Judge Kills FTC Lawsuit Against D-Link for Flimsy Security (dslreports.com) 100
Earlier this year, the Federal Trade Commission filed a complaint against network equipment vendor D-Link saying inadequate security in the company's wireless routers and internet cameras left consumers open to hackers and privacy violations. The FTC, in a complaint filed in the Northern District of California charged that "D-Link failed to take reasonable steps to secure its routers and Internet Protocol (IP) cameras, potentially compromising sensitive consumer information, including live video and audio feeds from D-Link IP cameras." For its part, D-Link Systems said it "is aware of the complaint filed by the FTC." Fast forward nine months, a judge has dismissed the FTC's case, claiming that the FTC failed to provide enough specific examples of harm done to consumers, or specific instances when the routers in question were breached. From a report: "The FTC does not identify a single incident where a consumer's financial, medical or other sensitive personal information has been accessed, exposed or misused in any way, or whose IP camera has been compromised by unauthorized parties, or who has suffered any harm or even simple annoyance and inconvenience from the alleged security flaws in the [D-Link] devices," wrote the Judge. "The absence of any concrete facts makes it just as possible that [D-Link]'s devices are not likely to substantially harm consumers, and the FTC cannot rely on wholly conclusory allegations about potential injury to tilt the balance in its favor."
Sounds about right... (Score:2)
Re: Sounds about right... (Score:5, Funny)
Excellent precedent to cite should I ever get pulled for dangerous driving...
Re: (Score:3, Insightful)
Excellent precedent to cite should I ever get pulled for dangerous driving...
If you ever get sued for dangerous driving, even though you didn't actually harm someone, it might help. But it has nothing to do with breaking the law.
Re: (Score:2)
There are craploads of examples of dangerous driving harming people.
Re: (Score:3)
There are craploads of examples of dangerous driving harming people.
OK. I agree. So what difference does that make? How many people have been sued for dangerous driving when nobody was harmed?
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Had people been injured from others who were doing dangerous driving. The FTC if showed harm from similar products from similar vulnerabilities then they may had a case.
Re: (Score:3, Insightful)
Could be viewed as a failure on the FTCs part I guess, but does anyone have any examples of consumers being harmed by D_Link being cheap POS hardware with poor security?
Possibly a failure to realize that they had a difficult case to make. While it is clear the there were deficiencies, this type of lawsuit requires harm to be shown. If a person was knowingly harmed due to this security lapse, I think we would have heard about it.
Re:Sounds about right... (Score:5, Insightful)
IMO, the judge is wrong in this case. This sort of action shouldn't require showing harm to individuals, because the harm isn't necessarily to the individual device owners. Most of the harm is to the people in aggregate.
Devices with security holes on the public Internet invariably eventually turn into botnets that attack systems in a distributed fashion, which harms the companies being attacked and the users that get locked out of their accounts. The harm to the owners is negligible, because they lose just a tiny bit of bandwidth. But the harm to society is huge.
And even in cases where the harm is to the individual owner, the harm could be impossible to prove, because you could never realistically be certain whether a password shared by several websites got stolen from one of those websites or from the unencrypted copy of the password on the user's router. But that doesn't mean that users weren't harmed. In effect, if this judge's opinion is allowed to stand, the government will be unable to prosecute the vast majority of cases in which consumers are harmed en masse by security-related negligence, and that's a bad thing.
Re: (Score:3)
IMO, the judge is wrong in this case. This sort of action shouldn't require showing harm to individuals, because the harm isn't necessarily to the individual device owners. Most of the harm is to the people in aggregate.
The harm to the owners is negligible, because they lose just a tiny bit of bandwidth. But the harm to society is huge.
Why is he wrong if the burden is on the plaintiff to show actual harm, and the plaintiff could not show actual harm? Would the judge have been right to not require evidence?
Re:Sounds about right... (Score:4, Informative)
Pretty much the first test of any civil lawsuit is whether there was any harm. If you can't demonstrate that, there is no case.
Re: (Score:1)
In my non-lawyer opinion, the negligence continues as long as updates remain unissued.
Re: (Score:3, Insightful)
But there was actual harm [wikipedia.org]. The Mirai botnet attacked other computers on the Internet, and as a part of that botnet, D-Link's routers probably did tens of millions of dollars of economic damage to the Internet as a whole. So there was very clearly harm. It just wasn't directed specifically at the owners of the devices. Rather, the owners of the devices were unknowingly being complicit in t
Re: (Score:2)
probably did tens of millions of dollars
Probably isn't good enough in court, and the malware you spoke of was not limited to D-Link.
