Antitrust Law Daily Wrap Up, PRIVACY NEWS: Marketer of hacked security cameras resolves FTC concerns over “lax security practices”, (Sep 4, 2013)

TRENDnet, Inc., a company that markets Internet Protocol (IP) security cameras that allow users to conduct remote surveillance of their homes and businesses via the Internet, has agreed to settle FTC charges that it failed to protect consumers’ privacy. The FTC announced today a proposed complaint and proposed consent order that would settle the FTC’s concerns over what the agency called “lax security practices” (In the Matter of TRENDnet, Inc., FTC File No. 1223090).

The agency alleged that TRENDnet engaged in unfair acts or practices in violation of Section 5 of the FTC Act by failing to provide reasonable security to prevent unauthorized access to the live feeds from its IP cameras. In addition, the company allegedly misrepresented that it had taken reasonable steps to ensure: (1) that its IP cameras and mobile apps were a secure means to monitor private areas of a consumer’s home or workplace and (2) that a user’s security settings would be honored.

TRENDnet was the victim of hackers in early 2012. The hackers discovered a flaw in the IP cameras that allowed access to these live feeds without entering login credentials. As a result, hundreds of previously private live feeds were made public, according to the FTC.

TRENDnet acknowledged that hackers were able to gain unauthorized access to TRENDnet’s IP Camera video feeds for select models sold between April 2010 and February 2012. The company said in a February 2012 statement that it had initiated immediate actions to quantify the scope of the issue, initiate corrective actions, and publish updated firmware to resolve the issue. The company’s president later issued an apology.

Following an investigation, the FTC concluded that TRENDnet failed to provide reasonable security to prevent unauthorized access to the live feeds from the IP cameras. The agency alleged that the company failed to follow certain basic security practices. According to the FTC, TRENDnet, among other things, failed to secure transmissions of login credentials over the Internet; failed to properly secure stored login credentials; failed to implement a process to actively monitor security vulnerability reports from third parties; and failed to employ reasonable and appropriate security in the design and testing of the software that it provided consumers for its IP cameras.

Proposed consent order. The proposed FTC consent order would prohibit TRENDnet from misrepresenting (1) the extent to which TRENDnet or its products or services maintain and protect the security of covered device functionality or the security, privacy, confidentiality, or integrity of any covered information; and (2) the extent to which a consumer can control the security of any covered information input into, stored on, captured with, accessed, or transmitted by a covered device. The settlement also would require TRENDnet to establish and maintain a comprehensive security program. The company also would be required to obtain third-party assessments of its security programs every two years for the next 20 years.

Under the terms of the proposed consent order, TRENDnet must notify customers about the security breaches and the availability of the software update to correct them. The company also must provide customers with free technical support for the next two years to assist them in updating or uninstalling their cameras.

“Internet of Things.” According to the FTC’s announcement, this is the agency’s first action against a marketer of an everyday product with interconnectivity to the Internet and other mobile devices—commonly referred to as the “Internet of Things.”

“The Internet of Things holds great promise for innovative consumer products and services,” said FTC Chairwoman Edith Ramirez. “But consumer privacy and security must remain a priority as companies develop more devices that connect to the Internet.”

Attorneys: Laura Berger and Andrea Arias for FTC. John L. Sun (Law Officers of John L. Sun) for TRENDnet, Inc.

Companies: TRENDnet, Inc.

News: ConsumerProtection Privacy FederalTradeCommissionNews