D-Link Systems’ Opposition to Plaintiff FTC’s 

Motion for Summary Judgment

 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CAUSE OF ACTION INSTITUTE 

JOHN J. VECCHIONE [admitted pro hac vice] [Lead Counsel] 

john.vecchione@causeofaction.org 

MICHAEL D. PEPSON [admitted pro hac vice] 

Admitted only in Maryland. 

Practice limited to matters and proceedings before United States Courts and agencies. 

michael.pepson@causeofaction.org 

JESSICA LEE THOMPSON [admitted pro hac vice] 

jessica.thompson@causeofaction.org 

ASHLEY SALVINO [admitted pro hac vice] 

ashley.salvino@causeofaction.org 

JOSHUA N. SCHOPF [admitted pro hac vice] 

josh.schopf@causeofaction.org 

NICHOLE C. WILSON [admitted pro hac vice] 

nichole.wilson@causeofaction.org 

KARA E. MCKENNA [admitted pro hac vice] 

kara.mckenna@causeofaction.org 

CYNTHIA CRAWFORD [admitted pro hac vice] 

 cynthia.crawford@causeofaction.org 

1875 Eye Street N.W., Suite 800 

Washington, DC 20006 

Telephone: (202) 422-4332/Facsimile: (202) 330-5842 

Christine Yang (SBN 102048) 

 chrisyang@sjclawpc.com 

LAW OFFICES OF S.J. CHRISTINE YANG

17220 Newhope Street, Suites 101 &102 

Fountain Valley, CA 92708 

Telephone: 714.641.4022 

Facsimile: 714.641.2082 

Christopher Kao (SBN 237716) 

 christopher.kao@pillsburylaw.com 

Brock S. Weber (SBN 261383) 

 brock.weber@pillsburylaw.com 

PILLSBURY WINTHROP SHAW PITTMAN LLP 

Four Embarcadero Center, 22nd Floor 

San Francisco, CA 94111-5998 

Tel.: 415.983.1000 / Facsimile: 415.983.1200 

Attorneys for Defendant D-Link Systems, Inc.

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

FEDERAL TRADE COMMISSION, 

Plaintiff, 

v. 

D-LINK SYSTEMS, INC., 

Defendants.

Case No. 3:17-cv-00039-JD 

DEFENDANT D-LINK SYSTEMS, INC.’S 

OPPOSITION TO PLAINTIFF FEDERAL 

TRADE COMMISSION’S MOTION FOR 

SUMMARY JUDGMENT 

Date: November 8, 2018 

Time: 10:00 a.m. 

Courtroom: 11 

Judge: Honorable James Donato 
D-Link Systems’ Opposition to Plaintiff FTC’s 

Motion for Summary Judgment

i Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

TABLE OF CONTENTS 

Page 

I. INTRODUCTION ............................................................................................................... 1

II. LEGAL STANDARD ......................................................................................................... 2

A. Summary Judgment Standard .................................................................................. 2

B. Standard for “Deception” Claims Under the FTC Act. ........................................... 3

III. ARGUMENT ...................................................................................................................... 4

A. There are Genuine Issues of Material Fact that Preclude 

Summary Judgment In Favor of the FTC on Count 2. ............................................ 4

1. There Are Material Factual Disputes as to the 

Representations Made in the DLS Security Advisory Website. .................. 4

a. The “Express Claims.” .................................................................... 4

b. The “Implied” Claims. ..................................................................... 6

2. There are Material Factual Disputes Regarding the 

“Reasonableness” of the Practices Used for DLS Products ........................ 8

i. There Is Conflicting Expert Testimony on 

Critical Issues. ................................................................................. 9

ii. There Are Genuine Factual Disputes as to the 

Practices Used by DLS. ................................................................. 10

3. There are Material Factual Disputes Regarding the 

“Materiality” of the Alleged Representations. .......................................... 16

B. There are Genuine Issues of Material Fact that Preclud 

 Summary Judgment In Favor of the FTC on Count 3. ......................................... 17

1. The DLS Datasheets At Issue In Count 3 Either 

Contain Nonactionable Opinions or are Literally True. ............................ 17

2. There are Material Factual Disputes Regarding the 

Security of the Accused Routers. .............................................................. 18

3. There are Material Factual Disputes Regarding the 

“Materiality” of the Alleged Representations. .......................................... 20

C. There are Genuine Issues of Material Fact that Preclude 

Summary Judgment In Favor of the FTC on Count 6. .......................................... 21
D-Link Systems’ Opposition to Plaintiff FTC’s 

Motion for Summary Judgment

ii Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1. There Are Material Factual Disputes as to the 

Representations Made in the DLS Business and 

Consumer IP Camera User Manuals and Graphical User Interfaces. ....... 21

2. There are Material Factual Disputes Regarding the 

Security of the Accused IP Cameras. ........................................................ 23

3. There are Material Factual Disputes Regarding the 

“Materiality” of Challenged Images. ......................................................... 24

IV. CONCLUSION ................................................................................................................. 25
D-Link Systems’ Opposition to Plaintiff FTC’s 

Motion for Summary Judgment

iii Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

TABLE OF AUTHORITIES 

Page(s) 

Cases

Allen v. FCA US LLC, 

No. 17-00007, 2017 WL 1957068 (W.D. Va. May 10, 2017) ................................................... 17 

Anderson v. Liberty Lobby, 

477 U.S. 242 (1986) ..................................................................................................................... 2 

Atari Corp. v. 3DO Co., 

No. 94–20298, 1994 WL 723601 (N.D. Cal. May 16, 1994) ..................................................... 17 

Carlay Co. v. Fed. Trade Comm’n, 

153 F.2d 493 (7th Cir. 1946) .................................................................................................. 3, 17 

Cook, Perkiss & Liehe, Inc. v. N. Cal. Collection Serv. Inc., 

911 F.2d 242 (9th Cir. 1990) ........................................................................................................ 3 

Donachy v. Playground Destination Props., Inc., 

No. 10-4038, 2013 WL 3793033 (D.N.J. July 19, 2013) ........................................................... 17 

Fed. Trade Comm’n v. Cyberspace.com, LLC, 

453 F.3d 1196 (9th Cir. 2006) ................................................................................................... 3, 4 

Fed. Trade Comm’n v. DIRECTV, Inc., 

No. 15-01129-, 2018 WL 3911196 (N.D. Cal. Aug. 16, 2018) ............................................. 3, 23 

Fed. Trade Comm’n v. Nat’l Urological Grp., Inc., 

645 F. Supp. 2d 1167 (N.D. Ga. 2008) ......................................................................................... 8 

Fed. Trade Comm’n v. Stefanchik, 

559 F.3d 924 (9th Cir. 2009) ........................................................................................................ 3 

Fed. Trade Comm’n v. Sterling Drug, Inc., 

317 F.2d 669 (2d Cir. 1963) ..................................................................................................... 4, 6 

Federal Trade Commission v. Medlab, Inc., 

615 F. Supp. 2d 1068 (N.D. Cal. 2009) ........................................................................................ 7 

Glen Holly Entm’t, Inc. v. Tektronix Inc., 

352 F.3d 367 (9th Cir. 2003) .................................................................................................... 5, 8 

Greater Hous. Transp. Co. v. Uber Techs., Inc., 

155 F. Supp. 3d 670 (S.D. Tex. 2015) ........................................................................................ 18 

In re Cliffdale Assocs., Inc., 

103 F.T.C. 110, 1984 WL 565319 (1984) .................................................................................... 4 
D-Link Systems’ Opposition to Plaintiff FTC’s 

Motion for Summary Judgment

iv Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

In re Countrywide Fin. Corp. Mortg. Mktg. & Sales Practices Litig., 

601 F. Supp. 2d 1201 (S.D. Cal. 2009) ...................................................................................... 17 

In re LabMD, Inc., 

No. 9357, 2014 WL 2331027 (F.T.C. May 19, 2014) ........................................................ 1, 9, 10 

