Exhibit 23

To Declaration of Jarad Brown in Support of 

Federal Trade Commission’s 

Motion for Summary Judgment

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 1 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 1 of 20

CAUSE OF ACTION INSTITUTE 

PA TRICK J. MASSARI [admitted pro hac vice] [Lead Counsel] 

2 patrick.massari@causeofaction.org 

MICHAEL PEPSON [admitted pro hac vice] 

3 Admitted only in Maryland. 

Practice limited to matters and proceedings before United States Courts and agencies. 

4 michael.pepson@causeofaction.org 

KARA E. MCKENNA [admitted pro hac vice] 

5 Admitted only in New York and New Jersey. 

Practice limited to matters and proceedings before United States Courts and agencies. 

6 kara.mckenna@causeofaction.org 

I 875 Eye Street N.W., Suite 800 

7 Washington, D.C. 20006 

Telephone: (202) 422-4332 

8 Facsimile: (202) 330-5842 

9 PILLSBURY WINTHROP SHAW PITTMAN LLP 

LAURA C. HURTADO (CSB #267044) 

10 laura.hurtado@pillsburylaw.com 

Four Embarcadero Center, 22nd Floor 

I 1 San Francisco, California 94 I 11 

Telephone: (415) 983-1000 

12 Facsimile: (415) 983-1200 

13 

Attorneys for Defendants D-Link Corporation 

14 and D-Link Systems, Inc. 

15 UNITED ST A TES DISTRICT COURT 

16 

17 

18 

NORTHERN DISTRICT OF CALIFORNIA 

SAN FRANCISCO DIVISION 

19 FEDERAL TRADE COMMISSION, No. 3: I 7-cv-00039-JD 

20 Plaintiff, 

21 vs. 

22 D-LINK CORPORATION 

23 and 

24 D-LINK SYSTEMS, INC., 

25 

Defendants. 

26 

27 

28 

No. 3: I 7-cv-00039-JD 

SUPPLEMENT AL DECLARATION OF 

WILLIAM BROWN IN SUPPORT OF 

DEFENDANT D-LINK CORPORA TIO N'S 

REPLY IN SUPPORT OF MOTION TO 

DISMISS 

SUPPLEMENTAL BROWN DECL. ISO D-LINK 

CORPORATION'S MOTION TO DISMISS 

4812-8887-200 1.vl 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 2 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 2 of 20

SUPPLEMENT AL DECLARATION OF WILLIAM BROWN 

2 The undersigned declarant, William Brown, states: 

3 1. I am Chief Information Security Officer at D-Link Systems, Inc. ("D-Link 

4 Systems"). Unless stated otherwise, the following facts are based on my own personal 

5 knowledge and, if called as a witness, I could and would testify competently thereto. 

6 This declaration supplements my April 3, 2017, Declaration in Support ofD-Link 

7 Corporation's ("D-Link Corp.") Motion to Dismiss. 

8 2. I understand that the plaintiff in this lawsuit, the Federal Trade Commission 

9 ("FTC" or "Commission"), has submitted papers with this Court in opposition to D-Link 

10 Corp.'s Motion and has made certain factual claims, as well as characterizations of my 

11 testimony. I have reviewed the FTC Opposition and provide this supplemental 

12 declaration to respond to the FTC Opposition's factual claims and characterizations of 

13 my testimony, as well as to provide context for the excerpts from my testimony I 

14 understand the FTC cites in support of its Opposition. 

15 3. As further explained below, in July 2014 I testified at a FTC investigational 

16 hearing after the FTC issued a Civil Investigative Demand ("CID") to me, personall y, 

17 and also issued a separate CID to D-Link Systems. 

18 4. Attached as Exhibit A to this Declaration is a true and correct copy of a CID 

19 issued to D-Link Systems by the FTC on June 5, 2014. That CID did not request that D20 Link Systems' corporate representative be prepared to provide testimony relating to D21 Link Corporation ("D-Link Corp."). More specifically, that CID only references D-Link 

22 Systems and does not mention D-Link Corp. The CID Specifications did not ask for 

23 testimony about, among other things, 0-Link Corp. 's business model, corporate stmcture, 

24 and related matters. 

25 5. Pursuant to the CID that the FTC issued to D-Link Systems, I was designated as 

26 representative of 0-Link Systems because the focus of the CID's Specifications tracks 

27 with my job duties, background, and experience. My preparation to testify as a 

28 -1-

No. 3: 17-cv-00039-JD 

SUPPLEMENTAL BROWN DECL. ISO D-LINK 

CORPORATION'S MOTION TO DISMISS 

4812-8887-200 1.vl 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 3 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 3 of 20

representative of D-Link Systems was based on the Specifications in the CID the FTC 

2 issued to D-Link Systems. 

3 6. Attached as Exhibit B to this Declaration is a true and con-ect copy of a CID 

4 issued to me c/o D-Link Systems by the FTC on June 5, 2014. 

5 7. Pursuant to the CIDs the FTC issued to me and to D-Link Systems, I attended a 

6 three-day Civil Investigational Hearing in July 20 14 and gave testimony on behalf of 

7 myself, on certain topics, and as a corporate representative for D-Link Systems, as to 

8 topics within the scope of the Specifications for the CID the FTC issued to D-Link 

9 Systems. · 

10 8. I did not testify on behalf of D-Link Corp., and I was not asked to do so. r am not 

11 authorized to give testimony on behalf of D-Link Corp. To the best of my knowledge, 

12 the FTC has never issued a CID to D-Link Corp. 

