FTC MOTION FOR SUMMARY JUDGMENT

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

ALDEN F. ABBOTT

GENERAL COUNSEL

Kevin H. Moriarty (D.C. Bar No. 975904)

Cathlin Tully (NY Bar)

Shameka L. Walker (D.C. Bar No. 493891)

Jarad A. Brown (Ca. Bar No. 294516)

Katherine E. McCarron (D.C. Bar No. 486335)

James A. Trilling (D.C. Bar No. 467273)

Federal Trade Commission

600 Pennsylvania Avenue NW, Mail Drop CC-8232

Washington, DC 20580

P: (202) 326-2949/F: (202) 326-3062

kmoriarty@ftc.gov; ctully@ftc.gov; swalker@ftc.gov; 

jbrown4@ftc.gov; kmccarron@ftc.gov; jtrilling@ftc.gov

Attorneys for Plaintiff Federal Trade Commission

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA

SAN FRANCISCO DIVISION

FEDERAL TRADE COMMISSION,

Plaintiff,

v.

D-LINK SYSTEMS, INC.,

Defendant.

No. 3:17-CV-00039-JD

FEDERAL TRADE COMMISSION’S

MOTION FOR SUMMARY 

JUDGMENT ON LIABILITY ON 

COUNTS 2, 3, AND 6

Hearing Date: November 8, 2018

Hearing Time: 10:00 a.m.

Location: Courtroom 11, 19th Floor

Judge: Hon. James Donato

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 1 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page i 

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

TABLE OF CONTENTS

TABLE OF CONTENTS.................................................................................................................I

TABLE OF AUTHORITIES ..........................................................................................................II

NOTICE OF MOTION FOR SUMMARY JUDGMENT.............................................................. 1

MEMORANDUM OF POINTS AND AUTHORITIES ................................................................ 1

I. INTRODUCTION ........................................................................................................ 1

II. FACTUAL BACKGROUND.......................................................................................... 2

III. LEGAL STANDARD ................................................................................................... 4

A. Summary Judgment Standard ..................................................................... 4

B. Elements of Deception Under the FTC Act................................................ 4

1. Determining What Claims Are Made in the Representations......... 5

2. Determining Whether the Claims Were Likely to Mislead ............ 5

3. Determining Whether the Claims Are Material.............................. 5

IV. LIABILITY ARGUMENT ............................................................................................. 6

A. D-Link’s Security Event Response Policy (“SERP”) Claims 

Violate the FTC Act (Count 2; Complaint Exhibit 1)................................. 6

1. D-Link Claims It Engaged in Particular Software Security 

Practices in Its SERP. ..................................................................... 7

2. D-Link’s SERP Was Likely to Mislead Because D-Link 

Did Not Engage in the Claimed Software Security 

Practices. ......................................................................................... 9

3. D-Link’s SERP Claims Are Material Because They Are 

Express and Because Security Is a Central Characteristic of 

Routers and IP Cameras................................................................ 13

B. D-Link’s Router Brochures Claims Violate the FTC Act (Count 3; 

Complaint Exhibits 2-5)............................................................................ 15

1. D-Link Router Brochures Promoted the High Quality of 

Their Security................................................................................ 15

2. D-Link’s Router Brochures Claims Are Likely to Mislead 

Because the Routers Were Not Secure from Basic Threats.......... 20

3. D-Link’s Router Brochures Claims Are Material Because 

They Are Express and Refer to Central Characteristics of 

Routers. ......................................................................................... 21

C. D-Link’s IP Camera Interface Claims Violated the FTC Act 

(Count 6; Complaint Exhibits 10-11) ....................................................... 22

1. D-Link Made Claims in Its IP Camera Interface that Setting 

a Password Would Secure the Device. ......................................... 22

2. D-Link’s IP Camera Interface Claims Are Likely to 

Mislead Because the Devices Had Another Secret 

Password that Could Be Used Maliciously for 

Unauthorized Access. ................................................................... 23

3. D-Link’s IP Camera Interface Claims Are Material 

Because They Are Express and Because They Relate to a 

Central Characteristic of IP Cameras............................................ 24

CONCLUSION............................................................................................................................. 25

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 2 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page ii 

CASE NO. 3:17-CV-00039-JD 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

TABLE OF AUTHORITIES 

Cases

Celotex Corp. v. Catrett, 477 U.S. 317 (1986) ........................................................................... 4, 5 

Cliffdale Assocsiates, Inc., 103 F.T.C. 110 (1984) ........................................................... 5, 6, 7, 16 

Commerce Planet, 878 F. Supp. 2d 1048 (C.D. Cal. 2012) ............................................................ 5 

FTC v. AMG Services, Inc., 29 F. Supp. 3d 1338 (D. Nev. 2014) .................................................. 6 

FTC v. Colgate-Palmolive Co., 380 U.S. 374 (1965) ..................................................................... 5 

FTC v. Cyberspace.com, LLC, 453 F.3d 1196 (9th Cir. 2006) ............................................. 6, 8, 16 

FTC v. Figgie International, Inc., 994 F.2d 595 (9th Cir.1993) ..................................................... 6 

FTC v. Gill, 71 F. Supp. 2d 1030 (C.D. Cal. 1999) ........................................................................ 6 

FTC v. Medlab, 615 F. Supp. 2d 1068 (N.D. Cal. 2009) .......................................................... 9, 24 

FTC v. Mortgage Relief Advocates LLC, No. CV-14-5434-MWF (AGRx), 2015 WL 11257575, 

at *2 (C.D. Cal. July 1, 2015) .............................................................................................. 7, 15 

FTC v. Pantron I Corp., 33 F.3d 1088 (9th Cir. 1994) .......................................................... passim 

FTC v. QT, Inc., 448 F. Supp. 2d 908 (N.D. Ill. 2006) ................................................................... 7 

FTC v. US Sales Corp., 785 F. Supp. 737 (N.D. Ill. 1992) ............................................................ 5 

Kraft, Inc. v. FTC, 970 F.2d 311 (7th Cir. 1992) ............................................................................ 5 

Nissan Fire & Marine Ins. Co. v. Fritz Cos., 210 F.3d 1099 (9th Cir. 2000) ................................ 4 

Resort Car Rental Systems, Inc. v. FTC, 518 F.2d 962 (9th Cir. 1975) ......................................... 6 

Simeon Mangement Corp. v. FTC, 579 F.2d 1137 (9th Cir. 1978) ...................................... 6, 9, 24 

Thompson Medical Co., Inc., 104 F.T.C. 648 WL 565377, at *102 (1984) (FTC) ................ 14, 21 

Statutes

15 U.S.C. § 45(a) (2012) ............................................................................................................. 1, 4 

Rules

FEDERAL RULES OF CIVIL PROCEDURE 56(a) .................................................................................. 4 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 3 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 1 

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

NOTICE OF MOTION FOR SUMMARY JUDGMENT

On November 8, 2018, at 10:00 a.m., pursuant to Federal Rule of Civil Procedure 56, the 

Federal Trade Commission (“FTC”) will move this Court for summary judgment against D-Link 

Systems, Inc., for violations of Sections 5(a) of the FTC Act, 15 U.S.C. § 45(a) (2012).