Re: (Score:3)
Re: (Score:2)
Actually the legal definition of "reasonable doubt" is where you are less than 51% certain that a thing occurred.
reasonable doubt has no place in a lawsuit. That is for criminal prosecution.
Re: (Score:2)
Re:Sounds about right... (Score:4, Insightful)
What seems 'off' about this case is that the FTC legal department's lawyers surely understood basic civil law, but yet did not prepare their case with the requisite evidence of harm any such case has to demonstrate.
It makes me think maybe the FTC just wanted to *look like* they were "taking serious action" here when in reality they wanted the problem to quietly go away because of regulatory-capture/crony-capitalism.
Strat
Re: (Score:2)
Unfortunately, that's quite possible, particularly given the current political climate in Washington.
Re: (Score:2)
Unfortunately, that's quite possible, particularly given the current political climate in Washington.
And by "the current political climate in Washington" you mean the last several decades if not more, right? It's not like this sort of corruption just suddenly became a problem.
Strat
Re: (Score:2)
What I meant was that consumer protection in general tends to be a lower priority for Republicans, which compounds the problems caused by the corruption.
Re: (Score:2)
What I meant was that consumer protection in general tends to be a lower priority for Republicans, which compounds the problems caused by the corruption.
I am unconvinced that (D)isney is any better in that regard.
A pox on both their houses, I say.
Strat
Re: (Score:1)
It is OBVIOUS that (D)libidoop is better in this regard.
It's also obvious that neither (D)libidoopers or (R)ectalfaces are good enough.
I agree to the pox on both their houses.
Re:Sounds about right... (Score:4, Insightful)
Lawsuits are for righting wrongs. If you can't show anyone was wronged, then there is nothing to right.
Protecting people in aggregate is what statutes are for, and neither the FTC nor the judge can create a statute.
The judge ruled correctly.
Re:Sounds about right... (Score:5, Insightful)
But there's ample proof that people were harmed by the Mirai botnet, and much of that harm was the direct result of D-Link routers getting p0wn3d. What they lacked was proof that the owners of the devices were harmed, and the judge incorrectly jumped from "the owners weren't harmed" to "no one was harmed", when in fact that is clearly not the case.
Re: (Score:2)
Or, put another way - If it wasn't the fault of D-Link's negligence, then anyone harmed by the botnet has a claim against each individual owner of a compromised router.
Re: (Score:2)
So as soon as someone is sued because their crappy camera was part of the botnet, there will be grounds against D-Link by the defendant of that lawsuit.
Seems a little weird. If I run over someone because my car is poorly designed and spontaneously backs up without warning, does the victim sue me or the car company?
Re: (Score:2)
After customers report harm the case can be opened again. The Fact that the FTC had raised caution in the past can be extra evidence.
The law requiring to say your Coffee is hot on the cup only happens after someone burns themselves with it. For the Coffee case it would be trying to sue McDonnalds for brewing really hot coffee, where no one actually hurt themselves. Most people know pouring hot coffee can injure people. But it is legal to brew hot Coffee. However after proof the Coffee was too hot, then
Re: (Score:2)
This isn't really like the coffee case. In that case, the product harmed the actual user of the product. This is more like a home safety system that watches for unknown home invaders, and because of a bug, occasionally shoots random strangers that walk by on the street, incorrectly believing that they are inside the house. The owner of the home safety system is never harmed directly, but the product still causes harm, even when used as intended, even without any negligence on the part of the user.
Additi
Re: (Score:2)
The coffee didn't actually harm the "user" of the coffee as I am quite sure that putting coffee between your legs, then spilling it all over yourself and then not immediately removing the clothes is not how you are supposed to use coffee. Oh and I say that having just drunk a cup of coffee that was *hotter* than the one in question and I have not need admitting to hospital.
The judge agrees with you, FTC doesn't (Score:2)
> Most of the harm is to the people in aggregate.
> botnets that attack systems in a distributed fashion, which harms the companies being attacked and the users that get locked out of their accounts.
> The harm to the owners is negligible, because they lose just a tiny bit of bandwidth. But the harm to society is huge.
That's what the judge said. The FTC argued otherwise/
The judge wrote:
--
would likely be in the
ballpark of a âoesubstantial injury,â particularly when aggregated across a large
Re: (Score:1)
Windows seems to fit that description.
Re: (Score:2)
The easiest evidence would be to provide URLs to those sites that aggregate various unsecured cameras for voyeuristic viewing.