13 9. When I testified at the Civil Investigational Hearing, my title was Associate VP of 

l 4 Technology for D-Link Systems. 

15 10. During the hearing, I used the term "vendor" to refer to, among other things, 

16 manufacturers of products D-Link Systems sells, including IP cameras and routers. The 

17 FTC asked me about this te1minology during the investigational hearing, and I clarified 

18 this. 

19 11. As I explained in my April 3, 2017, Declaration, these third-party vendor20 manufacturers finalize the design of the products (including routers and IP cameras) that 

21 D-Link Systems sells, make the products, ship the products directly to D-Link Systems, 

22 and then create firmware updates for the products. 

23 12. I understand the FTC states on page 1, line 19 of its Opposition that "D-Link does 

24 not dispute that it finali zes the functions and features .... " This is incorrect. As stated in 

25 paragraphs 26, 31, and 32 of my April 3, 2017, Declaration, D-Lin.k Systems has 

26 authority to specify to third party vendors that manufacture the products D-Link Systems 

27 sells what the security requirements should be for such products and also decides what 

28 -2-

No. 3: 17-cv-00039-JD 

SUPPLEMENTAL BROWN DECL. ISO D-LINK 

CORPORATION'S MOTION TO DISMISS 

48 I 2-8887-2001.v I 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 4 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 4 of 20

specific features and functions D-Link brand products sold in the United States by D2 Link Systems will use or contain. D-Link Systems approves features and functionality of 

3 devices it sells in the United States. 

4 13. I understand the FTC states on page 1, line 22 of its Opposition that D-Link Corp. 

5 "designs the products' graphical user interfaces ("GUis")[.]" This is incorrect. Product 

6 design is completed by the Asian vendors/manufacturers, which is then presented to D7 Link Corporation, D-Link Systems, and other regions of D-Link entities. D-Link 

8 Systems selects features and functionality in devices sold in the United States, for the 

9 products of the Asian vendors/manufacturers that are presented to D-Link Systems. D10 Link Corporation is the owner of the Brand and its assets. GUis must have similar look 

11 and feel across our product-line. Once D-Link Systems approves a product presented by 

12 the Asian vendor/manufacturer, the Asian vendor/manufacturer must offer us a generic 

13 D-Link Branded look and feel GUI. D-Link Systems will then take the Branded GUI and 

14 customize install flow, work-flow, and ensure the English language content is accurate. 

15 14. I understand the FTC makes certain statements regarding the mydlink app. As 

16 discussed in paragraph 20 of my April 3, 2017, Declaration, D-Link Systems creates the 

17 English content of mydlink for its United States customers and maintains the United 

18 States website for the apps locked by the respective vendors/manufacturers of the 

19 products. The devices that utilize this cloud service are locked to the United States 

20 region's system at time of manufacture by the vendors/manufacturers. The mydlink 

21 cloud system is maintained here in the United States for products D-Link Systems sells 

22 and is hosted by Amazon Web Services. 

23 15. I understand the FTC states on page 3, lines 22 of its Opposition that I "identified 

24 D-Link as 'responsible for product support, product manufacturing.'" The FTC 

25 misinterprets this statement my testimony. As stated in my April 3, 2017, Declaration, 

26 D-Link Corporation does not manufacture products. Product design is completed by the 

27 Asian vendors/manufacturers and then is presented to D-Link Corporation, D-Link 

28 -3-

No. 3: J 7-cv-00039-JD 

SUPPLEMENTAL BROWN DECL. ISO D-LINK 

CORPORATION'S MOTION TO DISMISS 

481 2-8887-2001.v I 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 5 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 5 of 20

Systems, and other regions of D-Link entities. D-Link Systems selects featmes and 

2 functionality in devices sold in the United States, for the products of Asian 

3 vendors/manufacturers that are presented to D-Link Systems. 

4 16. I understand that the FTC states on page 4, lines 7-8 of its Opposition that D-Link 

5 Corp. "ultimately selects and contracts with manufacturing vendors for products sold in 

6 the U.S.," and makes other statements on lines 14-16, citing my testimony. This 

7 statement is inaccmate as written. As I explained to the FTC, D-Link Systems has the 

8 discretion and right to decide on the features and functionality for the products that D9 Link Systems sells in the U.S. I understand that D-Link Corporation sells D-Link 

10 branded products in Taiwan and maintains agreements with Asian vendors/manufacturers 

11 for those branded products, which could be sold both in Taiwan and other regions of D12 Link entities. But D-Link Systems has the right to reject the sale of any of any those 

13 branded products. As I also explained to the FTC when I testified, I could not testify to 

14 D-Link Corp.'s contracts with their affiliates/vendors and had never reviewed any 

15 contract between D-Link Corp. and its affiliates/vendors. Therefore, I could not testify 

16 about the terms or content of any such contract. 

17 17. In addition, as stated in my April 3, 2017, Declaration, I do not speak, read, or 

18 write in Chinese, which is the language commonly used by the vendor/manufacturers that 

19 make the routers and IP cameras D-Link Systems sells and create firmware updates, as 

20 well as by the third-party testing company. D-Link Systems requests D-Link Corp., due 

21 to language, time-zone, and geographic location, to deal/communicate with the Asian 

22 vendors/manufacturers. D-Link Systems and D-Link Corporation work in a collaborative 

23 way when D-Link Systems needs to communicate or handle the product issues with 

24 vendors/manufacturers located in Asia for design, manufacturing issues, and security. 

