No Hack, Still Liable, Court Finds ADT

By: IPVM Team, Published on Jun 20, 2017

Recently, ADT has been in the news for a $16 million settlement for a cyber security vulnerability class action suit.

One of the most important and interesting points behind this settlement is a court order that found ADT could be found liable even if no actual hacks were proven. Many could see this as counterintuitive since what 'damage' had occurred if there was no hack / incident?

In this note, we examine that court order, how the Court reached that conclusion and what impact it might have on manufacturers and providers generally. 

********,*** *** **** ** the **** *** * $16 ******* ************* * ***** ******** vulnerability ***** ****** ****.

*** ** *** **** important *** *********** ****** behind **** ********** ** a ***** ***** **** found *** ***** ** found ****** **** ** no ****** ***** **** proven. **** ***** *** this ** **************** ***** what '******' *** ******** if ***** *** ** hack / ********?

** **** ****, ** examine **** ***** *****, how *** ***** ******* that ********** *** **** impact ** ***** **** on ************* *** ********* generally. 

[***************]

Executive *******

* ** ********** ***** in *********** ** *** found [**** ** ****** available] **** *** *** omitted ********** *** ************* despite ** ****** ** obligation ** ** **: 

*** ***** ********* **** Plaintiff ************ ******* **** *** **** him * **** ** disclose ******* *** *** ********* ********* of ******** ***** ******* to *********.

*** ********* / **** still ******, **** ******* an ****** ****, ***** the ***** ********* **** the ******** (*** ****) should **** ********* *** vulnerability *** *** *** sufficiently ** **.

Industry *********

*** ********** ***** ********** calls *** **** *** industry **** ***** ***** risks:

*** ************ ***** ** Plaintiff ** *** *** suggest **** *** ******** to ***** *** ******* **** ** the ************* ** ******** devices **** ****** ********* contracted **** ***.

Consumers *** ******** ** ****

** *** **** ****, the ********** ***** ***** that ********* ***** *** be ******** ** **** of ***** *****:

**** ********* *** ************ pleaded ******** ********* *** noting **** "[*]**** *********** customers ***** **** **** tipped *** ** *** possibility ** [* ******], many ********* ***** *** have ********* **** * search, *** ***** **** be ******** **").

Rejects **** ** *******

*** ********* ** *********** no ***** ** ****** hackings *** *** ***** rejected ****, ******* **** a ******** ***** *** have ****** *** ******** ** they ****:

* ****** **** *** be ********* ** ** material. ** ** ********* plausible **** * ********** consumer ***** ****** ********** to *** **** **** their **** ******** ****** could ** ****** ** hacked *** ********, **** absent ****** ********* ** such *******.

General ********** ******** ************

*** ***** ******** *** applying ***** ******* ********* language, **** **:

"*** *** *** ******* ***** signals ** ************** ** power ** *********** *** any ******" *** "** alarm ****** *** ******* complete ********** ** ********* prevention ** **** ** injury."

******* ** *********, *** Court ***** ** *** not ***** *** ******** risk:

**** ******** ** *** a ********** ** *** allegedly ******* ****, ****** that ADT's wireless ******* *** ********** to *******, *******, *** other **********. 

Misleading *********** / ********* ********* **** *******

*** ***** ************ ***** this ***** ** ******** the********** ****** *********** *** (UCL)*** *** ********** ********* ***** ******** Act (****), **** ******** ** protect ********* ******* ********** advertising *** ********* **** of *********.

Industry ******?

**********: **** **** *** offer ***** ****** *** recommends ********** ***'* *********.

**** * ******** ***********, it **** ***** ********. Many ***** ******* ***** security ***** *** **** an ***** ** ** actual ******* / **** / ****** ******. **** court ****, ** **** as *** ** ***'* ******* ******* *-****'* IP *******, *** ******** ** manufacturers ** ********* ****** legal ***** *** ********* penalties *** *********** ********** buyers ***** *** ******** risks *** ******** ***.

*** ************ *********** ********** factor ** ***'* ***** size ($* - $* billion ****** *******) ******** such ********. **** ********* that *** ******* *** not ******* ********** ***** / ******** ******* ** pursue **********. ********, ** is ******** **** ***'* monthly ******* ******* ***** increase **** *** ** financial ****** ** ******** manufacturers **** **** ******** for * ***-**** ******.

**** ***********, **** **** underscores **** * ******** claims (*.*., ******** ********) and ***** (*.*., ***** security *****) ***** ** used ** ****** ** sue * ******** **** if *** ***** *** not ******** **** ******, but ****** ****** **** they ***** *** **** bought * ******* ******** if *** ******** *** properly ********* / ****** marketed ***** ********. **** is *** **** ** risk **** ********* ****** carefully ********.