The FTC respectfully requests this Court to grant summary judgment against Defendant 

as to liability on all three counts remaining in this case. As explained below, the FTC has 

established sufficient material facts, about which there is no genuine dispute, to support a finding 

that Defendant is liable as a matter of law. The FTC has attached a proposed order granting 

summary judgment as to liability and ordering additional briefing on injunctive relief.

1

MEMORANDUM OF POINTS AND AUTHORITIES

I. INTRODUCTION

D-Link Systems, Inc. (“D-Link”) promises consumers that the software on D-Link 

routers and IP cameras is secure from unauthorized access. D-Link has made these promises on 

its website, on its brochures advertising its routers, and in the consumer interface for its IP 

cameras. These promises are false and misleading. D-Link routers and IP cameras have many 

serious, foreseeable, easily preventable, and undisputed security vulnerabilities that permit 

unauthorized access to these devices.

The vulnerabilities in D-Link routers and IP cameras reflect real threats to consumers’

privacy and security. Because these vulnerabilities exist on devices that are the digital and 

physical gateway into the home, they afford criminals the opportunity to invade consumers’ 

privacy and steal their personal information. Cybercriminals often target vulnerable routers to 

access consumers’ personal information, commit fraud, and to use the routers as “bots” to mask 

the origin of criminal attacks launched across the Internet. Cybercriminals target Internetconnected devices to surveil activities inside consumers’ homes.

 1 The FTC believes that broad injunctive relief is appropriate, but that is beyond the scope of this 

motion. Accordingly, the FTC has attached a proposed order reflecting a finding of liability. 

The scope of injunctive relief to protect consumers from D-Link’s practices violating the FTC 

Act is properly the subject matter of separate briefing.

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 4 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 2 

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

A trial is unnecessary in light of the undisputed record. D-Link does not dispute that it 

made the representations at issue. There is no genuine dispute that D-Link routers and IP 

cameras have contained serious, foreseeable, and easily preventable vulnerabilities permitting 

unauthorized access; that D-Link knew of these vulnerabilities; and that D-Link sold and 

marketed these devices as secure anyway. Further, there is no genuine dispute that D-Link’s 

representations regarding the security of its devices are material to consumers.

II. FACTUAL BACKGROUND

D-Link is a California-based corporation that markets and sells IP cameras that connect 

to the Internet (“D-Link cameras”) and routers (“D-Link routers”) under the D-Link brand 

(collectively, “D-Link devices”). D-Link Corporation is the Taiwanese-based parent corporation 

to D-Link. In its Complaint, the FTC alleges that D-Link deceived consumers when it promised, 

then failed, to take reasonable steps to protect D-Link devices2 from unauthorized access.3

The Complaint alleges that D-Link, has made a series of misrepresentations to U.S. 

consumers regarding the security of D-Link devices. Specifically, D-Link:

• published a “Security Event Response Policy” on its website, that touted 

the fact that D-Link “prohibited” features, such as undocumented account 

credentials and backdoors, that would allow unauthorized access on DLink devices (Count 2);

4

 2 Brown Decl. Ex. 1, App. A to Pl.’s Fourth Am. Initial Disclosures (identifying the routers and 

IP cameras that are at issue in this case).

3 Compl. for Perm. Inj. and Other Equitable Relief (“FTC Compl.”) (Mar. 20, 2017) ¶ 15 (Dkt. 

No. 44). The original complaint also named D-Link Corporation. Notwithstanding the central 

role D-Link Corporation plays in developing D-Link devices, the FTC agreed to dismiss D-Link 

Corporation for two reasons. First, D-Link accepted responsibility for the relevant secure 

software development practices when it represented to this Court that “D-Link Systems is 

responsible for addressing any potential security vulnerabilities for any products that are sold by 

D-Link Systems in the United States.” Brown Decl. Ex. 15, Decl. of William Brown in Supp. of 

D-Link Corp.’s Mot. to Dismiss ¶ 25 (Apr. 3, 2017) (Dkt. No. 50-2). Second, based on D-Link’s 

representations to this Court, the FTC is satisfied that this Court would be able to fashion 

injunctive relief sufficient to protect consumers from the sale and marketing by D-Link of routers 

and IP cameras that are not secure from unauthorized access.

4 Brown Decl. Ex. 2, FTC Compl. Ex. 1 (“PX 1”).

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 5 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 3 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

• marketed its routers as providing “advanced” network security or being 

“one of the safest” routers that are secure from unauthorized access (Count 

3);5 and, 

• represented to consumers through a graphical user interface that setting a 

password would secure certain D-Link IP cameras from unauthorized 

access (Count 6).6

Contrary to these assurances, and as explained in the Liability Argument at Section IV, D-Link 

did little to try to develop devices that were secure from well-known, preventable 

vulnerabilities.7 

 

 As a 

result, even those devices that D-Link blithely promoted as among the “safest”10 and with 

“great”11 network security were regularly released with well-known and preventable security 

vulnerabilities.12

 

 A top executive of D-Link readily admits, 

for example, that Worse, it is 

undisputed that D-Link looked the other way while its primary online distributors continued to 

sell D-Link IP cameras that D-Link knew had dangerous backdoors that permitted a third party to 

 

5

 Brown Decl. Ex. 3, FTC Compl. Exs. 2-5 (“PX 2-5”).

6

 Brown Decl. Ex. 4, FTC Compl. Exs. 10-11 (“PX 10-11”). The FTC’s original complaint 

included three additional counts, which the Court dismissed on D-Link’s motion to dismiss. 

FTC Compl. ¶¶ 28-29, 37-42; Order on Mot. to Dismiss (Sept. 19, 2017) (Dkt. No. 90). 

7 See Section IV. A.2., B.2., C.2. 

8 Id. 9 Id. 10 See Brown Decl. Ex. 4, FTC Compl. Ex. 5 (“PX 5”). 

11 See Brown Decl. Ex. 4, FTC Compl. Ex. 2 (“PX 2”). 

12 See Section IV. A.2., B.2., C.2. 

13 Id. 14 See Brown Decl. Ex. 5, Wang Dep. 174:4-16 ( 

”).

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 6 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 4 

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

view the feed with the easily-guessed credentials of username “guest” and password “guest.”15 

Instead of developing set-up software that would require an update to fix this vulnerability, DLink pushed out updates only to consumers who separately signed up for D-Link’s “mydlink 

cloud” service.16 And, instead of warning consumers or recalling these cameras, D-Link did the 

opposite: It published its Security Event Response Policy, promising consumers that such 

backdoors were “prohibited,” and were given the “highest priority.”17

There is no genuine issue as to these facts and, for these reasons alone, summary 

judgment is appropriate as to all remaining counts.18

III. LEGAL STANDARD

A. Summary Judgment Standard

Summary judgment is appropriate “if the movant shows that there is no genuine dispute 

as to any material fact and the movant is entitled to judgment as a matter of law.” FED. R. CIV. P.