25 Upon D-Link Systems request, D-Link Corp. will discuss features and functionality 

26 demanded by D-Link Systems with the Asian vendors/manufacturers. Put differently, D27 Link Systems decides what features and functionality the products it sells must have but 

28 -4-

No. 3: I 7-cv-00039-JD 

SUPPLEMENT AL BROWN DECL. ISO 0-LINK 

CORPORATION'S MOTION TO DISMISS 

481 2-8887-2001.v l 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 6 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 6 of 20

will communicate/negotiate with the vendor/manufacturers thrnugh D-Link Corp. D2 Link Systems has the discretion and right to decline any vendor/manufacturer and suggest 

3 new vendors if necessary to meet demands of a device D-Link System must sell. 

4 18. I understand that the FTC makes statements on page 5, lines 5-9 of its Opposition 

5 regarding D-Link Corp. 's alleged role in security testing, citing my testimony. As also 

6 discussed in my April 3, 2017, Declaration, D-Link Systems asks D-Link Corporation, 

7 due to language, time-zone, and geographic location, to deal/communicate with the Asian 

8 vendors/manufacturers and a third party testing company located in Taiwan on testing 

9 issues. Given the logistic advantage, D-Link Systems requests D-Link Corporation to 

10 help maintain quality security practices, audits, and issue escalation with the 

11 vendors/manufactures. D-Link Corporation is selling products in Taiwan, so it maintains 

12 agreements with vendors/manufactures, as well as third-party security experts. D-Link. 

13 System has also maintained its own vendor agreements for security vulnerability 

14 research. 

15 19. I understand that the FTC states on page 5, line 10 of its Opposition that D-Link 

16 Systems "has no budget for product security testing" based on my testimony, which I 

17 clarified the next day. The reason why D-Link Systems does not have a " formal" budget 

18 for security testing is because the Asian vendors/manufacturers are supposed to be 

19 responsible for security vulnerability issues and testing. Nonetheless, D-Link Systems 

20 will also secure third-party security research to audit security vulnerability issue and 

21 testing, as necessary and appropriate. 

22 20. I understand that the FTC made statements on page 5, line 27 to page 6, line 1 of 

23 its Opposition regarding the way in which the products D-Link Systems are tested by 

24 third parties, citing my testimony. These statements are incorrect or out of context for the 

25 reasons set forth in my April 3, 201 7, Declaration. To further clarify, D-Link Systems 

26 asks D-Link Corporation, due to language, time-zone, and geographic location, to 

27 deal/communicate with the Asian vendors/manufacturers. Onl y the Asian 

28 -5-

No. 3:17-cv-00039-JD 

SUPPLEMENTAL BROWN DECL. ISO D-LINK 

CORPORATION'S MOTION TO DISMISS 

4812-8887-200 1.v l 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 7 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 7 of 20

1 

2 

,., 

.) 

4 

5 

6 

7 

8 21. 

9 

10 

11 

12 

13 

14 

15 

16 

vendor/manufacturer of the device can accurately provide fixes for issues because they 

are responsible for the complete system- both hardware and software. When correcting 

issues, a device must get a system wide audit by the vendor/manufacture to ensure new 

bugs or new security issues are not introduced. As appropriate, D-Link Corporation 

reports to 0-Link Systems the coITection or effects of coITections from the 

vendors/manufacturers for D-Link Systems approval. But D-Link Systems must 

authorize the scope of all fixes for products it sells. 

I understand that the FTC made statements on page 9, lines 12-13 of its 

Opposition regarding product design and manufacture. Those statements are incorrect. 

0-Link Systems and 0-Link Corporation do not design or manufacture products for the 

United States market. Product design is completed by the Asian vendors/manufacturers, 

which is then presented to 0 -Link Corporation, D-Link Systems, and other regions of 0-

Link entities. D-Link Systems selects features and functional ity in devices sold in the 

United States, for the products of Asian vendors/manufactures that are presented to 0 -

Link Systems. 

I declare under penalty of perjury under the laws of the United States that the foregoing is 

1 7 true and correct. 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Executed this 24th day of April, 2017 at ~ountain Valley, California. 

4

1.tJ lrt---....,.>I 

~ -· 

-6-

No. 3: l 7-cv-00039-JD 

SUPPLEMENTAL BROWN DECL. ISO D-LlNK 

CORPORATION'S MOTION TO DISMISS 

4812-8887-200 1.v I 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 8 of 21
EXHIBIT A 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 9 of 21 Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 8 of 20
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 9 of 20

A 

v 

CIVIL INVESTIGATIVE DEMAND 

Oral Testimony 

1. TO 

D-Link Systems. Inc .. c/o Victoria Hao and Christine Yang 

Law Offloes of S.J. Chri&tine y.,,9 

Plaza Del Lago 

17220 NeWl)ope Str~t, Sutes 101 & 102 

Fountain Valley, CA 92708 

2. FROM 

UNITED STATES OF AMERICA 

FEDERAL TRADE COMMISSION 

This demanct Is issued pursuant to Section 20 of the Fed~ral T~de Commission Act, ·15 U.S.C. § 571>-1. In the 

course of an investigation to determine whether 1here i$, has been, or may be a violation of any laws administered 

by the Federal Trade Commlssiori by conduct, activities or proposed action as described in Item 6. 