The problem is they would have to prove the makers of those cameras to show they aren't all shady Chinese junk (the kind that doesn't have D-Link's name on it, I mean), and it could be argued the whole site is staged and the people in the feeds aware of the camera being publicly available.
Re: (Score:2)
Perhaps the FTC's approach was off. (Score:4, Insightful)
D-Link PR material consistently claimed the highest security standards.
Seems like they should have gone after them for fraud and false advertising, given the abysmal lack of security in the systems that were sold for the purpose of making networks secure.
Re: (Score:3)
With security standards as they stand today, claiming the highest can be just as easy as not falling off the floor.
What is really needed is for an open standards body to function like UL, and have a set of security certifications for devices. Perhaps with a Sold Secure type of gold/silver/bronze level as well, where with the higher levels, the device is on more secure OS, there is auditing, the CPU is secure, and so on. Something where Joe Sixpack who wants something secure can buy something decent, or sp
Re: (Score:2)
Nah, that's just puffery.
Re:Innocent Until Proven Guilty (Score:4, Insightful)
The Judge made the right call. No evidence means no proof. No proof means they're innocent, even if they're guilty as hell.
There was plenty of evidence to show that the default security was absolute shit.
What was lacking here was common fucking sense that confirms when default security is absolute shit, data breaches are usually the end result.
Validation of that fact is likely strewn across decades of case law, so it was hiding about as well as an elephant herd in the room.
Re: (Score:3)
So.. You can now sue for negligence without having to prove any harm was actually done?
How on earth do you establish damages if you don't have evidence you where damaged in some way?
The judge did the right thing. The FTC dropped the ball and didn't have their ducks in a row. Sorry, go try again people...
Re: (Score:1)
How on earth do you establish damages if you don't have evidence you where damaged in some way?
The judge did the right thing. The FTC dropped the ball and didn't have their ducks in a row. Sorry, go try again people...
The poor security (lack of auditing, not protecting logs against deletion) is to blame for the lack of evidence.
Sometimes proof of negligence by itself is, or should be, enough. Actual damages should be based on actual harm, but an injunction (you cannot sell these products until you fix their security) and/or punitive damages (you harmed someone's privacy, which can't be easily measured in dollars and cents) are different.
Re: (Score:2)
So.. You can now sue for negligence without having to prove any harm was actually done?
How on earth do you establish damages if you don't have evidence you where damaged in some way?
The judge did the right thing. The FTC dropped the ball and didn't have their ducks in a row. Sorry, go try again people...
I think I'll go start an automotive company, and look to cut corners by removing all forms of safety restraints. No air bags. No seat belts. And I'll stand confident that I would never be found negligent until one of my customers is harmed or killed. I'll just make more profit and not care until some actual evidence of negligence manifests itself.
Yes, I'm well aware of the fact that such stupidity would never pass DOT regulation, ironically for the same fucking reason that blatantly shitty security prac
Re: (Score:2)
Then you are advocating that there should be a law or regulation to protect consumers from such stupidity, like the DOT's regulations keep you from selling vehicles which don't meet their safety standards.... Call your representatives and get that started.
However, in this case, the judge did the right thing in dismissing the case.
"You have no evidence of damages?"
"No sir."
"Then there is nothing to decide here, no damages to collect from D-Link.... Case Dismissed! Come back when you have evidence."
Re: (Score:2)
Yes, I do understand how historical evidence related to security breaches and common sense were all legally dismissed well before the judges gavel came down in this case. You are correct in that regulation and mandate are the only way you will ever get a manufacturer to pay attention to security.
Not sure even regulation or mandate will truly be effective. As we've seen in the financial sector, damn near any violation is well worth the fine, giving further evidence to show how fucked our legal system truly
Re: (Score:2)
There was plenty of evidence to show that the default security was absolute shit.
What was lacking here was common fucking sense that confirms when default security is absolute shit, data breaches are usually the end result.
Validation of that fact is likely strewn across decades of case law, so it was hiding about as well as an elephant herd in the room.
You and I see lots of evidence of poor security, but that is not the same thing as evidence of harm to the consumer. Schlage locks are very easy to pick, but I doubt that factors into most home burglaries.
Re: (Score:2)
For most homes a normal door lock is sufficient even in semi tough neighborhoods.
Sure nearly anyone can get in using a credit card or just some force. But most wont bother, so the basic lock is good enough for these people. If they are a storefront then they will normally have better locks.
So D-Link targeting consumers may have crap security but it may be good enough for average joe who is using it behind their cable modem router. Thus no one being harmed.
Re: (Score:2)
The government normally reflects the will of the people. Most people don’t realize risking 0.1% of your security from attacks from bad guys your privacy and personal freedom can double.