56(a). A party moving for summary judgment must show the absence of a genuine dispute as to 

any material fact with respect to an essential element of the non-moving party’s claim, or to a 

defense on which the non-moving party will bear the burden of persuasion at trial. Celotex Corp. 

v. Catrett, 477 U.S. 317, 322-23 (1986); Nissan Fire & Marine Ins. Co. v. Fritz Cos., 210 F.3d 

1099, 1102 (9th Cir. 2000). The burden then shifts to the opposing party to designate “specific 

facts showing there is a genuine issue for trial.” Celotex, 477 U.S. at 324.

B. Elements of Deception Under the FTC Act

An act or practice is deceptive pursuant to 15 U.S.C. § 45(a) (2012) if “first, there is a 

representation, omission, or practice that, second, is likely to mislead consumers acting 

reasonably under the circumstances, and third, the representation, omission, or practice is 

 15 See Section IV. A.2.

16 Id. 17 See Brown Decl. Ex. 4, FTC Compl. Ex. 1 (“PX 1”).

18 As set forth below, there are sufficient undisputed facts now to support summary judgment. If 

this matter proceeds to trial, however, the FTC will present additional facts to support a finding 

of liability, including that that D-Link’s software development program was not capable of 

preventing serious, well-known, foreseeable, and easily preventable vulnerabilities.

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 7 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 5 

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

material.” FTC v. Pantron I Corp., 33 F.3d 1088, 1095 (9th Cir. 1994) (quoting and adopting 

standard in Cliffdale Assocs., Inc., 103 F.T.C. 110, 164–65 (1984)) (emphasis added).

1. Determining What Claims Are Made in the Representations

To establish deception, the FTC must first demonstrate that D-Link made the challenged 

representations. No additional facts are necessary to interpret the language of the statements 

themselves: the Court can simply read the D-Link’s statements to understand their meaning. 

FTC v. US Sales Corp., 785 F. Supp. 737, 745 (N.D. Ill. 1992) (citing FTC v. Colgate-Palmolive 

Co., 380 U.S. 374 (1965)). The Court does not need a consumer survey or other extrinsic 

evidence to support a finding that a representation violates Section 5 of the FTC Act; a facial 

analysis is sufficient. Kraft, Inc. v. FTC, 970 F.2d 311, 318-19 (7th Cir. 1992); see also 

Commerce Planet, 878 F. Supp. 2d 1048, 1068 (C.D. Cal. 2012) (citing Kraft).

When interpreting an implied representation, the Court should evaluate “the overall, 

common sense ‘net impression’ of the representation or act as a whole to determine whether it is 

misleading,” FTC v. AMG Servs., Inc., 29 F. Supp. 3d 1338, 1349 (D. Nev. 2014) (quoting 

Commerce Planet, 878 F. Supp. 2d at 1063). A representation “capable of being interpreted in a 

misleading way should be construed against” the party making the representation. Simeon 

Mgmt. Corp. v. FTC, 579 F.2d 1137, 1146 (9th Cir. 1978) (quoting Resort Car Rental Sys., Inc. 

v. FTC, 518 F.2d 962, 964 (9th Cir. 1975)).

2. Determining Whether the Claims Were Likely to Mislead

Simply put, representations are misleading when they are false. Pantron I, 33 F.3d at 

1096. Both express and implied claims may violate the FTC Act. FTC v. Gill, 71 F. Supp. 2d 

1030, 1043 (C.D. Cal. 1999); FTC v. Figgie Int’l., Inc., 994 F.2d 595, 604 (9th Cir.1993)

(“[Defendant] can point to nothing in statute or case law which protects from liability those who 

merely imply their deceptive claims; there is no such loophole.”).

3. Determining Whether the Claims Are Material

A misleading impression created by a representation is material if it “involves 

information that is important to consumers and, hence, likely to affect their choice of, or conduct 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 8 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 6 

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

regarding, a product.” FTC v. Cyberspace.com, LLC, 453 F.3d 1196, 1201 (9th Cir. 2006)

(quoting Cliffdale Assocs., 103 F.T.C. at 165). Certain types of representations are 

presumptively material, including express product claims, Pantron I, 33 F.3d at 1095-96, health 

and safety claims, FTC v. QT, Inc., 448 F. Supp. 2d 908, 960 (N.D. Ill. 2006), claims involving 

purpose, safety, or efficacy, Cliffdale Assocs., 103. F.T.C. at 182, and express or implied claims 

relating to a product’s central characteristics, FTC v. Mortg. Relief Advocates LLC, No. CV-14-

5434-MWF (AGRx), 2015 WL 11257575, at *2 (C.D. Cal. July 1, 2015).

IV. LIABILITY ARGUMENT

Summary judgment is appropriate here because there is no dispute that: (a) D-Link made 

representations that D-Link devices were secure from unauthorized access; (b) D-Link devices 

contained many vulnerabilities, which made D-Link devices not secure from unauthorized 

access; and (c) D-Link’s statements about security are material to consumers.

This section discusses each of D-Link’s alleged misrepresentations separately. It first 

discusses the claims made in D-Link’s Security Event Response Policy (“SERP”). Next, it 

discusses D-Link’s claims in the promotional brochures for its routers. Finally, it discusses DLink’s claims in the user interface for its IP cameras.

A. D-Link’s Security Event Response Policy (“SERP”) Claims Violate the FTC 

Act (Count 2; Complaint Exhibit 1)

The FTC prevails on Count 2 because D-Link’s SERP deceived consumers through its 

express claims about the security of its devices and through the net impression conveyed by the 

SERP in its entirety—that D-Link took reasonable steps to secure its devices from unauthorized 

access.19 In fact, these express and implied claims were false.

 19 See FTC Compl. ¶¶ 31-33; Brown Decl. Ex. 2, PX 1.

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 9 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 7 

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1. D-Link Claims It Engaged in Particular Software Security Practices

in Its SERP.

There is no factual dispute that the SERP contains express claims related to the security 

of D-Link’s devices.20 Specifically, in the section “D-Link’s Commitment to Product Security,” 

D-Link explicitly promises:

D-Link prohibits at all times, including during product development by D-Link or 

its affiliates, any intentional product features or behaviors which allow 

unauthorized access to the device or network, including but not limited to 

undocumented account credentials, covert communication channels, “backdoors” 

or undocumented traffic diversion. All such features and behaviors are 

considered serious and will be given the highest priority.21

This statement expressly notes that D-Link will “prohibit” any “features or behaviors” that 

“allow unauthorized access.” Despite its express claims, D-Link’s devices did in fact contain, 

and continue to contain, both undocumented account credentials and backdoors. D-Link did not 

disclose the existence of these vulnerabilities to consumers.