In re POM Wonderful LLC, 

No. 9344, 2013 FTC LEXIS 6 (F.T.C. Jan. 10, 2013) ..................................................... 6, 16, 21 

In re Thompson Med. Co., 

104 F.T.C. 648, 1984 WL 565377 (1984) .................................................................................... 8 

In re Worlds of Wonder Sec. Litig., 

35 F.3d 1407 (9th Cir. 1994) ........................................................................................................ 3 

In re Yahoo! Inc. Customer Data Sec. Breach Litig., 

No. 16-02752, 2017 WL 3727318 (N.D. Cal. 2017) ................................................................ 5, 8 

Intermountain Stroke Ctr., Inc. v. Intermountain Health Care, Inc., 

No. 13-00909, 2014 UWL 1320281 (D. Utah Mar. 31, 2014) ................................................... 17 

Kraft, Inc. v. Fed. Trade Comm’n, 

970 F.2d 311 (7th Cir. 1992) ........................................................................................................ 4 

L.A. Taxi Coop., Inc. v. Uber Techs., Inc., 

114 F. Supp. 3d 852 (N.D. Cal. 2015) ........................................................................................ 18 

Lenscrafters, Inc. v. Vision World, 

943 F. Supp. 1481 (D. Minn. 1996) ........................................................................................... 17 

Lopez v. CTPartners Exec. Search, Inc., 

173 F. Supp. 3d 12 (S.D.N.Y. 2016) ........................................................................................ 5, 8 

Newcal Indus. v. Ikon Office Solution, 

513 F.3d 1038 (9th Cir. 2008) ...................................................................................................... 3 

Pac. Express, Inc. v. United Airlines, Inc., 

959 F.2d 814 (9th Cir. 1992) ........................................................................................................ 3 

Provenz v. Miller, 

102 F.3d 1478 (9th Cir. 1996) .................................................................................................... 25 

S&H Riggers & Erectors, Inc. v. Occupational Safety & Health Review Comm., 

659 F.2d 1273 (5th Cir. 1981) ...................................................................................................... 9 

S. Cal. Gas Co. v. City of Santa Ana, 

336 F.3d 885 (9th Cir. 2003) ........................................................................................................ 2 

Silverpop Sys., Inc. v. Leading Mkt. Techs., Inc., 

641 F. App’x 849 (11th Cir. 2016) ............................................................................................... 9 
D-Link Systems’ Opposition to Plaintiff FTC’s 

Motion for Summary Judgment

v Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Simeon Management Corp. v. Federal Trade Commission, 

579 F.2d 1137 (9th Cir. 1978) ...................................................................................................... 8 

Sw. Sunsites v. Fed. Trade Comm’n, 

785 F.2d 1431 (9th Cir. 1986) .................................................................................................. 3, 8 

Thomas v. Newton Int’l Enters., 

42 F.3d 1266 (9th Cir.1994) ......................................................................................................... 3 

U.S. v. F/V Repulse, 

688 F.2d 1283 (9th Cir. 1982) ...................................................................................................... 3 

United States v. Bayer Corp., 

2015 WL 5822595 (D.N.J. Sept. 24, 2015) .................................................................................. 8 

Zamani v. Carnes, 

491 F.3d 990 (9th Cir. 2007) ...................................................................................................... 25 

Rules and Regulations

Fed. R. Civ. P. 56(a) ........................................................................................................................... 2 
D-Link Systems’ Opposition to Plaintiff FTC’s 

Motion for Summary Judgment

1 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

MEMORANDUM OF POINTS AND AUTHORITIES 

I. INTRODUCTION 

The Federal Trade Commission’s (“FTC”) motion for summary judgment on Counts 2, 3 

and 6 of the FTC’s Complaint (“MSJ”) is based almost entirely on disputed issues of material fact, 

including with respect to fundamental issues regarding Defendant D-Link Systems, Inc.’s (“DLS”) 

products, and DLS’ practices and procedures to prevent against potential intrusions of those 

products by third parties. The Court cannot resolve these critical disputed issues of fact on 

summary judgment in concluding whether DLS has engaged in any “deception” under the FTC Act. 

Accordingly, the FTC’s MSJ must be denied. 

As an initial matter, the FTC’s argument that DLS has engaged in deceptive practices 

regarding its products admittedly relies on expert testimony about core issues in this case, such as 

the security of the accused DLS routers and IP cameras, and the “reasonableness” of the practices 

with respect to the engineering and testing of those products. The FTC’s experts’ opinions and 

conclusions on these fundamental issues squarely conflict with those offered by DLS’ experts. This 

alone is sufficient to defeat summary judgment on all counts. Indeed, in administrative actions 

under the FTC Act, the FTC itself has unanimously held that conflicting expert opinions as to the 

“reasonableness” of a company’s security practices precludes summary judgment. See In re 

LabMD, Inc., No. 9357, 2014 WL 2331027, at *6 (F.T.C. May 19, 2014) (“[C]onflicting expert 

opinion is precisely the type of dispute that evidentiary hearings are held to resolve.”). The result 

should be no different here. 

In addition, the FTC’s MSJ should be denied because there are numerous material disputes 

as to the fundamental facts that form the basis for the FTC’s claims. These include for example: 

 the security practices used for the products DLS sells, including among other things (i) the 

frequency and nature of pre- and post-release testing of the products; (ii) the processes used 

to determine how, when, and whether a possible hypothetical vulnerability should be 

patched; and (iii) practices relating to firmware upgrades; 

 the conditions under which potential theoretical security vulnerabilities affecting DLS 

products could be exploited in the real world, and the hypothetical consequences thereof; 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

2 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 the context, purpose, and user experience of DLS’ predecessor Security Advisories page; 

 the context and user experience of DLS’ business and consumer IP camera Setup Wizards 

and User Manuals; and 

 the intent, context, and purpose of various DLS emails and Security Advisements directed to 

security issues. 

 Tellingly, the FTC’s MSJ primarily relies on a few stray emails and DLS web postings 

(many of which contain inadmissible hearsay statements from unaffiliated third parties), and the 

declaration of Jamie Hine, an FTC attorney who purported to test two DLS model DCS-2310L IP 

cameras, to support its claims. However, even a cursory review of all the relevant documentation 

concerning DLS’ products, and the testimony of DLS’ witnesses, establish that the FTC’s exhibits 

and its attorney’s testimony provide an incomplete view of the relevant events in this case, are 

divorced from necessary context, and ignore that the material facts in this case are vigorously 

disputed. Mr. Hine’s October 1, 2018, deposition testimony pursuant to the Court’s September 24, 

2018 Order, Dkt. No. 168, if anything, provides further factual support for DLS’s arguments. 

For these reasons, which are discussed in greater detail below, the Court should deny the 

FTC’s MSJ. 

II. LEGAL STANDARD 

A. Summary Judgment Standard 

In order to prevail on summary judgment, the FTC, as the movant, must show that “there is 

no genuine dispute as to any material fact and [it] is entitled to judgment as a matter of law.” Fed. 

R. Civ. P. 56(a); see also Anderson v. Liberty Lobby, 477 U.S. 242, 248 (1986) (applying same 

standard under earlier wording of Rule 56). “As the party with the burden of persuasion at trial, the 

[FTC] must establish ‘beyond controversy every essential element of its’ . . . claim.” S. Cal. Gas 

Co. v. City of Santa Ana, 336 F.3d 885, 888 (9th Cir. 2003) (citation omitted). 

“[T]he substantive law will identify which facts are material” and “summary judgment will 

not lie if the dispute about a material fact is ‘genuine[.]’” Anderson, 477 U.S. at 248 (citation 

omitted). Further, “[t]he inferences to be drawn from the underlying facts must be viewed in the 

light most favorable to the nonmoving party.” Pac. Express, Inc. v. United Airlines, Inc., 959 F.2d 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

3 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

814, 816 (9th Cir. 1992) (applying summary judgment standard in Sherman Act Section 2 case). 

