February 27, 2018

VIA ECF (CHAMBER’S COPY VIA HAND-DELIVERY TO CLERK’S 

OFFICE) 

The Honorable James Donato

United States District Judge 

San Francisco Courthouse

450 Golden Gate Ave., Courtroom 11, 19th Floor

San Francisco, CA 94102

Re: Federal Trade Commission (FTC) v. D-Link Systems, Inc., 

No. 3:17-cv-00039 JD

 

Dear Judge Donato:

Pursuant to the Court’s Order filed on February 20, 2018 (Dkt. No. 109), Defendant 

D-Link Systems, Inc. (DLS) respectfully submits this letter brief in response to FTC’s 

letter brief filed February 15, 2018 (Dkt. No. 108). For the following reasons, this 

Court should deny FTC the relief it seeks. 

I. FTC’s Complaint Confirms the Relevance of FTC’s Shodan Activities

As this Court has noted, “FTC says that it undertook a thorough investigation before 

filing the complaint[.]” Order Re Motion to Dismiss, Dkt. No. 90, at 9 (citations 

omitted). FTC’s Complaint avers: “[R]emote attackers could search for vulnerable 

devices over the Internet and obtain their IP addresses using readily available tools, 

such as a popular search engine that can locate devices running particular 

software versions or operating in particular locations.... In many instances, an 

attacker could then take simple steps to exploit vulnerabilities in Defendants’ routers 

and IP cameras[.]” Compl., Dkt. No. 1, ¶ 17 (emphasis added). Shodan is that socalled “popular search engine,” as confirmed by FTC’s Letter Brief. DLS should be 

permitted to learn the facts underlying FTC’s claims, as alleged in the Complaint.1 

Because FTC itself intentionally injected Shodan into this case, FTC’s Shodan-related 

activities are relevant and discoverable. See FRCP 26(b)(1). 

FTC Counsel represented to this Court at the March 9, 2017 Rule 12(b)(6) hearing 

that FTC’s Complaint at paragraphs 16-18 relied on “a variety of web sites that 

identify exploitations based on basically like (chk)white hat hackers or (chk)gray hat 

hackers identifying vulnerabilities in devices.”2 In a series of questions, the Court 

then put its finger on exactly why FTC is not entitled to the relief it seeks here.3 FTC 

Counsel was simply unable, or unwilling, to disclose the nature of FTC’s Shodan- 

 

1 Use of Shodan is also relevant to DLS’s Eighth Defense. See Answer, Dkt. No. 92, at 15.

2 Fed.R.Civ.P 12(b)(6) Hr’g Tr. 9:8-11, Mar. 9, 2017. 

3 Id. at 9:13–10:20. 

Case 3:17-cv-00039-JD Document 110 Filed 02/27/18 Page 1 of 4
The Honorable James Donato 

February 27, 2018 

Page 2 

related activities as a factual foundation for the allegations in the Complaint.4 DLS 

properly seeks to discover that information now in its defense.

FTC cannot use Shodan searches as a sword against DLS, and then seek to shield

from discovery the putative “facts” on which it built its Complaint. Shodan is not a 

consulting expert under FRCP 26(b)(4)(D), and there is no common-interest privilege 

here, as confirmed by FTC’s own description of Shodan’s services in the Complaint. 

Nor was Shodan hired by FTC to assist it in the professional rendition of legal 

services. FTC’s voluntary interactions with third parties like Shodan, described 

above, are not privileged.5 See also Church & Dwight Co., Inc. v. Mayer Laboratories, 

Inc., No. C11–3288 EMC (JSC), 2011 WL 5827222, at *2-3 (N.D. Cal. Nov. 18, 2011).

Even if the “fruit” of FTC’s Shodan activities was fact work product—it is not—DLS 

has a substantial need for it because FTC’s Complaint spans a period of years and 

DLS cannot duplicate the results of whatever Shodan searches FTC conducted in the 

past. Cf. Order on Discovery Dispute, FTC v. Qualcomm, No. 17-cv-00220 LHK (NC), 

Dkt. No. 152, at 1, 4-5 (N.D. Cal. Aug. 24, 2017) (informant privilege overcome by 

need for third-party communications and Qualcomm’s right to defend itself).

A. Shodan is Not Westlaw, So FTC’s Shodan Activities Are Not 

Protected Work Product

Although FTC suggests otherwise, see FTC Letter, Dkt. No. 108, at 2, Shodan is not 

Westlaw. Use of it appears controversial among computer experts. See, e.g., Ali 

Shemshadi et al., Internet Based Search and Crawler Engine for the Web of Things, 

in MANAGING THE WEB OF THINGS, at p. 38 (2017) (emphasis added) (“Shodan is 

basically designed as a search engine for hackers. It identifies and hacks into 

password protected devices connected to the Internet. ... Due to ethical issues and 

scope matters, we do not include Shodan in our study.”). It has been described as a 

“real threat to Internet-facing ICS and thereby national security.”6 In 2016, U.S. Navy 

Admirals wrote to the Secretary of Defense requesting assistance dealing with 

“nefarious cyber payloads” like “Shodan,” which “have the potential to debilitate our 

installations’ critical infrastructure.”7 

 

4 Id. at 8:8–10:20. 

5 Regardless, the work-product privilege does not protect facts contained within the work product. See 

Cal. Sportfishing Prot. All. v. Chico Scrap Metal, Inc., 299 F.R.D. 638, 644 (E.D. Cal. 2014). 