3. LOCATION OF HE.ARING 

Federal Trade Commission 

San Francisco Regional Office 

901 Market Street, Suite 570 

San Francisco, CA 94103 

6. SUt)JECT OF INVESTIGATION 

See attached resolution. 

7. RECORDS CUSTODIAN/DEPUTY CU.STODIAN 

Kevin Havens/Laura 0. Berger 

600 Pennsylvania Ave., NW, NJ-8100 

Washington, DC 20580 

4. YOUR APPEARANCE. WILL BE BEFORE 

Laura D. Berger 

5. DATE AND TIME OF HEARIN!:)' 

July 17, 2014. 9 am. (PST) 

8. COMMISSION COUNSEL 

Laura D. Berger 

901 Market Street, Suite 5.70 

San Franclsc(), CA 94103 

INSTRUCTIONS AND NOTICES YOUR RIGHTS TO REGULA TORY ENFORCEMENT 

The dell'l'ef)' of this demand to you by any !Tl1lthod prescribed by the 

Commisslon's Rules of Pr.ad.ice Is legal senlioe and may sul>ject you lo a 

penally Imposed by law fOf failure to comply. This dem~nd d~s not 

require appro:val by OMB under the Pap~rwQrk R!!duction Ad. of 198Q. 

PETITION TO LIMIT OR QUASH 

The Comm1ssl0n'a RI.des of Pradice reqtJre that any petitton to limit or 

quash this demand be fllecl wittiln 20 days after service, ·or, If tne return 

d!lte ls.Jess then 20 days after seivice, prior to the return dele. The original 

an<I twelve ·copies of tt.ie petJtion must be n1e<1 wtth the Secretaiy of the 

Federal Trade Commission, and ooe copy should be serrt to the 

Commission Counsel named In nem a. 

FAIRNESS 

Tha FTC has a loogstancling Commilrr!enl to a fa~ regulatocy enforcement 

environment. If you are a small business (under sman Business 

Admlnis1rat1on standard&), you have a·rlght to contact the Small Busi~ 

Adminislration's Nation~! Ombl,ldsman at 1.a88-REGFAIR 

(1-881H34-32_,7) orwww.sba.gov/ombudsman regarding 1he fairness of 

the rompliance and enforcement activilies of the agency. You ahotld 

uocterstar)(l, l'\owever, lha1 tile National omti1,111sman.cannot ~ange, &loP, 

of d~ley a. federal agency enlorceinent !lction. 

The FTC sttlcify forbids teta.fiato;y acts by us employees. and you will not 

te J)enalized for exJ)l'esslng a concern about these actMties. 

TRAVEL EXPENSES 

Use the ericlosecl travel l/P1,1cher to qlalm compensation to which YO\J are entlJled as a Wllnees fQr the Commission. Th.e completed travel voucher and thls 

demand should be presented to Commission Counsiil for payment. If you are p&1manenlly or temporarily living somewhere other than the address on this 

demand and tt would require excessive travel for you to appear, you mu:Jt get P,ribr approval from Commission Counsel. 

A copy of !he Commission's Rules of Practice is availal>le onfine ath!l;1 ([ott.l:t/fTCP· ·o;so!Pmc:.ioe. Paper copies .are avail11ble upon request. 

FTC Fomi 141 (rev. 3/03) EXHIBIT 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 10 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 10 of 20

Form cf Certificate of Compiiancel!Vl/e. do c~rtify that all of the h1formation requir~d by th~ attach~d ·civil lnv.e.sti9atsve Derriartd which Js 

in the possession, costo·dy, co.htror ... or knoy..rledge of tl'ie rws.on to wh9m the demaflQ is directed has beeri 

submitted to ~ custodian named herein. 

If an lntefTl!Jga!qry or·a portion of the req~~t has not ~e11 fulfy.answer~d or P.ortiOn of the i'epo.rt has 

not be,en completed ihe objection to such intertog9t~ry or uncompleted portion and 'the reasons for the 

objection have been stated. 

Signattsre _________ ________ _ 

Title. _______ _____ _ _ ___ _ 

Swosn to: before me this .day 

Notary PubHe 

•1n lhe evenl that more lhiin or>e perllon is resp!)risif?le for amswering the inlerrogalorie.s or preparing the reoort. th.e certifitate. 

shBll ideniify the ~ite•109a!o(ies or portion of the report for which each certifying Individual was.respoll$ible. In place of.a i;wom 

mtement. the above certificate of conipllan~ may. be ;SUppOr1Q~ by .an unswom declaration as provfded for by 28 U.S.C. § ·H46. 

FTC Form 141 ·bad< (rev S/03) 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 11 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 11 of 20

----- -----

UNITED STATES OF AMERICA 

BEFORE TIUi: FEDERAL TR.ADE CO)WISSION 

COM,MISSIONERS: Jon Leibowitz, Chaitman 

Edith Ramirez 

Juli~ :llrill 

Maureen K. Ohlhausen 

Josh\ia D. Wright 

RESOLUTION D:um~TING USE OF COMPULSORY PROCESS JN NONPUBLIC 

INVESTIGATION OF ACTS AND PRACTICES RE~ATED TO CONSUl\'IER PRIVACY A1~19~ DA TA SE(:UR11Y 

File No. P95486.7 

Nature and Scope of Inv~tigatiom 

To detcn:nine, whether unnamed peroons, partrterships, corp0rations, or othm. are 

engaged ~ or may have ensaged in, de~tive or~ acts or practices relat~l'1o consumer 