Conflicting expert opinion evidence is generally sufficient to defeat summary judgment. See In re 

Worlds of Wonder Sec. Litig., 35 F.3d 1407, 1425 (9th Cir. 1994) (“As a general rule, summary 

judgment is inappropriate where an expert’s testimony supports the non-moving party’s case.”); 

Thomas v. Newton Int’l Enters., 42 F.3d 1266, 1270 (9th Cir.1994) (“Expert opinion evidence is 

itself sufficient to create a genuine issue of disputed fact sufficient to defeat a summary judgment 

motion.”). 

B. Standard for “Deception” Claims Under the FTC Act. 

“As the plaintiff, the FTC bears the burden of proof and must prove each element of its case 

by a preponderance of the evidence.” Fed. Trade Comm’n v. DIRECTV, Inc., No. 15-01129-, 2018 

WL 3911196, at *2 (N.D. Cal. Aug. 16, 2018) (citing U.S. v. F/V Repulse, 688 F.2d 1283, 1284 (9th 

Cir. 1982)). Here, in order to prevail on its “deception” claims (Counts 2, 3 and 6), the FTC must 

prove that DLS (1) made a “representation”; that (2) is “likely to mislead consumers acting 

reasonably under the circumstances”; and (3) is “material.” Fed. Trade Comm’n v. Stefanchik, 559 

F.3d 924, 928 (9th Cir. 2009); see also Sw. Sunsites v. Fed. Trade Comm’n, 785 F.2d 1431, 1436 

(9th Cir. 1986). 

As a general matter, statements of opinion and other subjective claims cannot form the basis 

for deception liability.1 See, e.g., Carlay Co. v. Fed. Trade Comm’n, 153 F.2d 493, 496 (7th Cir. 

1946) (“[S]uch words as ‘easy,’ ‘perfect,’ ‘amazing,’ ‘prime,’ ‘wonderful,’ ‘excellent,’ are regarded 

in law as mere puffing or dealer’s talk upon which no charge of misrepresentation can be based.”). 

And although proof of actual deception is not necessary for a liability finding, “such proof is highly 

probative to show that a practice is likely to mislead consumers acting reasonably under the 

circumstances.” Fed. Trade Comm’n v. Cyberspace.com, LLC, 453 F.3d 1196, 1201 (9th Cir. 2006). 

 

1

 As this Circuit has explained in an analogous context, “the difference between a statement of fact 

and mere puffery rests in the specificity or generality of the claim.” Newcal Indus. v. Ikon Office 

Solution, 513 F.3d 1038, 1053 (9th Cir. 2008) (citing Cook, Perkiss & Liehe, Inc. v. N. Cal. 

Collection Serv. Inc., 911 F.2d 242, 246 (9th Cir. 1990)). “Thus, a statement that is quantifiable, 

that makes a claim as to the ‘specific or absolute characteristics of a product,’ may be an actionable 

statement of fact while a general, subjective claim about a product is non-actionable puffery.” Id.

(citing Cook, 911 F.2d at 246). 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

4 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

“When representations or sales practices are targeted to a specific audience, the Commission 

determines the effect of the practice on a reasonable member of that group.” In re Cliffdale Assocs., 

Inc., 103 F.T.C. 110, 1984 WL 565319 (1984), at *46 [hereinafter FTC “Deception” Statement].2 It 

is also necessary to “evaluate the entire advertisement, transaction, or course of dealing in 

determining how reasonable consumers are likely to respond.” Id. at *48 (emphasis added); accord 

Fed. Trade Comm’n v. Sterling Drug, Inc., 317 F.2d 669, 674 (2d Cir. 1963) (“It is therefore 

necessary . . . to consider the advertisement in its entirety and not to engage in disputatious 

dissection. The entire mosaic should be viewed rather than each tile separately.” (emphasis added)). 

A representation is “material” if it is important to a reasonable consumer’s decision whether 

to purchase the product or, alternatively, how the product is used. See Cyberspace.com, 453 F.3d at 

1201. 

III. ARGUMENT 

A. There are Genuine Issues of Material Fact that Preclude Summary Judgment 

In Favor of the FTC on Count 2. 

1. There Are Material Factual Disputes as to the Representations Made in the 

DLS Security Advisory Website.

The FTC’s claim in Count 2 of its Complaint is based entirely on PX 1, the Security 

Advisory Website, as it existed in September 2015. The record before the Court establishes that 

there are genuine material of issues of fact involving both the purported express and implied claims 

that the FTC contends are made in PX 1.3 Compare FTC MSJ at 7–8, with Seitz Decl. ¶¶ 3–-4, Ex. 

B (Rebuttal Report) at pp. 17–19. 

a. The “Express Claims.”

With respect to the alleged “express claims,” DLS disputes that any of the express claims 

along the lines of what the FTC contends exist in PX 1 at all. For example, at most PX 1 states 

expressly that it “prohibits . . . any intentional features or behaviors which allow unauthorized 

 

2

 For example, “a practice or representation directed to a well-educated group, such as a 

prescription drug advertisement to doctors, would be judged in light of the knowledge and 

sophistication of that group.” FTC “Deception” Statement, 1984 WL 565319, at *47. 

3

 “Express claims directly represent the fact at issue while implied claims do so in an oblique or 

indirect way.” Kraft, Inc. v. Fed. Trade Comm’n, 970 F.2d 311, 318 n.4 (7th Cir. 1992). 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

5 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

access to the device or network.” See PX 1; Compl. ¶ 20. The FTC, however, reads the critical 

word “intentional” out of PX 1, see FTC MSJ at 7:9–10, in an attempt to hold DLS to purported 

express promises that simply are not present in PX 1.4 DLS never expressly (or otherwise) 

guaranteed that its products would be free from all vulnerabilities, including any “prohibited” 

features. Indeed, the FTC’s own marketing expert agreed with DLS that PX 1 implies that the 

“prohibited” features and behaviors may occur, Ex. 95 (Shimp Tr.) 142:14–143:13, and does not 

communicate that DLS products are free from vulnerabilities. Id. at 147:5–15. PX 1, when read as 

a whole, instead communicates that DLS’ products, like all such Internet of Things (“IoT”) products 

that can be connected to the Internet, will at times have potential vulnerabilities, which are fixed via 

firmware upgrades as they are discovered. See Supp. Brown Decl. ¶¶ 27-37 & Exs. E-G. 

The remainder of the alleged “express claims” are nonactionable as a matter of law, and 

cannot serve as the basis for judgment on Count 2. For example, PX 1 states that any prohibited 

“features and behaviors are considered serious and will be given the highest priority.” See PX 1; 

Compl. ¶ 20. This is not an actionable deceptive statement. See, e.g., Glen Holly Entm’t, Inc. v. 

Tektronix Inc., 352 F.3d 367, 379 (9th Cir. 2003) (statement of “high priority” is “mere ‘puffery’”); 

In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-02752, 2017 WL 3727318, at *26 

(N.D. Cal. 2017) (“The Court agrees with Defendants that the first alleged misrepresentation—that 

‘protecting our systems and our users’ information is paramount to ensuring Yahoo users enjoy a 

secure user experience and maintaining our users’ trust’—constitutes non-actionable puffery.”); 

Lopez v. CTPartners Exec. Search, Inc., 173 F. Supp. 3d 12, 28 (S.D.N.Y. 2016) (“very seriously” 

is nonactionable puffery). For the same reason, “D-Link’s Commitment to Product Security” is also 

not an actionable deceptive statement. See PX 1; Compl. ¶ 20. 

 

4

 The FTC further faults DLS in its MSJ for an alleged failure to disclose vulnerabilities. See FTC 

MSJ at 7:11–12. But the Complaint does not allege that DLS committed deception based on a 

failure-to-disclose theory, as the FTC’s 30(b)(6) witness has admitted. Ex. 6 (FTC 30(b)(6) Tr.) at 

276:15–277:2, 319:15–320:10. 

