On May 22, 2017, New York Attorney General Eric Schneiderman announced a settlement with Safetech Products LLC (“Safetech”) over allegations that the Internet of Things (IoT) company sold insecure wireless door and padlocks. According to the Attorney General, the settlement marks the first time a state Attorneys General has taken legal action against a wireless security company for failing to protect their consumer’s personal and private information.
Safetech offers customers Bluetooth-enabled locks. According to the Attorney General, Safetech represented to consumers that its products would allow users to protect personal belongings inside their homes by turning doors and closets into secure areas. However, in 2016, independent researchers found that Safetech’s Bluetooth-enabled locks transmitted passwords between the locks and the user’s smartphone in plain text without encryption, allowing potential perpetrators to intercept the passwords and open the locks. The researchers also discovered that the locks contained weak and insecure default passwords that could easily be solved or discovered through brute force attacks of automated software used to generate a large number of consecutive guesses.
As part of the settlement agreement, Safetech agreed to establish and implement a written comprehensive security program that is reasonably designed to (1) address security risks related to the development and management of new and existing devices that use security information, and (2) protect the privacy, security, confidentiality, and integrity of security information, including:
- The designation of an employee or employees to coordinate and be accountable for the security program;
- The identification of material internal and external risks to (a) the security of the devices that could result in unauthorized access to or unauthorized modification of the device, and (b) the privacy, security, confidentiality, and integrity of security information;
- The risk assessments considering each area of relevant operation, including, but not limited to: (a) employee training and management, including secure engineering and defensive programming; (b) product design, development, and research; (c) secure software design, development, and testing; (d) review, assessment, and response to third party security vulnerability reports, and (e) prevention, detection, and response to attacks, intrusions, or systems failures;
- The design and implementation of reasonable safeguards to control the risks identified through risk assessment;
- Regular testing or monitoring of the effectiveness of the safeguards’ key controls, systems, and procedures including reasonable and appropriate security testing techniques such as vulnerability and penetration testing, security architecture reviews and code reviews;
- The development and use of reasonable steps to select and retain service providers (if any are hired) capable of maintaining security practices consistent with the agreement, and requiring service providers by contract to implement and maintain appropriate safeguards consistent with the agreement; and
- The evaluation and adjustment of Safetech’s security program in light of the results of the testing and monitoring required by the agreement.
The New York Attorney General’s action is notable in that it marks the first time that a State Attorney General has taken action against an IoT company over security representations. In recent years, the FTC has established itself as a lead regulator in the space. As we noted here, the FTC recently brought an action against D-Link alleging UDAP violations related to the company’s security vulnerabilities. There, the FTC alleged that D-Link failed to adequately secure software for D-Link routers and IP cameras, and misrepresenting through their security event response policy, router and IP camera promotional material, and router graphical user interface that the software was secure. Similarly, last year, the FTC settled with another IoT company, ASUSTek Computer, Inc. Read our blog post here. There, the FTC alleged that ASUS had engaged in unfair and deceptive acts or practices by marketing their routers and cloud services as “secure” while knowing about and failing to fix serious vulnerabilities.
Going forward, IoT companies should expect continued scrutiny not only from the FTC, but also state Attorneys General.
The Cyber Security, Information Governance & Privacy team at Troutman Sanders is well-positioned to help companies develop procedures for effectively handling security issues. Because of our team’s technical background, we are uniquely positioned to understand companies’ IoT technology concerns and to address any risks from a legal perspective. We routinely advise businesses on security and privacy best practices with respect to connected devices, which help to avoid acts or practices that may be considered unfair or deceptive.