privacy and/or data sectμ:ity, including bui not limited to the collection, acqliisition,, USe, 

disClosure, security, stntag~, retention. or di'spQsitioμ 9f consumer :irifqrmatiop., in Qr affecting 

commerce, in violation of Section 5 ~f the Federal. Trade 'Commission Act, l S U.S.C. '§ 4S. as 

amended. Sueh investigation shall, in addition, determine whether CQmtttlssion ·action to o~tain 

redress of injury' to conSu.mers or ot;hers wo~~ be in the pubJ.ic int.crest 

The Federal Trade Commission h~y re~lves and directs that any and all compulsory 

processes available to it be ~~ in coxmectfon with this investigation not to exCeed five (5) years 

fra'1:1 ~~ da~ .of issuance of this resolution. 'The expiration of this nve-~ period shall ~Qt 

limit or terminate the mveStigation 91' ~e legal effect of any e»mp$ory proc~s issued di.lring 

the 'five·yC111 peri~ The Federal Trade CommiSSion speci:fieally authorizes the filfp,g or 

C-Ontinuation of .actions tO enforce ~y S"qcli C:Ompulsoey process 8ftet. the expiration of the fiv~ 

year period. · 

Authority to Conduct Inves.tigatjon: 

Sections 6, 9, l0, and20 QftheFed~ Trade CQtnmission.Act, .IS U.S.C, '§§ 46~ 49, SO, 

and 57b-l, a$ amend~ FfC Procedures and Rules of Practice, 16 C.F.R. § l .I et s.eq: f,l.lld 

supplements thereto. 

By direction of the Commission. ~.,g .Ct,J~ 

Donald S. Clark , .. Secretaxy 

Issued: J~nuary 24, 20.l~ 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 12 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 12 of 20

DEFINITIONS 

CTVlL INVESTIGATlVE DEY.AND 

SCHEDULE FOR ORAL TESTIMONY 

TO D-LINK SYSTEMS, INC. 

As used:in this Civil Investigalive Demand, the following .definitions shaU apply; 

A. ''And," as well as "Qr," sha)lbe construed both conjunctively.am:! dfsjunctively, as 

ne(:eSsary, in order to bring \Vitl+in the scope·of any spetj'(kation in tltis Schedule all 

information that otherwise mi~t be construed to be outside the scope of the 

speciffoanon. 

B. ''Any" shall be cqnstrued to .include "all," and ''all" shall be con.strUed to iriclude ~Q.e 

wor<i "any,., 

C. "CID" sbaU·rnean this Cwil Investigative Demand, including the attached Resolution and 

this Schedule, and including the.Definitions, Instructions, and Specifications: 

D "IP Camera" shall mean (I) any Int~et ProtoC91 C'IP") -camera1 cloud camera., or other 

Intemet-accessible camera that transmits, or allows for the transmission of video, aud.iQ> 

ot audiovisual data over: the. Jn.ternet;. and (2) and any app ot software used to .operate, 

manage, or acoess such earner~. ''IP Camera" shB.11 al.so include any product that. the 

Company offers as an IP catnera t~ conSllJliers, 

E. ~'D-Unk" or "Compuey" shall mean D-Link Systems, Inc., its wholly or partially owned 

subsjdiaries, uriibcorp<>rat.ed divisions, joint ventures, op·erations under asstimed name~. 

and sffilfates, and all directors, .officers, employees, agents, consultants, and other 

persons working for or on behalf of!;be foregoing. 

F. "Each" shall b~ construed to faclude ''every.'' and "every'' shall be ci>nstrucd to include 

"each." 

G. .. FTC" or "Commission" shall mean the.Federal Trade C0m.roiss.ion. 

l. "!>e:r.sonal Information" .shall mean fudividl.iaiiy jdentifiable inforn1ation from or about 

an individual consumer incJt.,lding: (a) a first and last name; {b) a home or .other physical 

address, \nch.adiqg street n!:lllle and n~e of city or'town; (c) an email addr~s or other 

(>nline cont~ct information, such as an .instant messaging user identifier or a sct~n nall}e; 

( d) a telephone number; (e) a Social Security number; (f) a driver's license or other stateissued identification nwnber; (g) a financial institution account nuriiber~ (h) credit or 

deQit card infomu~iipn; (j) a per:sis~enl identifier for computers or mobUe devices, such as 

a. customer nuq:iber held in a "cookie_," a static Inter.net Protocol ("IP") address, or a 

processor serial number; (j) nonpublic communications and content, including, but not 

limited to, photos, videos,. audio, or olher dii:ital images ot audio eontent; or (k) biometric 

data associated with or derived from any data described j,n (j), 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 13 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 13 of 20

J. "Referring to;" "relatlng ~o,'.' ''regardilig," or "about" shall mean discussing, 

describing, reflecting, conta~ning, arralyzfug, stμdying, reporting, commenting, 

evidencin:g, wnstitμting, setting foJ1}1 ,c~msidering, reccmmending; concetnihg, or 

pertaining to, in whole or in part. · 

K. "Ro~ter" shall mean: (1) any device that c(>nnects two or more networks .together and 

forwards or tr-anstnit$ p~k~ aIQo~g th~; imd (2) and any app or software used to 

operate, manage, or ac~s such device. "Rollter'' shall also include any product that the 

Com~any offers as a router to <:onsumers. · 

L. "Vulnerability'' shall mean a flaw or weakiless in a softWflie security procedure, design, 

implerrientatjon~ orintemal contrpl tilat could be excrdsed (accidently triggered or 

intentionally e~ploited) and could result in a security brcacQ. 9r a violation"of the 

software!s security policy .and.lead to access to Personal Information that is not 

authorized by a consumer. 