5

 Exhibits are attached to the Declaration of Michael Pepson, unless otherwise indicated, and are 

designated numerically. 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

6 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Moreover, while disclaimers do not automatically immunize statements that might otherwise 

be deceptive, see Dkt. No. 90 at 5, the FTC’s own marketing expert has testified that the only 

people that PX 1 would have any impact on would be “highly motivated consumers” who are 

“vigilant, diligent information processor[s],” Ex. 9 (Shimp Tr.) at 107:23–108:17, 113:2–9, 123:16–

23, 128:14–17, 144:10–14, suggesting they would review the disclaimers directly below the 

challenged statement.6 That alone, at a minimum, raises a factual dispute as to the effect the 

disclaimers would have on the “highly motivated consumer,” particularly because the operative 

disclaimers here are on the same page as the challenged statements directly below the allegedly 

express claims. See PX 1. 

b. The “Implied” Claims.

In addition, the “net impression” of PX 1 must also take into account the full gamut of 

information presented to visitors to DLS’ Security Advisories website, as well as the intended 

audience, as the FTC’s administrative decisions make clear. To determine what representations 

were made, “the Commission examines the entire advertisement and assesses the overall ‘net 

impression’ it conveys.” Opinion of Commission, In re POM Wonderful LLC, No. 9344, 2013 FTC 

LEXIS 6, *21–22 (F.T.C. Jan. 10, 2013) (citing FTC “Deception Statement,” 103 F.T.C. at 178); 

see also FTC “Deception” Statement, 1984 WL 565319, at *48 (it is necessary to “evaluate the 

entire advertisement, transaction, or course of dealing in determining how reasonable consumers are 

likely to respond”) “The entire mosaic should be viewed rather than each tile separately.” Sterling 

Drug, Inc., 317 F.2d at 674. “When representations or sales practices are targeted to a specific 

audience . . . the Commission determines the effect of the practice on a reasonable member of that 

group.” FTC “Deception” Statement, 1984 WL 565319, at *47. Thus, “a practice or representation 

directed to a well-educated group, such as a prescription drug advertisement to doctors, would be 

judged in light of the knowledge and sophistication of that group.” Id.

 

6

 Indeed, the FTC’s marketing expert pinned his entire analysis to this assumption: “As I’ve 

emphasized, all of this is predicated that only that subset of highly motivated consumers will have 

read carefully and understood the SERP.” Ex. 9 (Shimp Tr.) at 144:10–13. 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

7 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

PX 1, on its face, shows that DLS’ website then had a “Security Advisories List” and a 

“Security Advisories” section. See PX 1. As even the FTC’s own supporting exhibits show, see 

Jarad Brown Decl. Exs. 25, 28–32, 40-41, DLS’ website policy was inextricably linked to DLS’ 

overarching efforts to transparently inform of potential security vulnerabilities (and, more 

importantly, the status and availability of firmware fixes) through these “Security Advisories,” 

while also providing security researchers with the customary “credit” for their research. See Supp. 

Brown Decl. ¶¶ 27, 39-45 & Ex. F.7 These materials all shape the “net impression” of PX 1 and 

would underscore to a “highly motivated consumer” that PX 1 does not in any way suggest that 

DLS products are somehow “perfectly secure”—an unattainable standard, as the FTC admits. See 

Ex. 8 (FTC RFA Resp.) at 35–36 (Nos. 61–62) Ex. 16 (Graff Rebuttal) at 20, ¶ 32. This is 

particularly true here because the primary (and intended) audience reached by the Security 

Advisories site consisted of security researchers and technical people. Ex. 3 (Brown Tr.) at 76; 

Supp. Brown Decl. ¶¶ 33, 37-38. The FTC cannot, on the one hand, accuse DLS of deception for 

“not disclos[ing] the existence of [certain] vulnerabilities,” (of which DLS was not even aware), 

FTC MSJ 7:11–12, while simultaneously claiming that “D-Link has publicly acknowledged many 

such vulnerabilities through its ‘Security Advisories.” Id. at 12 n.50. 

 For these reasons, and particularly because the FTC proffers no extrinsic evidence—expert 

or otherwise—as to the “net impression” of the Security Advisories website, summary judgment 

should be denied as to Count 2. The cases that the FTC relies on to suggest that extrinsic evidence 

is unnecessary are inapposite. For instance, the FTC’s reliance on dicta from Federal Trade 

Commission v. Medlab, Inc., 615 F. Supp. 2d 1068 (N.D. Cal. 2009), is misplaced. See FTC MSJ at 

8:9–10. Medlab, unlike here, involved a number of specific weight loss claims, and the court 

observed in passing that even if the representations were implied, “these advertisements are capable 

of only one interpretation.” Id. at 1077–78. The FTC’s reliance on Simeon Management Corp. v. 

 

7

 The FTC’s MSJ relies heavily on emails and “Security Advisements” reflecting DLS’, and Mr. 

Brown’s, efforts to act in accordance with the unique customs and practices of the security 

researcher community (that is, “white hat hackers”) and navigate delicate interactions with “grey 

hat” hackers making sales pitches to DLS or otherwise seeking to monetize purported discoveries of 

vulnerabilities. See Supp. Brown Decl. ¶¶ 39-45. Ex. 10 (Brown IHT) at 620:7–22 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

8 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Federal Trade Commission, 579 F.2d 1137 (9th Cir. 1978), which, unlike here, involved a petition 

for review of an administrative order issued by the Commission, is equally unavailing. See FTC 

MSJ at 8:10–12. That case predated changes to the Commission’s deception standards that raised 

the FTC’s burden of showing liability. See Sw. Sunsites, 785 F.2d at 1436. 

The FTC’s arguments as to “implied claims” made in PX 1 also fail as a matter of law. For 

implied claims that are not reasonably inferred from the face of the advertisement, the FTC has 

stated before that it “will not find the ad[vertistment] to make the implied claim unless extrinsic 

evidence allows . . . [the FTC] to conclude that such a reading of the ad is reasonable.”8 In re 

Thompson Med. Co., 104 F.T.C. 648, 1984 WL 565377 (1984), at *102 & 102 n.8 (discussing use 

of surveys); see also United States v. Bayer Corp., 2015 WL 5822595, at *11, *13 (D.N.J. Sept. 24, 

2015) (discussing role of extrinsic evidence); Fed. Trade Comm’n v. Nat’l Urological Grp., Inc., 

645 F. Supp. 2d 1167, 1193 (N.D. Ga. 2008) (rejecting the FTC’s implied claim because it was 

unsupported by extrinsic evidence). In this case, the FTC has not proffered any objective extrinsic 

evidence to suggest that PX 1 somehow impliedly claimed that “reasonable steps” were taken to 

secure the products. 

Moreover, even if the FTC were correct, this purportedly implied message would be nothing 

more than an utterly subjective, non-actionable statement of opinion. Cf. Glen Holly Entm’t., 352 

F.3d at 379 (statement of “high priority” is puffery); In re Yahoo!, 2017 WL 3727318, at *26; 

Lopez, 173 F. Supp. 3d at 28. 

2. There are Material Factual Disputes Regarding the “Reasonableness” of the 

Practices Used for DLS Products 

Likewise, the central question whether the security practices used for the accused DLS IP 

cameras and routers were “reasonable” during the time period when PX 1 was posted on DLS’ 

support website involves not only conflicting expert opinions on either side, but is also subject to 

vigorous factual disputes requiring credibility determinations. Summary judgment as to Count 2 in 

therefore inappropriate on these grounds as well. 

 

8 See also FTC “Deception” Statement, 1984 WL 565319, at *37 (noting situations where “the 

Commission will require extrinsic evidence” for implied claims). 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

9 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

i. There Is Conflicting Expert Testimony on Critical Issues. 

DLS’ expert opinion evidence as to the reasonableness of the security practices used for 

DLS products, standing alone, is more than sufficient to defeat summary judgment on Count 2. As 

the FTC has previously (and unanimously) recognized in its own administrative proceedings, 

“conflicting expert opinion” regarding “appropriate data security measures” is sufficient to defeat 

summary judgment, particularly because this “is precisely the type of dispute that evidentiary 

hearings are held to resolve.” See In re LabMD, Inc., 2014 WL 2331027, at *6. So too here. 