In addition to the foregoing express claims, a facial analysis of D-Link’s SERP 

representations reveals that D-Link creates the net impression that it has taken reasonable steps 

to secure its products from unauthorized access. See FTC v. Cyberspace, 453 F.3d at 1200

(stating that a representation “may be likely to mislead by virtue of the net impression it creates 

even though [it] also contains truthful disclosures.”). In the SERP, D-Link also assures 

consumers that: 

• it uses global “security event response teams” that work with and respond 

to “customers, vendors, partners, consultants, security researchers, 

industry organizations, and others to identify potential security issues in 

our products”;

 20 There is no factual dispute that D-Link disseminated the SERP on its website from 

approximately December 2013 to September 2015. D-Link Sys. Answer to FTC Compl. ¶ 20 

(Oct. 3, 2017) (Dkt. No. 92) (“DLS admits that from approximately December 2013 until 

September 2015, a document titled “Security Event Response Policy” was posted on its webpage 

at http://support.dlink.com/securityadvisories.aspx.”). This motion describes the SERP in the 

past tense, because it was eventually taken down. By contrast, the router brochures and the GUI 

representations remain on the D-Link website and software set-up wizard, respectively, and so 

are describe in the present perfect tense.

21 Brown Decl. Ex. 2, PX 1.

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 10 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 8 

CASE NO. 3:17-CV-00039-JD

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

• it encourages anyone who suspects a product security issue to bring that 

concern to the attention of its security event response team;

• the “security event response team” monitors security requests received via 

e-mail on a 24/7/365 basis; that “Reports [of security vulnerabilities] are 

typically acknowledged within 24 hours” and “Plan of actions are 

typically offered with in [sic] 48 hours of a recognition and posting of a 

report”; and

• consumers can readily track security vulnerability information from DLink by accessing any of various sources (web, e-mail, RSS, Twitter, or 

various public relations contacts).22

A facial analysis of the SERP establishes that reasonable consumers who viewed the SERP

would believe that D-Link has taken reasonable steps to secure its products from unauthorized 

access. See FTC v. Medlab, 615 F. Supp. 2d 1068, 1078 (N.D. Cal. 2009) (holding that no 

extrinsic evidence was necessary to prove “obvious” implied claims). The Court should construe 

this reasonable interpretation of D-Link’s representations in the SERP against them. Simeon 

Mgmt., 579 F.2d 1146. Here, the FTC is not required to present extrinsic evidence of what DLink’s claims implied in order to prove “what is obvious to any rational reader.” Medlab, 615 F. 

Supp. 2d 1078.

Although the Court may conduct a facial analysis without looking to extrinsic evidence, 

to assist the trier of fact, in further support of this analysis, the FTC submits extrinsic evidence in 

the form of a facial analysis by a marketing communications expert, Dr. Terrence A. Shimp.23 

Dr. Shimp’s expert report comprehensively describes the process by which consumers research 

routers and IP cameras, including by conducting online research on brands’ websites.24 Dr. 

Shimp analyzed the SERP and offered opinions on the implied claims that D-Link made in this 

document.25 Dr. Shimp concluded that the type of reasonable consumers who would read the 

SERP would form the belief, upon reading it, that D-Link takes security very seriously and that 

D-Link has taken reasonable steps to secure its products from unauthorized access.26 D-Link’s

experts do not present evidence contrary to this conclusion.

 22 Id.

23 See Brown Decl. Ex. 55, Shimp Decl. incorporating Expert Report (“Shimp Report”).

24 Brown Decl. Ex. 55, Shimp Report ¶¶ 19-24, 55.

25 Id. ¶¶ 56-60.

26 Id. ¶¶ 57, 60.

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 11 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 9 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

2. D-Link’s SERP Was Likely to Mislead Because D-Link Did Not 

Engage in the Claimed Software Security Practices.

27

The SERP’s express claims are false because D-Link did not, in fact, “prohibit[] at all 

times, including during product development by D-Link or its affiliates, any intentional product 

features or behaviors which allow unauthorized access . . . including but not limited to 

undocumented account credentials...[and] backdoors.”28 As AJ Wang, D-Link’s Chief 

Technology Officer and acting president at the time D-Link disseminated the SERP, testified, 

29

When the SERP was on its website,30 D-Link sold D-Link devices that it knew had 

backdoors and undocumented credentials. , DLS sold D-Link cameras31 with 

software that had an undocumented login credential to view the video feed using the easily 

guessable username “guest” and password “guest.”32 D-Link learned of this backdoor, or 

undisclosed credential, in 2013, and released software ostensibly designed to remove the 

guest/guest credential.

33 , D-Link continued to the sell at least one 

 

27 If the Court does not grant this motion for summary judgment, the FTC intends to establish at 

trial many facts beyond those described herein. The facts described in this section are those 

material facts regarding which there is no genuine dispute.

28 Brown Decl. Ex. 2, PX 1. 

29 Brown Decl. Ex. 5, Wang Dep. 160:2-9, 161:19-162:5. See also Brown Decl. Ex. 49, Brown 

Dep. 222:7-223:4 

. 30 See supra note 20. 31 E.g., Brown Decl. Ex. 11, D-Link Sys.’ 1st Am. Answers & Objs. to FTC 3d Set of Interrogs. 

(“3d Interrogs.”) Resp. 9 ( ). 

32 Brown Decl. Ex. 16,

; Brown 

Decl. Ex. 17,

Brown Decl. Ex. 18,

There is 

also no mention of the guest account in affected cameras’ user manuals. E.g., Brown Decl. Ex. 

19, (DCS-2310L User Manual v1.0 at 73) (DLS0005107-95). See further discussion of the DLink camera backdoors below, at Part IV.C.2. 

33 Supra note 32; Brown Decl. Ex. 20, (DCS-2310L Firmware Release Notes) (DLS0005255-59) 

(“Remove the default account ‘guest’” in v1.01.10, June 18, 2013, at DLS0005256-57).

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 12 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 10 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

device model that had the backdoor credential.

34 This device, with the undocumented credential 

still present, continued to be available through D-Link’s two primary online sales channels35 in 

August 2018.36 Nor did D-Link make it easy for consumers to learn about the software patches. 

Unless a consumer signed up separately for the “mydlink” cloud service, the only way he or she 

would know there was an updated firmware version was by visiting the support page for his or 

her device.37 There is thus no genuine dispute that it was false and misleading for D-Link to 

claim it “prohibits at all times . . . undocumented account credentials . . . [and] ‘backdoors’” 

while continuing to sell cameras preinstalled with the highly exploitable guest-guest backdoor.38 

The net impression claims made by the SERP—that D-Link took reasonable steps to 

secure D-Link devices from unauthorized access—were also false, because D-Link did not take 

such reasonable steps. During the time D-Link published the SERP, D-Link devices were 

affected by well-known, foreseeable, and easily preventable vulnerabilities,39 the existence of

which is undisputed by D-Link’s two security experts.40 In addition, there is no genuine issue of 

fact that many of these vulnerabilities had been ranked by the Open Web Application Security 

Project (“OWASP”)—an organization that D-Link’s putative expert agrees is an authoritative 

source of information41—as “among the most critical and widespread web application 

vulnerability since at least 2007” (“OWASP Top Ten”).42 

 

34 Brown Decl. Ex. 11, 3d Interrogs. Resp. 9 ( . 35 Brown Decl. Ex. 5, Wang Dep. 47:17-19. 

36 Brown Decl. Ex. 21, Hine Decl. ¶¶ 2-3, 5-7, 9-10. These cameras are still available for 

purchase new from resellers. Id. ¶ 2. Mr. Hine’s Declaration is the subject of a pending motion 

by the FTC to permit the use of facts that the FTC was not reasonably able to learn prior to the 

close of fact discovery. See FTC Letter Brief (Sept. 4, 2018) (Filed Unsealed at Dkt. No. 168). 