M; You'' and "you:r" $hall mean the person or entity tp whom this CID ls issued. 

INSTRUCTIONS 

A. Petitio.ns to Lfurit or Quash: Any petitlon to limit or qu~sh this CID must be filed wiih 

the Secretary of the Commission no later than twenty (20) days after service of the CID, 

or~ if the return date is less than twenty (20) days after service, prior to the return date. 

Such petitibn shall set forth all assertions of protected status or other factual and legal 

objections to the CID» including all appropriate argument.S, affidavits, and other 

supportjng documentation. 16 C.F.R. § 2.lO(a)(l): Such peti'tion sball not exceed.:5,000 

words as set forth in 16 C.F:R. § 2: 1 O(a)(l) and muit include the sjgn.ed 5eparate 

statement of counsel required by 16 C.F.R. § 2.1 O(a)(2). The Commission will n'Qt 

consider petitlon~ to quash or Uniit absent a pre-filing meet and confer session with 

Commission -staff and, absent ex:ttaordinary circums~nces, wm consider only issues 

:raised durμig the JJJ.eet and co:i.fe.r process. 16 C.F.R.. § 2.7(k); see also § 2.il(b). 

B. Procedures: This CID is issued pursuant to Section 20 of the Federal Trade Commission 

Act, 15 U.S. C. § 57b-1. The ta:klng of orai testimon) p'Ui'Suant to this .CID will be 

condu~te{l iμ 90nfo.rmity wi~ that se~tion and with Part 2A of the Commission's Rules, 

16 C .F.R. §§ 2.. 7(f), 2.7(h)j and 2.9. 

SPECIFICA TIQNS 

~e Company is reql.).ii;ed tQ designate and'.make a\1ailable one or rn.ore officers, directors, 

or managing agents, or others who consent, to t~iify on its behalf Unless a $i.ngle individual is 

designated, the Company must designate in advance and in Writing the matters on which each 

des:igxwe will testify. the persoh(s) designated must testify about infonnation known or 

reasonably available t9 the Company and their res.timony shall b~ binding upon it. 16 C.F.R. § 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 14 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 14 of 20

·! 

2.7(h). The person(s) designated must be prepared to provide testin;iony relating to tbe following 

top:ics: 

A. All procedures followed and steps taken by th.e Comp.any to establish, test, or maintain 

the fimctionaljty and S<Wurity of its IP Cameras and RQut~rs, the m~iws by wbfcb such 

procedures or steps are documente.d, and the rcesults of sucb procedures and steps. 

B. All pro <Xiur~ followed and steps :tak~n by the Company to identify and obtain r'~orts 

.and ¢ther info~ation r.egardirlg Vldilerabilities affecting the Company's IP Cametas and 

Routers~ the means by which such procedures and step~ are documented, and the results 

of such procedures and steps. 

C. All Vuln~rabilities affecting the Company's. IP Cameras and Router5, and for each: 

a. The means by and approxim~te d~te on which ¢e Company learn~ of the 

Vulnerability; 

b. All ~ans by which the Vulrietability could be or could hav.e been expJoited to· 

g~in μnauthoriz~d control of an IP Camera ot Router or access 'to. PerS<>.nal 

lnfoffi?.ation, and a step-by-ITTcp ex.planatfon of how such .exploitation could occur; 

c. All steps the Company took to investigate the Vulnerability and the results of 

such1nvesngabon;and 

d. AU steps the CQmpany to.ok to remediate the Vulnerability or its impact on 

oonsun).ers. the app.tox.imate d!!-tes ·on wbich you took each step, and how you dOC\lltl~ted it; . . 

e. All steps the Company took to notify or otherwise co~llllicate with consumers 

regarding the Vulnerability or regarding your efforts to remediate it; and 

f. Any change made to the procedures followed ot steps taken by the Company to 

establish. test, or maintain :th~ security of its IP cameras and routers fo1Iowing, or 

as a re.sult of, the Vulnerability. 

D. AU e-0ri:lmunications received by you from consumers, security researchers, or other third 

pameS regat:di.ng the security Qfyour IP Cameras or R.outers or the privacy of the 

information they transtμit, and for each such con.lo1unication: 

a. The concerns addressed by the communications, and 

b. Your respot1$e. 

E. All features or controls that you pr0vi9e to enable users of your IP' Carner~ an(:} Route{s 

to restrict access to or eontrol of the device or information transmitt~d by the device; the 

steps a tiser must take to implement any such featilre or control; the dates on which tlie 

featw:e or contr1>l was available; the rat~ at Which it was implemented by users, and its 

effectiveness. 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 15 of 21
EXHIBIT B 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 16 of 21 Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 15 of 20
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 16 of 20

0 CIVIL INVESTIGATIVE DEMAND 

Oral Testimony · 

1. TO 

William Brown 

c/o D-Link Systems, Inc. 

17595 Mt. Hermann St. 

Fountain Valley, CA 9270.8 

2. FROM 

UNITED STATES OF AMERJ~A 

FEDERAL TRADE COMMISSION 

This demand is issued pursuant to Section 20 of the Federal Trade Corrimi~ion Act, 15 U.S. C. § 57b-1, in the 

course of an investigation to determine whether there is, has been, or may be a violation of any laws administered 

by the Federal Trade Commission by conduct. activities or proposed action as described in Item 6. 