Compare Jarad Brown Decl., Ex. 57 (Graff Report), with Ex. 13 (Schaumont Tr.) at 225:16–229:21 

(reaffirming all opinions in expert reports); Schaumont Decl. ¶¶ 1–4, Ex. A (Schaumont Report); 

Ex. B (Schaumont Rebuttal); Ex. 12 (Radcliffe Tr.) at 259:20–260:3 (reaffirming all opinions in 

expert reports); Radcliffe Decl. ¶¶ 1–4, Ex. A (Radcliffe Report), App. B; Ex. B (Radcliffe 

Rebuttal).9

 

 Moreover, the FTC’s MSJ should further be denied because the FTC cannot even establish 

what specific “reasonable steps” should have been taken by DLS. See Silverpop Sys., Inc. v. 

Leading Mkt. Techs., Inc., 641 F. App’x 849, 852 (11th Cir. 2016) (unpublished) (defendant entitled 

to summary judgment on plaintiff’s negligent data-security practices claim because plaintiff’s 

expert did not establish the standards ordinarily employed in defendant’s industry and plaintiff 

presented no evidence to establish that the challenged practices failed to meet the applicable 

standard of care); cf. S&H Riggers & Erectors, Inc. v. Occupational Safety & Health Review 

Comm., 659 F.2d 1273, 1282–85 (5th Cir. 1981) (due process may require objective industryspecific practice standard of care for general “reasonableness” inquiry). The need to identify what 

was allegedly “reasonable” (and when)—measured against the baseline industry-wide practices for 

consumer IP camera and router companies—is particularly important in the data-security context, 

because as the FTC has previously recognized, “no one static standard can assure appropriate 

 

9

 The 148-page report of the FTC’s expert Mark Graff (Jarad Brown Decl. Ex. 57) makes a host of 

additional disputed factual assertions, which are unsupported by any of the admissible exhibits to 

FTC’s MSJ. DLS does not address each of those disputed factual assertions herein because “an 

expert report cannot be used to prove the existence of facts set forth therein” on summary judgment. 

See In re Citric Acid Litig., 191 F.3d 1090, 1102 (9th Cir. 1999). 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

10 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

security, as security threats and technology constantly evolve . . . in this rapidly changing area.” In 

re LabMD, Inc., No. 9357, 2014 WL 253518, at *12 (F.T.C. Jan. 16, 2014). Here, the FTC cannot 

even establish what the applicable standard of care is for the IoT consumer-embedded device 

industry at any given points in time. See generally Jarad Brown Decl. Ex. 57 (Graff Report); cf.

Ex. 7 (Graff Tr.) 101:7–8 (“there are no literal standards, legally binding standards in the U.S. on 

secure coding”). In any event, one of DLS’ experts, Jay Radcliffe, specifically opined in March 

2015 that, in his “expert opinion, the security practices with respect to these [DLS] products are 

more than reasonable” for the IoT consumer-embedded device industry and that “D-Link’s security 

practices are in the top tier of the industry, represent a reasonable and appropriate concern for 

security, and have appropriately evolved as new threats have come to be understood.” Radcliffe 

Decl., ¶ 2, Ex. A (Report) App. B (2015 Decl.) ¶ 4. 

ii. There Are Genuine Factual Disputes as to the Practices Used by DLS. 

Even if this conflicting expert evidence were not sufficient to defeat summary judgment, 

there are numerous additional factual disputes regarding the practices used for DLS products that 

independently preclude summary judgment here. 

Many of the purported “facts” the FTC identifies as material are, at a minimum, genuinely 

disputed. For example, contrary to the facts recited in the FTC’s MSJ (on pages 9–13): 

 DLS and DKC prohibited vendors from intentionally leaving persistent user credentials and 

other such features in products during the entire period PX 1 was posted on DLS’ support 

website, and continue to do so. Ex. 10 (Brown IHT) at 318:3–16; Ex. 5 (Wang Tr.) at 

159:15–163:16; see also Supp. Brown Decl. ¶¶ 2-4; Supp. Tsai Decl. ¶¶ 12-14. 

 DLS did not “knowingly” sell consumer IP cameras with hidden persistent user credentials 

during the period that PX 1 was on DLS’ support website. There is no dispute that the 

persistent user account issue was fixed in June 2013,10 before PX 1 was posted on the 

support website, and which, in any event, was not a persistent credential but rather a 

 

10 Exhibit 18 (cited at 9 n.32 in the FTC MSJ) reflects that although it was forwarded without 

comment in August 2014, the attached document and substantive communications occurred in May 

2013. Consumer IP cameras manufactured after June 2013 did not have this issue. See Tsai Decl., 

Dkt. No. 184-3, ¶ 14; Supp. Tsai Decl. ¶¶ 16-20 & Exs. B-C; Supp. Brown Decl. ¶¶ 6-8 & Ex. B. 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

11 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

persistent account that originally had a business purpose. Supp. Brown Decl. ¶¶ 2-7 & 

Ex. A; Supp. Tsai Decl. ¶¶ 12-16 & Exs. B-C; Ex. 10 (Brown IHT) at 561:16–586:2; Ex. 5 

(Wang Tr.) at 228–32. Even before then, in May 2013, DLS posted on its website (and 

otherwise disseminated) instructions for end users to change the password themselves. 

Supp. Brown Decl. ¶9; see Jarad Brown Decl. Ex. 16. 

 DLS did not sell IP cameras with an “undisclosed” guest/guest account feature when PX 1 

was posted, nor does it do so today. The firmware fix for this issue has been available since 

June 2013, and was automatically implemented when end users followed the instructions 

and recommendations set forth in the Quick Install Guide (“QIG”) for the cameras during 

the period when PX 1 was posted. Supp. Brown Decl. ¶¶ 6-20 & Exs. A-C; Supp. Tsai 

Decl. ¶¶ 17-19, Exs. B-C. 

 During the period when PX 1 was posted, end users were made aware of updated firmware 

versions by many methods, including through the “mydlink” mobile applications, the 

Security Advisories webpage, the forums webpage, by logging into mydlink.com, on the 

general product support page, and by DLS customer support personnel trained to notify 

users of the latest firmware version when users call customer support. Ex. 10 (Brown IHT) 

at 620:7–22, 773:24–774:5; Brown Decl. ¶ 7, Ex. B; see also Tsai Decl., Dkt. No. 184-3, 

¶¶ 29–30. 

 During the period when PX 1 was posted, end users who activated the “mydlink” cloud 

service would be alerted to firmware updates upon logging into their mydlink account or 

during device activation. Brown Decl., Dkt. 190, ¶ 29; Tsai Decl., Dkt. No. 184-3, ¶ 29. 

For DLS products that use the “mydlink” lite mobile applications, the end-user would be 

automatically notified of firmware updates through the mobile application. Brown Decl., 

Dkt. 190, ¶ 29; Tsai Decl., Dkt. No. 184-3, ¶ 30; Supp. Brown Decl. ¶ 7, Ex. B; 

 DLS was not put on notice of potential vulnerabilities affecting the DIR-855L (first sold 

March 8, 2013) and DIR-826L (first sold May 2012) cameras before these products were 

sold. Compare Brown Decl. ¶¶ 48-49 (sales dates), with Jarad Brown Decl. Ex. 26 (test 

date). In any event, these potential vulnerabilities—which the FTC MSJ admits were later 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

12 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

fixed—did not render the products insecure before then. See Radcliffe Decl., ¶ 3, Ex. B 

(Rebuttal), ¶ 10.c (Lovett); Schaumont Decl. ¶ 3, Ex. B (Rebuttal) ¶¶ 33–35 & n.67. 

 Mr. Radcliffe’s email is taken out of context by the FTC, as explained in his rebuttal expert 

report. Radcliffe Decl., ¶ 3, Ex. B pp. 12–13, ¶ 15. 

 A one-off vendor oversight resulted in the private key issue, which, in any event, was 

revoked within a week after the issue was publicly reported and did not create the security 

risks FTC describes. Ex. 5 (Wang Tr.) at 193–200 (explaining “it wasn’t a security issue”); 

Ex. 3 (Brown Tr.) at 279–84. 