Comments (19)

Undisclosed Distributor #1

06/20/17 03:29pm

It's a very interesting read, but my interpretation is that any device that can ever, under any circumstances, be connected to the Internet must have a disclosure that it can be hacked.  This includes every PC ever built, routers/firewall, any "smart" product or IoT device, etc.  Back in the military they had a security rating for devices that a company providing computers was proud to claim, but they also noted that this security rating was immediately invalid if the computer was plugged into a network.

 

John Honovich

IPVM | In reply to Undisclosed Distributor #1 | 06/20/17 03:47pm

my interpretation is that any device that can ever, under any circumstances, be connected to the Internet must have a disclosure that it can be hacked

My interpretation (based on "The Court rejected ADT applying their general exclusion language") was that if something specific is known (e.g., unencrypted wireless), it needs to be specifically disclosed, not simply a generic 'anything can be hacked' statement.

Edgar Mora

06/20/17 04:04pm

I see this as an unforgiveable omision in ADT sales strategy.  When I used to sell monitoring services in my country (Costa Rica) we stated clearly in contract - that had to be signed by cliente- that our burglar alarm system and monitoring service was not an insurance policy.  We offered service as a way to lower probability of an intrusion and left clear probability of such undesirable event was never zero.

John Honovich

IPVM | In reply to Edgar Mora | 06/20/17 04:07pm

that had to be signed by cliente- that our burglar alarm system and monitoring service was not an insurance policy.

Edgar, in this case, my understanding is that such a disclosure / exclusion would not have made a difference, since neither ADT nor the plantiff allege that the system was an insurance policy.

I do not know what the consumer deceptive advertising laws are in Costa Rica, but in the USA, there are a fair number of such laws and those are the laws that are causing / driving this issue.

Jeremy Ellis

06/20/17 04:22pm

This is huge. The industry has relied on that contract language as an ultimate get out of jail free card for years. 

Undisclosed Manufacturer #2

06/21/17 02:18pm

It will be interesting to what the trickle down will be as a result of this ruling. 

With IoT becoming a focus in the PhySec space, the increase in liability for manufactures and integrators will only increase. There has always been tension in the retail market, with considerations for PCI compliance in the past, however, this could set a precedent that will affect many other systems connecting to the internet in virtually every vertical. 

One of the big questions I have is, "who is really responsible?"

- The manufacture (ADT being both in this case)

- The Integrator

- IT departments

- End-user... etc. 

As we become an increasingly connected society, the questions and challenges in front of us increase. 

I do not want to re-hash the recent issues of manufactures vulnerabilities, however I would argue that all manufactures and integrators need to get a solid handle on how to respond to these issues, not just from a technical perspective, but also from a liability standpoint. 

Avatar

Nick Giannakis

06/21/17 03:02pm

I asked this exact question to a discussion panel at SSN's TechSecSolutions conference earlier this year. The panel was an impressive collection of industry veterans and their response was a consensus that the responsibility is shared. 

Undisclosed Distributor #1

In reply to Nick Giannakis | 06/21/17 03:59pm

"Shared" implying that each of them can blame the others when it hits the fan and no one takes responsibility.  Almost as good as having that weatherman job.

Avatar

Luis Carmona

IPVMU Certified | 06/24/17 02:39pm

ADT countered by emphasizing no proof of actual hackings but the court rejected that, arguing that a consumer might not have bought the offering if they knew:

That's going to have an interesting effect on the bean counters who measure cost of liability versus cost of eliminating the problem. The common theme being "If we only expect $1M in lawsuits, but fixing the problem costs $1.5M, best to just leave the problem alone". I think this is a curve ball to the way things normally go in this area, and that the justice system may be trying to curve that kind of thinking.