Right now we as a world are afraid of the mean old other guy who may have a few random attacks a year which in theory can be preventable. So we cry out “why didn’t we stop this before it happened, we have the technology to do this!” So the government implements the technology and may or may not catch
Judge, PROVE your ruling. (Score:3, Insightful)
Since the Judge doesn't believe that the blatant existence of shitty default security can and often will lead to data breaches, I suggest we force the Judge to install the hardware inside every room of their personal home.
If the Judge thinks it's so fucking secure, then put your privacy where your ruling is.
Re:Judge, PROVE your ruling. (Score:4)
Since the Judge doesn't believe that the blatant existence of shitty default security can and often will lead to data breaches
The judge didn't believe that because the plaintiffs didn't provide any evidence that it is true.
I suggest we force the Judge to install the hardware
I suggest we require plaintiffs to provide evidence to support their claims.
Re: (Score:1)
A court is a public arena where grievances are hauled out for airing, in the public.
So, what is the harm? We need real examples of actual harm, not theoretical ones. You can't sue over imagined harms.
Re:Judge, PROVE your ruling. (Score:4)
Since the Judge doesn't believe that the blatant existence of shitty default security can and often will lead to data breaches, I suggest we force the Judge to install the hardware inside every room of their personal home.
If the Judge thinks it's so fucking secure, then put your privacy where your ruling is.
Your comment makes my head hurt. If insufficient evidence of harm was provided, then it's not the judge's job to prove anything.
Re: (Score:2)
Even if nobody realizes they've been hacked due to that in particular, it was shown that their hardware is not secure.
And yet your FTC could cite no specific cases where unsecure hardware has caused harm. Your legal system lets D-Link get away with this. Is this how capitalism is meant to work? You get to do whatever you want until you're sued or charged and found guilty?
Re: (Score:1)
It shouldn't be too difficult for them to find one or two people who have been affected by this issue. Having shitty default security isn't a crime in and of itself (though perhaps it could be fraud if they tried to pass it off as really good security) so it requires someone who's actually been harme
Re: (Score:1)
The judge didn't rule that D-Link security was good. The judge ruled that the FTC did not have standing to sue, and did not bring a meritorious case, which was the correct ruling to make.
Re: (Score:2)
I'm not sure what this would accomplish.
The judge already knows to change the default password. Or if he didn't already know, after this lawsuit, he certainly knows to not to keep the default password.
What? (Score:2)
So now the legal standard is, "as long as no one ever got hurt, it's fine?" What if I build a cheap, shoddy bridge using unsafe practises? So long as it doesn't fall apart before the lawsuit, I'm not at fault? What a shitty country this is. I hope this gets appealed and overruled.
Re: (Score:2)
So, basically what we need a law punishing developers and system administrators for gross negligence in regards to security.
While I like the idea in theory, I don't like the idea of personally getting fined because I forgot to install a security patch or put a tough password on a system service account.
Re: (Score:3)
So now the legal standard is, "as long as no one ever got hurt, it's fine?" What if I build a cheap, shoddy bridge using unsafe practises? So long as it doesn't fall apart before the lawsuit, I'm not at fault? What a shitty country this is. I hope this gets appealed and overruled.
You bring up an interesting point. If you build a bridge using unsafe practices you would violate close and be subject to enforcement actions. Absent a law definingbminimum standards for routers then building one with poor security doesn't open you up to lawsuits until someone can prove actual damages. That's been part of the law for a long time, hypothetical future harms are not reason enough to be able to sue. To build on your bridge example, if you paint the entrance to look wider then it is someone can'
I doubt D-Link claimed their products were secure (Score:2)
Re: (Score:2)
From TFA:
According to the original FTC complaint, an agency inquiry found that while D-Link PR material consistently claimed the highest security standards, little to nothing was done by the company to eliminate a number of "well-known and easily preventable security flaws" that potentially put millions of residential consumers at risk.
Re: (Score:2)
The judge is a bigger threat to our security (Score:2)
So FTC can not ban any device till it can demonstrate at least one instance of actual harm? At least one baby must die before a choking hazard toy must be banned?
Technology changes and advances must faster than the rate at which we retire and replace our judges.
Re: (Score:3)
More likely he's an experienced judge who understands the law.
Suppose I walk past your house and see that one of the front steps is loose. Can I sue you for potentially harming me if I had tripped on that step (but didn't)?
The law doesn't change because it's on the internet.
A request for domumented crimes? (Score:2)
Stupid. Stupid. Stupid.
You just converted all the white hackers into black.