 Since long before PX 1 was posted on DLS’ website, all DLS products and firmware 

underwent systematic prerelease testing by DKC’s D-Lab, which included both functional 

and security test points. Supp Tsai Decl. ¶¶ 6-8, 16, Exs. A-C; Tsai Decl., Dkt. No. 184-3, ¶ 

5; Ex. 2 (DLS 30(b)(6) Tr.) at 37:10–40:18, 63:23–66:24, 80:21–25, 153:1–25; Ex. 1 (Tsai 

Tr.) at 36:14–37:12, 68:9–72:3, 94:9–95:3; Ex. 4 (Hsu Tr.) at 20:12–25:7, 36:24–43:11. 

This included systematic testing for persistent user credentials. See Tsai Decl., Dkt. No. 

184-3, ¶ 12; Supp. Tsai Decl. ¶¶ 16-20, Exs. B-C. 

 For the entire time that PX 1 was posted, DLS products were developed using processes that 

were designed to detect and, when appropriate depending on level of risk, fix potential 

vulnerabilities before the products were shipped/sold. See Ex. 1 (Tsai Tr.) 219–28; Ex. 4 

(Hsu Tr.) at 39–40, 100–06; Supp. Tsai Decl. ¶¶ 6-11, 20. 

 DLS, DKC, and Mr. Brown diligently and proactively reached out to and worked with the 

security researcher community and were praised by these researchers for diligently and 

aggressively investigating potential theoretical vulnerabilities and, when necessary, ensuring 

that vendors promptly issue firmware fixes. See Supp. Brown Decl. ¶¶ 33, 40 & Ex. H. 

 DLS actively investigated potentially security issues on its own. Ex. 3 (Brown Tr.) at 70–

74. 

 The FTC’s reliance on testimony from one of its attorneys, Jamie Hine, to claim that DLS 

continues to sell vulnerable devices fails for numerous reasons. For one thing, the FTC falsely 

claims that the cameras Mr. Hine supposedly “tested” were purchased from entities that have a 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

13 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

business relationship with DLS. See FTC MSJ 10:1-2. At his deposition, however, Mr. Hine 

admitted the cameras were purchased from “Great Daily Buys” and “AtoZ Wireless,” Ex. 14 (Hine 

Tr.) at 39, 114–15, which are third parties that DLS has no business relationship with whatsoever. 

Supp. Brown Decl. ¶ 20. 

 Moreover, the only way it was possible for Mr. Hine to “test” the camera, as he describes, 

was through the use of a highly irregular setup process that effectively prevented the camera from 

functioning as intended because he did not allow the camera to connect to the Internet and update its 

firmware automatically as would normally occur. Indeed, at his deposition, Mr. Hine admitted that 

the IP cameras he tested were not accessible outside the local network he set up because they were 

not registered with mydlink.com. Ex. 14 (Hine Tr.) at 68; see id. at 69–70, 76, 94, 108–09 

(showing private IP address behind router); see also Supp. Brown Decl. ¶ 9. This defeats the 

purpose of the DCS-2310L, which was designed to operate in tandem with mydlink.com and the 

mydlink mobile apps. Supp. Brown Decl. ¶ 11. In order to take advantage of these features, an end 

user is required to update the camera’s firmware, which would have resolved the issue. Supp. 

Brown Decl. ¶¶13-15. 

 Indeed, In order to force the legacy DCS-2310L camera to operate without updating its 

firmware, Mr. Hine ignored DLS’ setup instructions and common sense. He admitted he did not 

follow instructions to set up a mydlink.com account, Ex. 14 (Hine Tr.) at 31:5–25; chose not to 

register the test cameras with mydlink.com, id. at 33, 121; chose to use a legacy Microsoft 

Windows Setup Wizard, see id. at 30, which was downloaded from the same webpage as the latest 

available firmware fix, see id. at 59–60; ignored a pop-up screen prominently recommending use of 

the free mydlink mobile app to set up the camera, see id. at 61–62; ignored another popup during 

the setup process informing him that in order to use the mydlink cloud service he would need to set 

up a mydlink account, id. at 67; chose to disable the mydlink cloud service, id. at 67; see id. at 116–

17; ignored web browser security warnings and did not take further steps to troubleshoot, id. at 71–

73; did not check for the most recent firmware as advised, id. at 95–103; and did not update the 

firmware, see id. at 121:19–21. In short, Mr. Hine crashed through every warning sign and off-
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

14 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

ramp DLS provided to force him to use the latest firmware, and then the FTC claims he ended up 

with a vulnerable camera. 

 Mr. Hine’s “tests” confirm that, contrary to the facts asserted in the FTC’s MSJ, see FTC 

MSJ:1–19, during the time period PX 1 was posted, DLS made it extremely simple and easy for 

end-users to learn about software patches, particularly during the initial setup process. See Ex. 18 

(screenshots of FTC video of setup process). It is common sense that products sit on store shelves 

or in warehouses and thus may not be installed with the most recent firmware. Therefore, as Mr. 

Hine himself demonstrated, DLS effectively forced all normal end users of its consumer IP cameras 

to upgrade the firmware during the initial setup process. See also Exs. 17-19; Brown Decl. ¶¶ 9-18. 

The FTC’s reliance on certain emails drafted by a DLS employee, William Brown, and 

“Security Advisories” created by Mr. Brown, and the FTC’s complete disregard of Mr. Brown’s 

deposition testimony relating to these documents, further underscores why summary judgment is 

inappropriate. At a bare minimum, the Court must make credibility determinations if it is to ignore 

a witness’s testimony regarding relevant documentary evidence and contradicting the FTC’s 

interpretation of the evidence. See Ex. 5 (Wang Tr.) at 182:8–183:18, 194:9–196:21, 205:24–206:4; 

Ex. 3 (Brown Tr.) at 193:1–195:14; Ex. 2 (DLS 30(b)(6) Tr.) at 72, 99:9–100:23. 116:25–117:6, 

139:9–25, 153, 194–96, 210:10–211:12, 238:11–22. 

The FTC’s reliance on certain emails drafted by a DLS employee, William Brown, and 

“Security Advisories” created by Mr. Brown, and complete disregard of Mr. Brown’s deposition 

testimony relating to these documents, further underscores why summary judgment is inappropriate 

here. At a bare minimum, the Court must make credibility determinations if it is to ignore a 

witness’s testimony regarding relevant documentary evidence and contradicting the FTC’s 

interpretation of the evidence. See Ex. 5 (Wang Tr.) at 182:8-183:18, 194:9-196:21, 205:24-206:4; 

Ex. 3 (Brown Tr.) at 193:1-195:14; Ex. 2 (DLS 30(b)(6) Tr.) at 72, 99:9-100:23. 116:25-117:6, 

139:9-25, 153, 194-96, 210:10-211:12, 238:11-22. 

A perfect example is the email Mr. Brown sent in May 2013 regarding the persistent guest 

user account that is the focal point of the FTC’s MSJ. See FTC MSJ 24:2-16 & Ex. 52. As 

addressed in detail further below (pp. 22-23), the FTC’s characterization of that email is 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

15 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

categorically refuted by (a) Mr. Brown’s testimony in 2014, see Ex. 10 (Brown IHT) at 755–84; (b) 

Mr. Brown’s testimony in 2018, see Ex. 3 (Brown Tr.) at 205–09; (c) Mr. Wang’s testimony, see 

also Ex. 5 (Wang Tr.) at 228–32; Mr. Brown’s declaration, Supp. Brown Decl. ¶¶ 9, 19; and Mr. 

Tsai’s declaration, see Supp. Tsai Decl., ¶¶ 12-20. Likewise, the FTC’s reliance on “security 

advisories” to support its core factual claims regarding the purported vulnerabilities, see, e.g., FTC 

MSJ 12:3-4, 20:11-13 & Jarad Brown Decl. Exs. 31 & 40, is plainly contradicted by the context in 

which these materials were created. See Supp. Brown Decl. ¶¶ 25-45; see also Jarad Brown Decl. 