Even absent this evidence, there is no genuine dispute that the SERP’s express claims were false 

or misleading.

37 Brown Decl. Ex. 6, Brown Investigational Hr’g, 620:13-19. 

38 Brown Decl. Ex. 2, PX1. See Part IV.C.2 (discussing D-Link camera backdoors). 

39 See, e.g., supra note 32; infra note 50. 40 Neither of D-Link’s security experts disputed the existence of these vulnerabilities (which 

were also identified in the Report of the FTC’s security expert, Mark Graff). Brown Decl. Ex. 7, 

Radcliffe Dep. 219:20-25, 225:13-17; 237:8-15; Brown Decl. Ex. 8, Schaumont Dep. 43:11-23. 

41 Brown Decl. Ex. 56, Expert Report of Dr. Patrick Schaumont (“Schaumont Report”) ¶ 65 

(“ ”). 

42 See FTC Compl. ¶ 15. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 13 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 11 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

In at least two known instances, D-Link actually was on notice of the well-known, 

foreseeable, and easily-preventable vulnerabilities on D-Link devices before it marketed and sold 

them in the United States. 

 

 

 

 

 

 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 14 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 12 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

In addition to these instances where D-Link was clearly on notice of the vulnerabilities, 

there are numerous instances where there is no genuine issue of fact that D-Link devices suffered 

from significant vulnerabilities during the time of the publication of the SERP.50 One of these 

vulnerabilities51 that occurred during the period in which the SERP was available on D-Link’s

website caused 

52 During this same time, D-Link’s lack of secure practices led to it 

posting a private key that put all Windows computer users at greater risk of malware being 

installed on their computers.53 

 

50 D-Link has publicly acknowledged many such vulnerabilities through its “Security 

Advisories.” 

he FTC’s security expert, Mark Graff, further 

addresses each of these in his Expert Report. Brown Decl. Ex. 57, Graff Decl. incorporating 

Expert Report (“Graff Report”)

51 Brown Decl. Ex. 31,

 Brown Decl. Ex. 32,

52 Brown Decl. Ex. 33, 

53 From February to September 2015, D-Link publicly posted a private key used to sign 

Windows software it distributed. Brown Decl. Ex. 34, 

 This key could have allowed 

attackers to bypass operating system warnings when planting malicious software on consumers’ 

computers, including consumers with no relationship to D-Link. Id.

See Brown Decl. Ex. 12, 

D-Link Sys.’ Answers & Objs. to FTC 5th Set of Interrogs. (“5th Interrogs.”) Resp. 15 

( ); Brown Decl. Ex. 9, D-Link 

Corp. 30(b)(6) Dep. 253:16-254:11; Brown Decl. Ex. 10, D-Link Sys. 30(b)(6) Dep. 195:11-22 

(“

); see Brown Decl. Ex. 57, Graff Report ¶¶ 241-44. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 15 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 13 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

D-Link devices suffered from these serious, long-recognized types of vulnerabilities 

because D-Link did not develop devices using processes designed to identify and fix well-known 

vulnerabilities before sale. There is no genuine dispute that from before the publication of the 

SERP 

 

 

 D-Link’s expert Dr. 

Schaumont stated that 

 

For the reasons above, there is no genuine dispute that it was false or misleading for DLink to have made claims it took reasonable steps to secure D-Link devices from unauthorized 

access.

3. D-Link’s SERP Claims Are Material Because They Are Express and 

Because Security Is a Central Characteristic of Routers and IP 

Cameras. 

D-Link’s claims about prohibiting unauthorized access through features such as 

undocumented credentials and backdoors are presumed material because the claims are express. 

Pantron I, 33. F.3d at 1095-96. 

D-Link’s security claims in the SERP—whether express or implied—also are presumed 

material because they relate to security, a characteristic that implicates the very purpose or 

efficacy of consumer routers and IP cameras. Mortg. Relief Advocates, 2015 WL 11257575, at 

 

54 Brown Decl. Ex. 6, Brown Investigational Hr’g 330:23-331:9 (William Brown testifying that 

); Brown Decl. Ex. 7, Radcliffe 

Dep. 106:15-107:3 (reaffirming that prior to the middle of 2014, D-Link Corporation used 

III/Onward “to test products, but on a more ad hoc basis”). 

55 Brown Decl. Ex. 11, 3d Interrogs. Resp. 9 (stating sales dates for D-Link devices).

56 See Brown Decl. Ex. 35, 

57 Brown Decl. Ex. 8, Schaumont Dep. 240:22-241:5. D-Link’s other security expert also agreed 

that “testing is an integral part of a security program, looking for vulnerabilities in their 

products.” Brown Decl. Ex. 7, Radcliffe Dep. 143:9-16. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 16 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 14 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

*2; see also Thompson Med. Co., Inc., 104 F.T.C. 648, 1984 WL 565377, at *102 (1984) (FTC

“cases have established several categories of claims pertaining to the central characteristics of a 

product or service, such as those relating to its purpose, safety, efficacy, or cost.”). Evidence 

supporting the fact that security is central to these devices’ purpose and efficacy includes internal 

D-Link emails. These emails confirm that “

60 DLink’s former CTO, AJ Wang, provided similar evidence of the centrality of device security to 

consumers when he testified that 

.

61 Because D-Link’s claims at issue 

concern the security of its devices, a characteristic that is central to the efficacy of these devices, 

these claims are presumptively material. 

The FTC offers further extrinsic evidence of the SERP claims’ materiality through its 

expert, Dr. Shimp, who opined that the claims made by the SERP are “manifestly material to 

[consumers’] subsequently evaluating and choosing D-Link router and IP camera products.62 A 

claim is material if it “involves information that is important to consumers and, hence, likely to 

affect their choice of, or conduct regarding, a product.” Cyberspace.com, 453 F.3d at 1201 

(quoting Cliffdale Assocs., 103 F.T.C. at 165). Dr. Shimp further opines that the fact that D-Link 

 

58 Brown Decl. Ex. 36, 

59 Brown Decl. Ex. 37,

60 Brown Decl. Ex. 38,

 Brown Decl. Ex. 39, 

61 Brown Decl. Ex. 5, Wang Dep. 34:25-35:6, 35:21-36:5. 

62 Brown Decl. Ex. 55, Shimp Report ¶ 60. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 17 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 15 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

both created the SERP and posted it on its website leads to the conclusion that D-Link itself 

acknowledges that the security of its wireless routers and IP cameras is material to its 

consumers.63 Mr. Graff also confirmed the importance of security to routers.64

D-Link’s experts offered no affirmative or rebuttal evidence regarding whether D-Link’s

SERP security claims were material to consumers. Thus, there is no genuine dispute that DLink’s claims in the SERP are material.

B. D-Link’s Router Brochures Claims Violate the FTC Act (Count 3; 

Complaint Exhibits 2-5) 

The FTC prevails on Count 3 because D-Link has made claims in its router brochures 

that its routers are secure from unauthorized access, and these claims are false. D-Link’s routers 

neither were nor are secure from unauthorized access. 