3. LOCATION OF HEARING 

Federal Trade Commission 

San Francisco Regional Office 

901 Market Street. Suite 570 

San Franeisco, CA 94103 

6 . SUBJECT OF INVESTIGATION 

See attached resolution. 

7. RECORDS CUSTODIAN/DEPUTY CUSTODIAN 

Kevin Havens/Laura 0 . Berger 

600 Pennsylvania Ave., NW, NJ-8100 

Washington, DC 2P580 

4. YOUR APPEARANCE WIU BE BEFORE 

Laura D. Berger 

5, DATE AND TIME Of HEARING 

July 15, 2014, 9 a.m. (PST) 

8. COMMISSION COUNSEL 

Laura D. Ber~ 

901 Mar1<et Stre~t. Suite 570 

San FrancisCQ, CA 94103 

DATE ISSUED CO MM

vf~cJ( 

ISS<ONER~ IGNATURE ~ 

INSTRUCTIONS AND NOTICES YOUR RIGHTS TO REGULATORY ENFORCEMENT 

The delivery of 11\is demand to you by anv. method prescribed by the 

GommlsGlon's Rules of Practice Is legal service .and may subject you to-a 

pen1Jty Imposed by law for failure to comply. This demand does not 

require approval by OMB under !he Paperwork Reduction Act of 1980. 

PETITION TO LIMIT OR QUASH 

The Commiasion's Rules of Pteclice require lhal l!ny peUtlon to litrit er 

quash !his dem:md be ftled wtlhln 20 days a lier seivi~. or, If tne re1vm 

date is less than 20 days after seMei. prior to the return date. 'The original 

and ~Ive copies of Ille pelitiori must be flied wtth the Seaetery of the 

Federal Trade Commission, and one ci:lfTY shoyld be sent to Ille 

Commission Counsel named In It.em .a. 

FAIRNESS 

The FTG has a longstanding oommltment to a fair regulalory enforcement 

environment If y0u are a smell bualness (under SmaU Business 

Administration sfandarda). yov hove • 11ght to contact the Small Business 

Administration's National Ombudsman at 1·888-REGFAIR 

(1-888-734-3247) or ba gov/ombtJO&man regan11ng lhe falmegg or 

~ compliance and enforcemenl ectivitics of Ille agency. You should 

und81$1and. ~.that the National Oniludsman cannot ehan9e, stop. 

or delay a federal agency enforcement action. 

The FTC slricUy (orbi<b retallaioty •cts by ti& employees, and you Will not 

be Pllnallzed for expressing a coneem abouj thes,e activities. 

TRAVEL EXPENSES 

Use the enclosed h:avel voucher tq claim e<;impensatlon to which you are entitled es a witness for the Commission. The compleled travel 11oueher and this 

demand should be presented to Commission Counsel for payment. If you are pennanenlly or temponrily ~Ying somewhere other than the addre$$ on this 

demand and ii would require excessive travel for you to appeer. you must get prior approval from Commission Counsel. 

A copy of the Commission's Rules or Practice is evaDeble online et hf4"2t.IM !y!f CR J'psof?r11s::t~. Paper copiH are avalable upon request. 

FTC Form 141 (rev. 3/03) EXHIBIT 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 17 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 17 of 20

Form cf Certificate of Compliance" 

lfWe do certify that all of lhe information required by tt;ie attached Civil ln\lestigative Demand which i'S 

In ·1he possession, custody, control, or knoWledge of the person to whom the demand is directed has been 

submitted to a custodian named herein. 

If an interrogatory or~ pPrtion of the req1.1est hH noi be~n fufiy answered or portion of tlie report ha& 

not been comp et~d the obj~tipn to l!IUCn interrogatory or i.mcompleted portlor.1 and the reasons for the 

object,tin have be.en stateq. 

Signature _____________ ____ _ 

Title _______________ _ 

Sworn to before me this day 

Notary Public 

•Jn 1t11n:w nt tJlat .nore tnan one person is respolf:S!ble for answering the Interrogatories or preparing the report, the certfficet,e 

·shall Identify the :nterrogelories or.Portion ·or the report fot which each certifying ·indfvuSual was rMpon51Jle. In place of a:swor1,1 

1talement; the above c:ertificale of compliance may be supported by an unswom dectaretion as provided for .by 28 U·S C .§ 1746. 

FTC Form 141 ~acl< (rev 3/03) 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 18 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 18 of 20

UNITED SfATES OF AMERICA 

BEFORE THE FEDERAL TRADE COMMISSION 

COMMISSIONERS: Jon Leibo:Witz, Chairinan 

Edith Ramirez 

Julie B"rill 

Maureen K. Oh].hausen 

Jos.hua ~ Wright 

RES0Ll.]1JON DIRECTING USE OF COMPULSORY PROCESS IN NONPUBL1C 

iNVESTIGAl'ION OF ACTS AND PRACTICES RELATED TO CONSUMER PRIVACY 

AND/OR DATA SECORITY 

File No. P954807 

Nature and Scope of Investig_atiori: 

To d~ennine whether unnamed persc)ns, partnerships, corporations, or others are 

engaged in. or may have engaged ill, de~ptive or unfair acts or practices related to consumer 

privacy and/or data securi~, in~lud.ing but not limited _to the collection. acq~ition, use, 

disclosure, security, sterage:.-retention, or disposition of consumer information, in or affecting 

commerce, in vjolation of Section.5 of the Federal Trade Commission Act, l5 U.S.C. § 45,.as 

amended. Such investigation shall, in addition. detcnnine whether Commission action to obtain 

redress of injury to consumers ot otheIS would be in the pubJic interest. 