Ex. 40 (“We offer the following as a summary pulled from the authors linked document.”). Yet 

another example is the FTC’s citation to an email Mr. Brown sent about the “private key,” FTC 

MSJ 12:9-10 & Jarad Brown Decl. Ex.34, which is put in context by Mr. Brown’s testimony, see 

Ex. 3 (Brown Tr.) at 279-84, and Mr. Wang’s testimony, see Ex. 5 (Wang Tr.) at 193-200 

(explaining “it wasn’t a security issue”). Finally, the FTC’s claims about Mr. Brown’s purported 

agreement with FTC as to the “core purpose” of IP cameras is also contradicted by objective facts, 

as explained by Mr. Brown in his declaration. See Supp. Brown Decl. ¶¶ 21-24. 

The FTC’s reliance on a list of vulnerabilities created by a nonprofit organization known as 

“OWASP,” see FTC MSJ 10:13–16, also is subject to numerous material factual disputes.11 As an 

initial matter, it is entirely improper for the FTC to rely at the summary judgment stage on its own 

Complaint as evidence that the alleged vulnerabilities are “critical,” as it attempts to do here. See 

FTC MSJ 10:16–17 & n. 42. This is particularly true because DLS denied the allegation. See Ans. 

¶ 15, Dkt. No. 92. In any event, the evidence in the record suggests that the OWASP list is used 

primarily by “the security test industry” (and not the consumer router and IP camera industry), and 

even for the security test industry, this list is “not considered to be the standard in the industry.” Ex. 

1 (Tsai Tr.) at 77–79. To the contrary, according to DLS’ witnesses, the OWASP list is not even a 

“must follow-up,” meaning that “there was not any industrial standard to indicate that if you do not 

follow OWASP top ten test items, then the device cannot be used.” Ex. 1 (Tsai Tr.) at 77–79. Indeed, 

 

11 Contrary to the FTC’s MSJ, see FTC MSJ 10:13–16 & n.41, the purported OWASP rankings are 

not an industry standard even in the security testing industry, nor is this list binding. See 

Schaumont Decl. ¶¶ 3–4, Ex. A (Schaumont Report) ¶¶ 65, 67 (no industry standard; only best 

practices); accord Ex. 7 (Graff Tr.) 101:7–9. 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

16 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DLS’ former CEO, A.J. Wang, who has extensive and deep experience in the consumer router and IP 

camera industry, was unfamiliar with OWASP and its list. Ex. 5 (Wang Tr.) at 168–69. 

Nor can the FTC rely on changes to the security-related practices used for DLS products, 

see, e.g., FTC MSJ at 12:24–28 n.53, 13:3–6 & n.54; releases of firmware fixes, see, e.g., id. at 

9:13–14 & n.33; posting of security advisories, see, e.g., id. at 11:6–14 & nn.46, 49, to support any 

of its liability claims in this case based on alleged events occurring before these measures were put 

in place. Fed. R. Evid. 407 (subsequent remedial measures cannot be used to prove negligence, 

culpable conduct, defect in a product or its design, or need for a warning or instruction). 

3. There are Material Factual Disputes Regarding the “Materiality” of the 

Alleged Representations. 

Finally, the FTC argues that the alleged representations at issue in Count 2 should be 

presumed by the Court to be material. See FTC MSJ at 13–15. This is wrong for several reasons. 

First, as discussed above, PX 1 does not make any actionable “express” claims. Second, 

cybersecurity is not the central characteristic of routers and IP cameras any more than it is for other 

IoT devices like smart “appliances” or “connected cars” or medical devices.12 A toaster is a toaster, 

whether connected to the Internet or not. And a camera is a camera. 

Regardless, even if this light presumption did properly apply (which it does not), it may be 

rebutted with evidence tending to disprove the predicate fact from which the presumption arises or 

evidence contradicting the initial presumption of materiality. See In re POM Wonderful LLC, 2013 

FTC LEXIS 6, at *121–22. “This is not a high hurdle.” Id. at *122. 

In this case, DLS’ marketing expert disputes the materiality of PX 1, offering opinions that 

squarely conflict with those of the FTC’s marketing expert, Dr. Shimp.13 See Seitz Decl. ¶ 3, Ex. B 

 

12 Underscoring this, the vast majority of DLS advertisements, packaging, and other documents 

relating to routers and IP cameras do not mention or focus on security—there is no reason to. Supp. 

Brown Decl. ¶¶21-24. See, e.g., Jarad Brown Decl. Ex. 54, Dkt. No. 178-56; Brown Decl., Dkt. No. 190, Ex. A. 

13 The FTC’s MSJ purports to rely on the FTC’s security expert to establish the materiality of the 

alleged representations. See FTC MSJ at 15:3 & n.64. However, Mr. Graff is not qualified to, was 

not asked to, and did not opine on this issue. See Jarad Brown Decl. Ex. 57 (Graff Report) ¶¶ 1–22. 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

17 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

at 17–19 (disputing claim that PX 1 is material); see also Poret Decl., ¶ 3, Ex. B at 22–24 (noting 

lack of empirical data). Standing alone, this precludes summary judgment here as to Count 2. 

B. There are Genuine Issues of Material Fact that Preclude Summary Judgment 

In Favor of the FTC on Count 3. 

1. The DLS Datasheets At Issue In Count 3 Either Contain Nonactionable 

Opinions or are Literally True.

To begin with, the FTC’s Motion should be denied as to Count 3 because all of the allegedly 

“deceptive” express claims made in PX 2–PX 5 are, in fact, either nonactionable statements of 

opinion or indisputably true. See FTC MSJ at 16:1–4, 17:5–7, 18:4–7, 19:4–7. 

Statements couched in language like “easy” and “advanced,” such as “Easy to Secure” and 

“Advanced Network Security,” are classic examples of non-actionable statements of opinion. 

Carlay Co., 153 F.2d at 496 (“‘[E]asy,’ ‘perfect,’ ‘amazing,’ ‘prime,’ ‘wonderful,’ ‘excellent,’ are 

regarded in law as mere puffing or dealer’s talk upon which no charge of misrepresentation can be 

based.”); see, e.g., Atari Corp. v. 3DO Co., No. 94–20298, 1994 WL 723601, at *1–3 (N.D. Cal. 

May 16, 1994) (“the most advanced home gaming system in the universe” is puffery); see also

Allen v. FCA US LLC, No. 17-00007, 2017 WL 1957068, at *3 (W.D. Va. May 10, 2017) (phrase 

“‘you’re surrounded by advanced features designed to keep you safe and secure’ is nonactionable 

puffery); Donachy v. Playground Destination Props., Inc., No. 10-4038, 2013 WL 3793033, at *7 

(D.N.J. July 19, 2013) (“Secure, no brainer” is nonactionable puffery); Lenscrafters, Inc. v. Vision 

World, 943 F. Supp. 1481, 1498 (D. Minn. 1996) (“the most advanced equipment available” is 

nonactionable puffery). 

Likewise, additional statements in PX 2 expressing qualitative opinions like “best possible,” 

“latest,” and “help prevent” cannot form the basis of liability under the FTC Act as a matter of law. 

See In re Countrywide Fin. Corp. Mortg. Mktg. & Sales Practices Litig., 601 F. Supp. 2d 1201, 

1217–18 (S.D. Cal. 2009) (“best” is nonactionable puffery); see also Intermountain Stroke Ctr., Inc. 

v. Intermountain Health Care, Inc., No. 13-00909, 2014 UWL 1320281, at *4–5 (D. Utah Mar. 31, 

2014) (“best possible” is nonactionable puffery under Lanham Act), aff’d 638 F. App’x 778, 788 

n.4 (10th Cir. 2016) (listing numerous other Circuit decisions in accord). 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

18 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

This Court should similarly conclude that the phrase “one of the safest,” as used in the 

context of PX 5, is a nonactionable statement of opinion as a matter of law. See also Greater Hous. 