1. D-Link Router Brochures Promoted the High Quality of Their

Security.

D-Link has made express and implied claims about its routers’ security in promotional 

brochures that it has posted on its website and distributed to retail partners.65

a. D-Link Claims the DIR-615 Is Secure from Unauthorized 

Access (Count 3; Complaint Exhibit 2).

D-Link marketed and sold the DIR-615 router66

67 In its promotional brochure, under the heading “EASY TO SECURE” D-Link claims: 

 

63 Brown Decl. Ex. 55, Shimp Report ¶ 55. 

64 The FTC offers additional extrinsic evidence that security is a central characteristic from its 

expert, Dr. Mark Graff, who states that “[s]ecurity is necessarily a core feature of routers . . . . 

Router manufacturers (including D-Link) acknowledge the centrality of security because they 

include on their devices certain security features: firewalls to stop certain incoming data and 

encryption for wireless connections on the LAN (e.g., WPA2).” Brown Decl. Ex. 57, Graff 

Report ¶ 26. 

65 Brown Decl. Ex. 14, D-Link Sys.’ Answers & Objs. to FTC 1st Set Reqs. for Admis. (“RFA”) 

Resps. 57-60. See also FTC Compl. ¶ 21, 21a-d; Brown Decl. Ex. 3, PX 2-5. 

66 Brown Decl. Ex. 14, RFA Resp. 62; RFA Resps. 63-64, 67 (Rev. A); RFA Resps. 91, 96 (Rev. 

B); RFA Resps. 97, 102 (Rev. C); RFA Resps. 71, 72, 76 (Rev. E); RFA Resps. 77-78, 80-81 

(Rev. I).

67 Brown Decl. Ex. 11, 3d Interrogs. Resps. 9, 10; Brown Decl. Ex. 12, 5th Interrogs. Resp. 22; 

Brown Decl. Ex. 14, RFA Resps. 62, 63, 71, 77, 91, 97. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 18 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 16 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

The DIR-615 supports the latest wireless security features to help prevent 

unauthorized access, be it from over a wireless network or from the Internet. 

Support for WPATM and WPA2TM standards ensure that you will be able to use 

the best possible encryption, regardless of your client devices. In addition, [the 

router] utilizes dual active firewalls (SPI and NAT) to prevent potential attacks 

from across the Internet.

Delivering great wireless performance, network security and coverage, [the 

router] is ideal for upgrading your existing wireless home network.68

There is no factual dispute that D-Link disseminated these claims by posting the DIR-615 

promotional brochure on its main product website69 and making it available for download from 

the support page for the DIR-615.70 Any consumer could access the DIR-615 support page by 

searching the D-Link website.71 

In addition to the foregoing express claims, a facial analysis of D-Link’s representations 

in the DIR-615 promotional brochure reveals that D-Link creates the net impression that the 

DIR-615 is secure from unauthorized access through, for example, the title, the prominence of 

the representation on the brochure, and the reference to the threat of “attacks.” Although the 

Court may conduct a facial analysis without looking to extrinsic evidence, to assist the trier of 

fact, the FTC presents additional extrinsic evidence of this implied claim through its expert, Dr. 

Shimp, who opined that reasonable consumers would form the belief, upon reading PX 2, that 

the DIR-615 router is secure from unauthorized access.72

 

68 FTC Compl. ¶ 21a; Brown Decl. Ex. 3, PX 2. There is no factual dispute that D-Link has 

made security claims in the DIR-615 promotional brochure that it posted on its website and 

 Brown Decl. Ex. 14, RFA Resp. 57 (

); Brown Decl. Ex. 13, D-Link Sys.’ Answers and Objs. to FTC 6th Set of 

Interrogs. (“6th Interrogs.”) Resps. 26-27 (“

”).

69 Brown Decl. Ex. 11, 3d Interrogs. Resp. 8 ( ). 

70 Brown Decl. Ex. 14, RFA Resps. 61, 67, 72, 76, 80-82. 

71 Brown Decl. Ex. 14, RFA Resp. 62. 

72 Brown Decl. Ex. 55, Shimp Report ¶¶ 35-36. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 19 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 17 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

b. D-Link Claims the DIR-412 Is Secure from Unauthorized 

Access (Count 3, Complaint Exhibit 3). 

D-Link marketed and sold the DIR-412 mobile wireless router73

74 Under the heading “ADVANCED NETWORK SECURITY,” DLink claims: 

The DIR-412 ensures a secure Wi-Fi network through the use of WPA/WPA2 

wireless encryption. Simply press the WPS button to quickly establish a secure 

connection to new devices. The DIR-412 also utilizes dual-active firewalls (SPI 

and NAT) to prevent potential attacks and intrusions from across the Internet.75

There is no factual dispute that D-Link disseminated these claims by posting the DIR-412 

promotional brochure on the D-Link website76 and making it available for download from the 

DIR-412 support page.77 Any consumer could access the DIR-412 support page by searching 

the D-Link website.78 

In addition to the foregoing express claims, a facial analysis of D-Link’s representations 

in the DIR-412 promotional brochure reveals that D-Link creates the net impression that the 

DIR-412 is secure from unauthorized access. The FTC presents additional, extrinsic evidence of 

this implied claim through its expert, Dr. Shimp, who opined that reasonable consumers would 

form the belief, upon reading PX 3, that the DIR-412 router is secure from unauthorized 

access.79

 

73 Brown Decl. Ex. 14, RFA Resp. 103. 

74 Brown Decl. Ex. 11, 3d Interrogs. Resps. 9, 10; Brown Decl. Ex. 12, 5th Interrogs. Resp. 22. 

75 FTC Compl. ¶ 21b; Brown Decl. Ex. 3, PX 3; Brown Decl. Ex. 14, RFA Resp. 107 

 There is no factual dispute that D-Link has made security claims in the (DIR412) promotional brochure that it posted on its website and Brown 

Decl. Ex. 14, RFA Resp. 58; Brown Decl. Ex. 13, 6th Interrogs. Resps. 26-27. 

76 Brown Decl. Ex. 11, 3d Interrogs. Resp. 8 ( . 77 Brown Decl. Ex. 14, RFA Resps. 105, 107, 110 

). 

78 Brown Decl. Ex. 14, RFA Resp. 106. 

79 Brown Decl. Ex. 55, Shimp Report ¶¶ 38, 42. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 20 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 18 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

c. D-Link Claims the DIR-815 Is Secure from Unauthorized 

Access (Count 3; Complaint Exhibit 4). 