6 Roland C. Bodenheim, Captain, USAF AFIT-ENG-14-M-14, Impact of the Shodan Computer Search 

Engine On Internet-Facing Industrial Control System Devices, Thesis, Dep’t of the Air Force, Air 

University, p. 102, http://www.dtic.mil/dtic/tr/fulltext/u2/a601219.pdf (emphasis added). 

7 Bill Gertz, Commanders Urge Pentagon to Counter Growing Threat of Cyber Attacks on Industrial 

Controllers, Flash/Critic, Cyber Threat News (Feb. 28, 2016), http://flashcritic.com/commanders-urgepentagon-to-counter-growing-threat-of-cyber-attacks-on-industrial-controllers/ (emphasis added). 

Case 3:17-cv-00039-JD Document 110 Filed 02/27/18 Page 2 of 4
The Honorable James Donato 

February 27, 2018 

Page 3 

II. Shodan is Not a “Remote Computing Service” Under the Stored 

Communications Act

FTC incorrectly asserts, see FTC Letter, Dkt. No. 108, at 3, that Shodan is a “remote 

computing service” (RCS) under the Stored Communications Act, 18 U.S.C. §§ 2701-

12 (SCA). FTC’s bald statement is contrary to prevailing case law, principals of 

statutory construction, and legislative history. See In re Zynga Privacy Litigation, 

750 F.3d 1098, 1105-06 (9th Cir. 2014) (determining the definition of “contents”); cf.

Joffe v. Google, Inc., 746 F.3d 920, 927 (9th Cir. 2013) (definition should “conform

with the common understanding held contemporaneous with the enacting Congress”).

SCA only protects contents of communications that are “of the two kinds of network 

services that were common in 1986” and thus, “stored search queries” likely fall

outside of the dichotomies codified by the statute. See Orin Kerr, The Next Generation

Communications Privacy Act, 162 U. PA. L. REV. 373, 395 (2014). Further, FTC’s

assertion of statutory rights under the SCA cannot be squared with the intent of the

law—to provide Fourth Amendment-like protections to individuals and businesses.

S. REP. 99-541, 1-3, reprinted in 1986 U.S.C.C.A.N. 3555, 3555-57. Shodan is not an

RCS, so the SCA does not apply. Regardless, FTC overstates the protections provided

under 18 U.S.C. § 2702, which permits disclosure of “a record or other information 

pertaining to” an RCS subscriber or customer, but not the “contents” of covered 

communications, “with the lawful consent of the customer or subscriber” or “to any

person other than a governmental entity.” 18 U.S.C. § 2702(c) (emphasis added). 

Because DLS is not a governmental entity, Shodan may divulge FTC’s “record or

other information” requested by the subpoena, regardless of FTC’s consent. See, e.g,

Loop AI Labs Inc v. Gatti, No. 15-CV-00798-HSG(DMR), 2016 WL 787924, at *3 (N.D.

Cal. Feb. 29, 2016), appeal dismissed (May 20, 2016).

In any event, the materials at issue are within the scope of DLS’s Requests for

Production under FRCP 34—which is why these materials were listed in FTC’s 

categorical privilege log even before the Shodan subpoenas were served—and 

therefore this Court can direct FTC to consent to the production of those materials. 

See Flagg v. City of Detroit, 252 F.R.D. 346, 363-66 (E.D. Mich. 2008). Alternatively, 

this Court can order FTC to produce the Shodan materials it possesses pursuant to 

FRCP 34, obviating the need for third party Shodan to also produce such materials.

For these reasons, DLS respectfully requests that the Court deny FTC the relief it 

requests.

Respectfully submitted,

s/ Patrick J. Massari 

Patrick J. Massari of CoA [admitted pro hac vice]; Erica Connolly of Vinson & 

Elkins LLP

Attorneys for Defendant D-Link Systems, Inc.

Case 3:17-cv-00039-JD Document 110 Filed 02/27/18 Page 3 of 4
-1-

No. 3:17-cv-00039-JD

CERTIFICATE OF SERVICE OF DLS RESPONSE 

TO FTC DISCOVERY DISPUTE LETTER

4818-9994-9888.v1

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CERTIFICATE OF SERVICE

I, Patrick J. Massari, declare as follows:

 Pursuant to Civil L.R. 5-1(h)(2) and Civil L.R. 5-5(a), I hereby certify that on February 27, 

2018, in Washington, D.C., in addition to serving a true and correct copy of the foregoing 

Defendant D-Link Systems, Inc.’s (“DLS”) Response to Plaintiff Federal Trade Commission’s 

(“FTC”) Discovery Dispute Letter, Dkt. No. 108, on counsel for Plaintiff FTC via by using this 

Court’s CM/ECF system, I also served a true and correct copy of DLS’s Response to Plaintiff 

FTC’s Discovery Dispute Letter on the following counsel for third-party Shodan, LLC, via e-mail:

Reid Wittliff

Wittliff | Cutter | Austin, PLLC

1803 West Avenue 

Austin, Texas 78701 

Office: 512.960.4866 

Fax: 512.960.4869 

Skype: reid.wittliff

reid@wittliffcutter.com

 Attorney for Shodan, LLC 

I declare under penalty of perjury under the laws of the United States that the foregoing is 

true and correct.

Executed this 27th day of February, 2018 at Washington, D.C. 

 

 s/ Patrick J. Massari 

 Patrick J. Massari

Case 3:17-cv-00039-JD Document 110 Filed 02/27/18 Page 4 of 4