Avatar

Mick Brown

06/29/17 11:03am

its about time the industry takes these matters seriously 

someone should take a class action suit against hikvision and dahua

their products are too easily hackable

 

Avatar

Mick Brown

06/29/17 12:03pm

Britain may go to war with foreign states attempting cyber attack on UK, Defence Secretary warns

Avatar

Mick Brown

06/29/17 01:29pm

every business has a duty of care the security industry has been putting money first

hik and dahua are at fault here too

they know their products are floored

 

 

Avatar

Robert Baxter

06/29/17 05:24pm

I looked at a copy of the Kirchenbaum contract, which the relevant section is reproduced below:

  1. WIRELESS AND INTERNET ACCESS CAPABILITIES: Subscriber is responsible for supplying high speed Internet access and or wireless services at Subscriber's premises. RADIUS does not provide Internet service, maintain Internet connection, wireless access or communication pathways, computer, smart phone, electric current connection or supply, or in all cases the remote video server.  In consideration of Subscriber making its monthly payments for remote access to the system RADIUS will authorize Subscriber access. RADIUS is not responsible for Subscriber's access to the Internet or any interruption of service or down time of remote access caused by loss of Internet service, radio or cellular or any other mode of communication used by Subscriber to access the system. Subscriber acknowledges that Subscriber's security system can be compromised if the codes or devices used for access are lost or accessed by others and RADIUS shall have no liability for such third party unauthorized access.  RADIUS is not responsible for the security or privacy of any wireless network system or router.   Wireless systems can be accessed by others, and it is the Subscriber's responsibility to secure access to the system with pass codes and lock out codes. RADIUS is not responsible for access to wireless networks or devices that may not be supported by communication carriers and upgrades to subscriber system will be at subscriber's expense.

In many cases providing managed video services we are providing the internet service, or the wireless service or connecting to the internet thru the customers equipment. I think these contracts need to address the different situations. 

John Honovich

IPVM | In reply to Robert Baxter | 06/29/17 07:17pm

Robert,

Thanks for sharing. I am not sure that the section you shared is germane to this issue, i.e.:

Subscriber is responsible for supplying high speed Internet access and or wireless services at Subscriber's premises....

RADIUS is not responsible for the security or privacy of any wireless network system or router. Wireless systems can be accessed by others, and it is the Subscriber's responsibility to secure access to the system with pass codes and lock out codes. [IPVM highlighted]

The way I read this is that it is a disclaimer about the user's own wireless network, not the wireless communications inherent / part of the alarm system. In the ADT case, they are saying that the ADT system's own wireless was insecure, not the homeowner's wireless network.

Agree/disagree? Am I missing something?

Related, I asked Kirschenbaum about this and he said he was planning a newsletter about this topic.

 

Avatar

Robert Baxter

In reply to John Honovich | 06/29/17 07:58pm

I was raising a related issue. What I was trying to get at is that the contract agreements used by ADT and Kirchenbaum contracts are making assumptions about how internet or wifi is provided as described in the above clause 9. To IPVM users who are using more internet connectivity than the alarm industry, likely may be using similar worded contracts. I see that managed video service providers (like IPVM users) are even more exposed to hacking than the alarm industry and probably don't have contracts to cover the range of liability exposure they face:

1. A customer site is hacked and the camera provider is blamed for the breach, even though it is caused by the customers own equipment, employees, practices,...

2. Lack of 2 level authentication, no encryption leading to a customer site being hacked. 

3. Passcodes shared by former employees to 3rd parties.

You can probably add to the list.

Contracts for our industry need to include wording that the big boys (Google, Apple, Microsoft) are using. 

John Honovich

IPVM | In reply to Robert Baxter | 06/29/17 08:11pm

A customer site is hacked and the camera provider is blamed for the breach, even though it is caused by the customers own equipment, employees, practices,...

Ok, but to be clear, the ADT / Edenborough case is not about a hack occurring at all, ergo the title of this post - 'No Hack, Still Liable'.

I am not contesting the clauses you reference. I am emphasizing that those clauses are not enough to handle the case of this post, because this is about false / misleading advertising, not damage from a hack.

David Fogle, CSEIP

In reply to John Honovich | 07/05/17 02:34pm

The issue at hand is the hacking of wireless alarm systems and the potential that someone could hack into the ADT burglar alarm via wireless transmitters and or keypads and manipulate the status of the alarm system to either cause an alarm to create a response or disable the device by some sort of jamming.

While in the absence of any case where it has been done successfully should be a mitigating point, but for some reason in California is was not.

Example: I sell you a house that has used a significant amount of fire resistant products to protect against fire does not mean your house will not burn down.

I could build the house out of all concrete and that still does not mean everything in the house will not burn and still result in a loss.

Absolute is a very tough standard to measure against.

 

Avatar

Ari Erenthal

In reply to David Fogle, CSEIP | 07/05/17 03:19pm

Example: I sell you a house that has used a significant amount of fire resistant products to protect against fire does not mean your house will not burn down.

If you sell fire resistant products that the manufacturer warned you a couple years back are flawed in some way, the consumer might be able to sue you even if their house didn't burn down. And your attorney might advise you to settle, too. That's more analogous to what happened here. 