D-Link marketed and sold the DIR-815 router80

1

 Under the heading “Advanced Network Security,” D-Link claims: 

The [DIR-815] Router supports the latest wireless security features to help 

prevent unauthorized access, be it from over a wireless network or from the 

Internet. Support for WPATM and WPA2TM standards ensure that you will be able 

to use the best possible encryption method. In addition, this [DIR-815] Router 

utilizes Stateful Packet Inspection firewalls (SPI) to help prevent potential attacks 

from across the Internet.82

There is no factual dispute that D-Link disseminated these claims by posting the DIR-815 

promotional brochure on the D-Link website83 and making it available for download from the 

DIR-815 support page.84 Any consumer could access the DIR-815 support page by searching 

the D-Link website.85 

In addition to the foregoing express claims, a facial analysis of D-Link’s representations 

in the DIR-815 promotional brochure reveals that D-Link creates the net impression that the 

DIR-815 is secure from unauthorized access. The FTC presents additional, extrinsic evidence of 

this implied claim through its expert, Dr. Shimp, who opined that reasonable consumers would 

form the belief, upon reading PX 4, that the DIR-815 router is secure from unauthorized 

access.86

 

80 Brown Decl. Ex. 14, RFA Resp. 114; Brown Decl. Ex. 12, 5th Interrogs. Resp. 22. 

81 Brown Decl. Ex.11, 3d Interrogs. Resps. 9, 10. 

82 FTC Compl. ¶ 21c; Brown Decl. Ex. 3, PX 4. There is no factual dispute that D-Link has 

made security claims in the (DIR-815) promotional brochure that it posted on its website and 

. Brown Decl. Ex. 14, RFA Resp. 59 

); Brown Decl. Ex. 13, 6th Interrogs. Resps. 26-27. 

83 Brown Decl. Ex. 11, 3d Interrogs. Resp. 8 ( ). 

84 Brown Decl. Ex. 14, RFA Resps. 129. 

85 Brown Decl. Ex. 14, RFA Resp. 116. 

86 Brown Decl. Ex. 55, Shimp Report ¶¶ 44-48. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 21 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 19 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

d. D-Link Claims the DIR-645 Is Secure from Unauthorized 

Access (Count 3, Complaint Exhibit 5). 

D-Link marketed and sold the DIR-645 from 87 

Under the heading “128-bit Security Encryption,” D-Link claims: 

The [DIR-645] protects your network with 128-bit AES data security 

encryption—the same technology used in E-commerce or online banking. Create 

your own network name and password or put it at the tip of your fingers with 

‘Push Button Security’ standard on every Amplifi device. With hassle-free plug 

and play installation, and advanced Wi-Fi protected setup, the [DIR-645] is not 

only one of the fastest routers available, its [sic] also one of the safest.88

There is no factual dispute that D-Link disseminated these claims by posting the DIR-645 

promotional brochure on the D-Link website89 and making it available for download from the 

DIR-645 support page.90 Any consumer could access the DIR-645 support page by searching 

the D-Link website.91 

In addition to the foregoing express claims, a facial analysis of D-Link’s representations 

in the DIR-645 promotional brochure reveals that D-Link creates the net impression that the 

DIR-645 is secure from unauthorized access. The FTC presents additional, extrinsic evidence of 

this implied claim through its expert, Dr. Shimp, who opined that reasonable consumers would 

form the belief, upon reading PX 5, that the DIR-645 router is secure from unauthorized 

access.92

 

87 Brown Decl. Ex. 14, RFA Resp. 131; Brown Decl. Ex. 11, 3d Interrogs. Resps. 9, 10; Brown 

Decl. Ex. 12, 5th Interrogs. Resp. 22. 

88 FTC Compl. ¶ 21.d; Brown Decl. Ex. 3, PX 5. There is no factual dispute that D-Link has 

made security claims in the (DIR-645) promotional brochure that it has posted on its website and 

. Brown Decl. Ex. 14, RFA Resp. 60 

); Brown Decl. Ex. 13, 6th Interrogs. Resps. 26-27. 

89 Brown Decl. Ex. 11, 3d Interrogs. Resp. 8 (

).

90 Brown Decl. Ex. 14, RFA Resps. 140 (

). 

91 Brown Decl. Ex. 14, RFA Resp. 134. 

92 Brown Decl. Ex. 55, Shimp Report ¶ 52. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 22 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 20 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

2. D-Link’s Router Brochures Claims Are Likely to Mislead Because the 

Routers Were Not Secure from Basic Threats.

D-Link’s router brochure claims are false and misleading. There is no genuine dispute 

that the promoted routers neither were nor are secure from unauthorized access. As a 

preliminary matter, as discussed in Section IV.A.3, above, the DIR-615, 412, 815, and 645 were 

not secure from unauthorized access because D-Link failed to take reasonable steps to secure DLink devices from unauthorized access. And, in fact, as a result of these failures, the routers 

suffer from serious, well-known, foreseeable, and easily preventable vulnerabilities, as discussed 

below.93

There is no genuine dispute of fact that DIR-615, 412, 815, and 645 contained wellknown, preventable vulnerabilities that would allow a cybercriminal to take over the device and 

access a consumers’ personal information.94 

 

 

 

93 The FTC’s security expert Mark Graff opined that the vulnerabilities affecting these four 

routers were foreseeable and preventable, and that they were caused by well-known code 

development failures. Brown Decl. Ex. 57, Graff Report ¶¶ 298-301. 

94 D-Link’s two security experts do not dispute that these vulnerabilities exist on these versions 

of the firmware. Brown Decl. Ex. 7, Radcliffe Dep. 219:20-25, 225:13-17, 237:8-15; Brown 

Decl. Ex. 8, Schaumont Dep. 43:11-23. Each raises the concern that there is an absence of 

evidence of exploitation of these vulnerabilities. See, e.g., Brown Decl. Ex. 7, Radcliffe Dep. 

197:14-198:7. That dispute, however, does not raise an issue of disputed fact regarding whether 

the devices were secure from unauthorized access.

95 Brown Decl. Ex. 40,

See also Brown Decl. Ex. 57, Graff Report 

¶¶ 180-83, 299. 

96 Brown Decl. Ex. 41, 

 See

also Brown Decl. Ex. 57, Graff Report ¶¶ 193-99, 300.

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 23 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 21 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 

 The existence of 

these preventable vulnerabilities that permit unauthorized access—which long have been 

recognized in the OWASP Top Ten99—is inconsistent with the router brochures’ express and 

implied claims that the routers were secure from unauthorized access. 

3. D-Link’s Router Brochures Claims Are Material Because They Are 

Express and Refer to Central Characteristics of Routers.

D-Link’s security-related claims in its router brochures are presumed material because 

they are express claims, Pantron I Corp., 33 F.3d at 1095–96, which tout to consumers that these 

routers provide “great . . . network security”100 or are the “one of the safest” routers available.101

Further, as argued in Section IV.A.3 above, D-Link’s claims about the security of its 

routers are presumptively material because they pertain to central characteristics, such as the 

“purpose” or “efficacy” of routers and IP cameras. Mortg. Relief Advocates, 2015 WL 

11257575, at *2; see also Thompson Med. Co., 1984 WL 565377, at *102. D-Link’s own 

documents, corporate officer testimony, and the FTC’s expert witness in software security all 

 

97

Brown Decl. Ex. 42,

; Brown Decl. Ex. 43,

see also

Brown Decl. Ex. 57, Graff Report ¶¶ 174-76. 

Brown Decl. Ex. 44,

see also Brown Decl. Ex. 57, Graff Report ¶¶ 177-79. 