The Federal Trade Commlssion hereby r.esolves and directs that any and.all C{)mpulsory 

processes available to it be used in corurecti.on With s investigation·noi ·to· ex~ed live (S) years 

from the date of issuance of this resolution. The expiration of this five:..year period shall not 

limit or tenninate the investigation or the legal effect of any compulsory process i.Ssued during 

the .nve-year period. The Federal Trade Coi:nmission specifically authorize$ the filing or 

continuation of actions. to eh.force BllY such compμisory process after the e"piration of-the fiveyear period. · · 

Aμthoricy· to Conduc~ Investigation: 

Sections 6,. 9, 10, ahd 20 ofth~ .. Fede:ral Tl'.84e ~mntission Act, 15 U:S.C: §§ 46, 49,.5-01 

and S71r I, as amended; FTC Procedμres and Rules of Pr~tice, 16 C..F .R. § 1, 1 et seq. a.rid 

supplements th.eieto. 

By dU,eetion of 1he Commission. ~~. C&,J~ 

Donald S. Clark 

Secretary 

bJued: JZJJuary 24, 20.U 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 19 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 19 of 20

CIVIL INVEST~GATIVE DEMANI.> 

SCHEDULE FOR ORAL TESTIMONY 

TO WILLIAM BROWN 

DEFINITIONS 

As '1Sed in (his Civil Investigative Demand, the following ·definitiO.ns shall apply: 

A. "And," as well as "or/' sha'.11 be construed b.oth conjunctively ~d disjunctively, as 

necessary~ in order to bring within the scope of any specification in this ScheduJe .all 

iri.fonnation that otherwise might be construed to be outside the scope ofth~ 

SJ?ecificati<m. 

B. "Any" shall be constJued to inolude "all," and "sill" ~hall be consjrued to include tpe 

word "any.'' 

c. "Cto•\ shiμl mean this Civ,il Investigative Demand, including t,he attached Resolution and 

this Sch~ule, and including tlJe Definitions, Instructions, and Specifications. 

D. "D-llik" oi "Companr" shall mean D-Link: Systemsi Inc,1 its wholfy 9r partially owne<l 

sμbsidiaries, unincorporat.ed divisions. joint :ventures, operatt6I1S under assumed names, 

and afflliates, and. aUd~ctors, officers, employ<!eS~ agents, cOJ).SJJltants, and other 

persons working for or on be.half of th~ foregoing. 

E. "Eaeh" shall be construed to mclude "every," and. "every" shall be construed to include 

"et~." 

p, 

G. 

H. 

1

•FTC' or "Commission" shall mean the Pederal Trade Cqmmi~siQn. 

"Refi.erring to" "relating to'' "regardina "or "about" shall mean discussing . ' . I , . e> ' 

describing, reflecting, containing; analyzing, st\l,dying, reporti~g, ·commenting, 

eyidencing) -constituting, setting for:th,. Considq::i_n,g, fCCoIDlnending, CODCeffiiilg, OT 

pertaining to; in whole or .in part. 

You" and "your" shall mean the p.erson or entity to whom this CID is issued. 

INSTRUCTIONS 

A. Pe.tifions io Limit or Quash: Any petitfori to limit Qr qtiash this CID must be filed with 

the Secretary pf the Commission no latet than twenty (20) days after service Of the CJD, Or;· if the 

return date is less than twenty (ZO) days after·service, prior to the return date. Such petition shall 

set furth .all assertions of protected status or other factual and legal objections to the CI1), 

incli.Jdmg all :appt(lpriate argument~, affid.avitS, and other supportirig docUm.entation. 16 C .. F.R. § 

2.1:0(~)(1). Such petifi~n s.hall not exce<~d $,000 wqrds as s.etforth in 16 C.F.R. § 2.lO(a)(t) and 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 20 of 21
Case 3:17-cv-00039-JD Document 64-2 Filed 04/24/17 Page 20 of 20

must inc1ude'the ~gned sepl!fate statentel)~ of c.Qμnsel required by 16 C .. F.R. § 2.10(a)(2). The 

Commiss.ion wi.ll not ~onsider ~titions t9 qu~sh or limit absent fl pr~-flling meet and conf~t 

session with Commission staff and, absent extraor.dlnary circumstances, ~I consider o~.:y 

issues ntl$ed during the meet and .confer process. 16 C;F.R. § l.7(k); see also§ Z.ll(b). 

B, Pr9cedures: This CID is issued pUTSQaμt to Section 20 of the F~eral Trade Commis~iQn 

Act, 15 U .S.C. § 57b-l. The taking of oral testimony pursuant to this CID will be con.ducted 1n 

c6nformity with that section and with: Plkt 2A ef the Commission's Rules, 16 C.F.R. §§ 2.7(f), 

2.9.. 

SPECIFICATIONS 

Su.bject'5 for testimony wil1 include, bu.t will not be limited to, the following: 

A. Your roJe., responsibitity, communications, and ~tfoll$ as an: enipfoyee of the Company~ 

and 

B. Your professional background, ·qo.aJHications, and opinions. 

Case 3:17-cv-00039-JD Document 178-25 Filed 09/21/18 Page 21 of 21