Avatar

Mick Brown

07/05/17 03:36pm

i dont know how hik and dahua get away with it

theirs has inherent problems and no one cares

 

Read this IPVM report for free.

This article is part of IPVM's 6,306 reports, 842 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now

Related Reports

ADT Acquires Much Maligned "Defenders" on Jan 07, 2020
"The Defenders" has the dubious distinction of being ADT's largest partner and a long history of customer and employee complaints and...
Wyze Massive Data Leak on Dec 26, 2019
Wyze has exposed millions of user's data, as reported by Twelve Security, and confirmed by IPVM, who has spoken with Twelve Security and reviewed...
Arcules CEO Retracts False GDPR Claim + Dahua and Milestone Claims Examined on Dec 03, 2019
Arcules CEO has retracted a false claim about his organization being a "fully compliant GDPR company" after IPVM reporting (Arcules CEO Threatens...
Arcules CEO Threatens Over "Security Breach" on Nov 25, 2019
An Arcules employee called out a recent 'security breach', however, Arcules CEO disputed this as 'inaccurate' and threatened to sue IPVM. Inside...
Alarm Veteran "Demands A Criminal Investigation" Of UL on Oct 18, 2019
The Interceptor's Project pressure against UL continues to rise. Following Keith Jentoft's allegation that "UL Has Blood On Their Hands", Jentoft...
"UL Has Blood On Their Hands" Alleges The Interceptor / Keith Jentoft on Oct 14, 2019
"UL has blood on their hands" alleges Keith Jentoft of "The Interceptor Project". We examined The Interceptor in-depth last year, see: The...
Cisco Settles False Claims Act Suit For Video Surveillance Vulnerabilities on Aug 01, 2019
Cisco entered the video surveillance market in 2007 and suffered for many years through a variety of its own errors and arrogance. The conclusion...
First Video Surveillance GDPR Fine In France on Jul 08, 2019
The French government has imposed a sizeable fine on a small business for violating the GDPR after it constantly filmed employees without informing...
Ex-Integrator Now Growth Strategist Interviewed on Apr 24, 2019
For more than a decade, Scot MacTaggart [link no longer available] was a security integrator (at PA-based PSX). In late 2018, he left the industry....
UK Installer CCTV Aware - Flat Pricing, No Salespeople on Apr 10, 2019
This is a different kind of company. They do flat pricing, they do not have any salespeople and 50% of their sales are sold and booked...

Most Recent Industry Reports

EyePark Presents Mobile Driver Authentication on Jun 05, 2020
EyePark presented its long-range QR code parking verification platform at the May 2020 IPVM Startups show. A 30-minute video from EyePark...
Bleenco "Under The Tongue" Temperature Detection Examined on Jun 05, 2020
"Say aah", says Bleenco, a PPE detection video analytics company, offering a different method for measuring body temperature with a thermal...
Hikvision and Uniview Entry Level Thermal Handheld Cameras Tested on Jun 05, 2020
While most screening systems cost $10,000 or more, manufacturers such as Hikvision and Uniview have now released handheld models for $1,000 or...
Sequr Presents HID based Cloud Access Control on Jun 04, 2020
Sequr presented HID based Cloud Access Control at the May 2020 IPVM Startups show. Inside this report: A 30-minute video from Sequr...
VergeSense Presents People Tracking Sensor on Jun 04, 2020
VergeSense presented its people tracking sensor and social distancing insights at the May 2020 IPVM Startups show. A 30-minute video from...
FLIR A Series Temperature Screening Cameras Tested on Jun 04, 2020
FLIR is one of the biggest names in thermal and one of the most conservative. While rivals have marketed fever detection, FLIR has stuck to EST...
"Fever Camera" Show On-Demand Watch Now on Jun 03, 2020
IPVM has successfully completed the world's first "Fever Camera" show. Recordings from Both days are posted at the end of this report for on-demand...
Cobalt Robotics Presents Indoor Security and Access Robots on Jun 03, 2020
Cobalt Robotics presented indoor security robots at the May 2020 IPVM Startups show. Inside this report: A 30-minute video from Cobalt...
Dahua Sues Ex-North American President, Says Legal Typo on Jun 03, 2020
Dahua's former North American President Frank Zhang claims he is owed almost $11 million but Dahua counter claims it is just a "scrivener's error",...
Smart Entry Systems Presents Cloud Multi-Tenant Access Control on Jun 02, 2020
Smart Entry Systems presented Cloud Multi-Tenant Access Control at the May 2020 IPVM Startups show. Inside this report: A 30-minute video...