98 Brown Decl. Ex. 45,

; Brown Decl. Ex. 46,

The FTC’s 

security expert, Mr. Graff, concluded that these vulnerabilities “significantly reduced the security 

of the device.” Brown Decl. Ex. 57, Graff Report ¶ 298. 

99 See, e.g., Brown Decl. Ex. 22,

100 FTC Compl. ¶ 21a; Brown Decl. Ex. 3, PX 2. 

101 FTC Compl. ¶ 21d; Brown Decl. Ex. 3, PX 5. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 24 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 22 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

support the undisputed fact that security is a central characteristic of routers. See Section IV.A.3, 

above. Thus, there is no genuine issue of fact that D-Link’s claims about the security of its 

routers are material to consumers. 

C. D-Link’s IP Camera Interface Claims Violated the FTC Act (Count 6; 

Complaint Exhibits 10-11) 

The FTC prevails on Count 6 because D-Link deceived consumers through the graphical 

user interface (“GUI”) used to set up certain IP cameras for the first time. The GUI included the 

representation that setting a password would secure the device. Contrary to this representation, 

however, the software on the camera contained an alternative, secret password that could be used 

maliciously to access the device video feed over the Internet. 

1. D-Link Made Claims in Its IP Camera Interface that Setting a

Password Would Secure the Device.

There is no factual dispute that D-Link made express claims related to securing its IP 

cameras in the GUIs for certain devices. In the following D-Link IP cameras, the GUI displays 

the phrase “Enter a password to secure your camera” alongside a prompt to type in a password 

before proceeding to the next screen of the setup: DCS-2310L, and DCS-6010L.102 

The following D-Link IP cameras display the phrase “Set up an Admin ID and Password to 

secure your camera” alongside a prompt to set a password: 

 These statements in the GUI make express claims that a 

 

102 Brown Decl. Ex. 4, PX 11 (displaying representation); Brown Decl. Ex. 14, RFA Resps. 163 

, 155

Brown 

Decl. Ex. 47, Brown Decl. Ex. 48, 

DCS-6010L User Manual v1.1 at 19 (DLS0007087-7174). 

103 Brown Decl. Ex. 4, PX 10 (displaying representation); Brown Decl. Ex. 14, RFA Resps. 174-

209

. 104 Brown Decl. Ex. 4, PX 10 (displaying representation); Brown Decl. Ex. 50, 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 25 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 23 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

consumer’s camera will be “secure” once a consumer sets his or her password. 

A facial analysis of the GUI establishes that D-Link also makes an implied claim that it

secured its IP cameras from unauthorized access and control. In the context of setting up a 

device and “securing” it by setting a password, a reasonable interpretation of the claim that DLink intended to convey to consumers is that once they set their password, the camera would be 

secure from unauthorized access and control. The Court should construe this reasonable 

interpretation of D-Link’s representations in its IP cameras’ GUIs against them. Simeon Mgmt., 

579 F.2d 1146. The FTC is not required to submit extrinsic evidence supporting this reasonable 

interpretation of D-Link’s implied claim. See Medlab, 615 F. Supp. 2d at 1078. Accordingly, 

there is no genuine dispute as to this fact. 

2. D-Link’s IP Camera Interface Claims Are Likely to Mislead Because 

the Devices Had Another Secret Password that Could Be Used 

Maliciously for Unauthorized Access. 

There is no genuine dispute of material fact that D-Link’s IP Camera GUI claims are 

deceptive, false, and misleading. At the same time that D-Link represented to consumers that 

setting a user password would “secure” their device, they had also created in the software a 

backdoor to permit access to the device using an alternative credential with a standard, easily

guessable username “guest” and password “guest.” Documents from D-Link and D-Link 

Corporation establish indisputably that this backdoor existed.105 These documents describe the 

backdoor existing on the following D-Link cameras: DCS- 2132L; DCS-2210; DCS-2230; 

DCS-2310L; DCS-2332L; DCS-3112; DCS-3710; DCS-3716; DCS-6010L; DCS-6210; DCS6510; DCS-6511; DCS-6513; DCS-6616; DCS-6818; DCS-7010L; DCS-7413; and DCS7513.106

 

 Brown Decl. Ex. 14, RFA Resp. 155 

).

105 Brown Decl. Ex. 16, Guest User Account Security Advisement for Select D-Link IP Cameras

(May 9, 2013) (DLS0005316-17); Brown Decl. Ex. 51,

106 Supra note 101. 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 26 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 24 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

There is no genuine dispute that the guest/guest backdoor exists; nor is there any genuine 

dispute that the backdoor was trivial for any third party to exploit. William Brown, who was 

responsible for security at D-Link, 

 

 

 the guest/guest vulnerability 

was trivially easy to exploit, and its existence rendered false the instruction to consumers that 

entering a password would secure their cameras.

3. D-Link’s IP Camera Interface Claims Are Material Because They Are

Express and Because They Relate to a Central Characteristic of IP

Cameras.

D-Link’s IP camera claims are express claims and presumed material. D-Link’s experts

do not dispute the express nature of these claims; therefore, there is no disputed material fact that 

these statements are indeed express.

Moreover, D-Link’s claims should be presumed material because they concern a core 

characteristic of the devices. See Section IV.A.3. Security of an IP camera’s feed from 

unauthorized access and control goes directly to what D-Link

107 Brown Decl. Ex. 52, 

108

109 Brown Decl. Ex. 52, ); Brown Decl. Ex. 

53, 

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 27 of 28
FTC MOTION FOR SUMMARY JUDGMENT Page 25 

CASE NO. 3:17-CV-00039-JD 

1

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

110 D-Link markets its cameras to be used in and around the 

home or office; therefore, a consumer’s ability to secure it, i.e., prevent others from logging into 

the camera to view the live feed, is central to its functioning as intended by D-Link.111 Further, 

D-Link’s own documents, corporate officer testimony, and the FTC’s expert witness in software

security all support the undisputed fact that security is a central characteristic of consumer IP 

cameras. See Section IV.A.3. Accordingly, there is no genuine dispute as to this fact.

CONCLUSION

This Court should grant the FTC’s motion for summary judgment. The Court should 

enter a permanent injunction, the substance of which will be the subject of further briefing, to 

enjoin D-Link from further violations of the FTC Act.

Dated: September 21, 2018 Respectfully submitted,

 /s/ Jarad A. Brown

KEVIN H. MORIARTY

CATHLIN TULLY

SHAMEKA WALKER

JARAD A. BROWN

KATHERINE E. McCARRON

JAMES A. TRILLING

Federal Trade Commission

600 Pennsylvania Avenue NW, Mail Drop CC-8232 

Washington, DC 20580 

Attorneys for Plaintiff

Federal Trade Commission 

110 Brown Decl. Ex. 6, Brown Investigational Hr’g 61:17-62:4 ( ).

111 Brown Decl. Ex. 54, DCS-2310L Datasheet (DLS0005100-03 at 5101) (“Features[:] 

Remotely Monitor Your Home or Office over the Internet”).

Case 3:17-cv-00039-JD Document 178 Filed 09/21/18 Page 28 of 28