Transp. Co. v. Uber Techs., Inc., 155 F. Supp. 3d 670, 683 (S.D. Tex. 2015); Allen, 2017 WL 

1957068, at *3. But see L.A. Taxi Coop., Inc. v. Uber Techs., Inc., 114 F. Supp. 3d 852, 860–62 

(N.D. Cal. 2015). 

The FTC cannot point to any evidence that the remaining statements contained in PX 2–PX 

5 are not literally true. See Ex. 15 (FTC Resp. to DLS 2d Set Rogs) at 10–16 (Nos. 12 &13); Ex. 6 

(FTC 30(b)(6) Tr.) at 361–62. Although it is not DLS’s burden to do so, DLS can. See, e.g., Supp. 

Brown Decl. ¶ 46. 

In addition, DLS’s marketing expert, Dr. Victoria Seiz, disputes the FTC’s claim that these 

DLS router datasheets either expressly or impliedly communicated to anyone that the routers were, 

in fact, “secure from unauthorized access,” Seitz Decl. ¶ 3, Ex. B (Rebuttal) at 1–6, 9–10, 11–17, 

19, in the sense FTC apparently means in its Complaint. Tellingly, the FTC’s MSJ is also 

unsupported by evidence of actual consumer deception as to Count 3. Notably, the actual DLS 

router retail packaging is not accused as deceptive by FTC and is not at issue in this case. 

2. There are Material Factual Disputes Regarding the Security of the Accused 

Routers. 

As with Count 2, a central factual issue for Count 3—the security of the accused products—

is likewise subject to genuine factual disputes and conflicting expert opinion evidence. 

The FTC’s MSJ essentially argues that because of an alleged failure “to take reasonable 

steps,” the DLS routers at issue contained potential “vulnerabilities” discovered by security 

researchers, which rendered the product insecure. See FTC MSJ at 20–21. But the discovery of a 

theoretical vulnerability by a security researcher (frequently using sophisticated tools in lab 

conditions) does not mean that a product is “insecure,” as DLS’ security experts have explained. 

See Radcliffe Decl., ¶¶ 2–4, Ex. A (Report) App. B (2015 Decl.) ¶¶ 4–13, Ex. B (Rebuttal Report) 

¶¶ 5–11; Schaumont Decl. ¶¶ 3–4, Ex. B (Rebuttal Report) ¶¶ 3.c, 4.a–c, 16–62. And indeed, even 

the FTC agrees that “there is no such thing as perfect security,” Ex. 8 (FTC RFA Resp.) at 35–36 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

19 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(Nos. 61-62), and that “it is impossible to eliminate all security vulnerabilities[.]” Ex. 16 (Graff 

Rebuttal) at p. 20, ¶ 32. 

As DLS’ expert opines, therefore, “[t]he mere presence of a vulnerability in a router does 

not imply that the router suffers from unauthorized access and control.” Schaumont Decl. ¶ 3, 

Ex. B (Rebuttal) ¶ 50. Here, the purported potential vulnerabilities overwhelmingly share three 

common features that illustrate why: 

 The vulnerability is theoretical (that is, proof of concept (“PoC”) and was “discovered” 

by researchers in lab conditions using sophisticated tools (and often reverse 

engineering). E.g., Ex. 11 (Rapid 7 30(b)(6) Tr.) at 46; Ex. 4 (Hsu Tr.) at 127–29 

(discussing “proof of concept”), 133–35 (discussing use of “emulator”); see also 

Radcliffe Decl. ¶¶ 2–3, Ex. B (Rebuttal) ¶ 10. 

 Multiple steps and events, often involving end user error—such as falling for a phishing 

attack or leaving a mobile phone unlocked at a coffee shop—must occur before the 

theoretical vulnerability could conceivably be exploited. See Schaumont Decl. ¶ 3, Ex. 

B (Rebuttal) ¶¶ 17–50; Radcliffe Decl. ¶ 3, Ex. B (Rebuttal) ¶ 10; cf. Ex. 7 (Graff Tr.) at 

232:8–249:16; Jarad Brown Decl Ex. 57 (Graff Report) at pp. 104, ¶ 202 (“But 

regardless of whether we call it CSRF or not, it could be exploited if an attacker could 

trick someone on the router’s network to visit a website containing properly-styled 

attack code.”). 

 The vulnerability can only theoretically be “exploited” if the attacker is on the exact 

same local area network (LAN) (for example, if multiple people in the same house are 

connected to or within range of the same router).14 See Ex. 5 (Wang Tr.) at 208:1–23 

(discussing Jarad Brown Decl. Exs. 32 & 41), 100:18–101:16; Ex. 12 (Radcliffe Tr.) at 

 

14 In addition, it is important to assess what, precisely, a hypothetical attacker could theoretically do 

by exploiting the potential vulnerability. For many such purported vulnerabilities, the consequence 

would be no more than a functional nuisance, such as reduced performance speed or a reboot. Ex. 2 

(DLS 30(b)(6) Tr.) at 70:22–71:20, 220:20–221:9; Supp. Brown Decl. ¶ 44; Supp. Tsai Decl. ¶ 11. 

That is drastically different than the types of harms the FTC’s Complaint alleges could theoretically 

occur. See Compl. ¶¶ 16–18. 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

20 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

207:6–210:23, 216:14–217:5; Radcliffe Decl. ¶ 3, Ex. B (Rebuttal) ¶ 10; Schaumont 

Decl. ¶ 3, Ex. B (Rebuttal) ¶¶ 26–36; see also Ex. 1 (Tsai Tr.) at 223:4–24 

 It is therefore not surprising that the FTC’s expert agrees with DLS that there is no evidence 

that any of the accused products have been compromised or exploited in the real world. See Jarad 

Brown Decl. Ex. 57 (Graff Report) ¶¶ 167, 173; Ex. 7 (Graff Tr.) at 200:5–10, 173:11–13, 199:8–

10, 221:11–13, 225:6–8, 228:5–-10, 223:13–21, 236:18–237:5, 265:10–13, 266:11–14, 267:22–

268:3, 268:13–-17, 270:1–4, 271:1–4, 271:17–272:2. Indeed, the FTC MSJ’s claim that “[t]he DIR615 suffered from vulnerabilities that could allow a remote attacker to gain unauthorized access,” 

FTC MSJ at 21:1–2, is refuted by the FTC’s security expert. See Jarad Brown Decl. Ex. 57 (Graff 

Report) ¶ 298 (“none of the documents or testimony I have reviewed have confirmed that the DIR615 versions sold by D-Link Systems could have been remotely compromised”). 

As this Court observed in September 2017: 

The FTC does not identify a single incident where a consumer’s financial, medical 

or other sensitive personal information has been accessed, exposed or misused in any 

way, or whose IP camera has been compromised by unauthorized parties, or who has 

suffered any harm or even simple annoyance and inconvenience from the alleged 

security flaws in the DLS devices. The absence of any concrete facts makes it just as 

possible that DLS’s devices are not likely to substantially harm consumers[.] 

Order Re DLS Mot. to Dismiss at 8:26-9:3, Dkt. No. 90 (emphasis added). A year later, and after 

costly, burdensome discovery in the United States and abroad, the FTC indisputably still cannot do 

so. See DLS MSJ at 15:1-9, Dkt. No. 183. This, too, shows why the FTC’s Motion should be 

denied. 

3. There are Material Factual Disputes Regarding the “Materiality” of the 

Alleged Representations. 

 Finally, the FTC simply has no evidence, apart from bare unsupported assertions of its expert, 

that the datasheets at issue in PX 2 – PX 5 are in any way material. See Poret Decl. ¶ 3, Ex. B (Poret 

Rebuttal) at 22–24. Conversely, DLS has proffered survey data showing that the challenged 

statements in the archived DLS datasheets are not material, see Poret Decl. ¶ 2, Ex. A (Poret Report) 

at 4–43, 47, which is further supported by DLS’ marketing expert. See Seitz Decl. ¶ 3, Ex. B 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

21 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(Rebuttal) at 1–6, 9–10, 11–17, 19. This alone is sufficient to defeat summary judgment as to Count 

3. 

C. There are Genuine Issues of Material Fact that Preclude Summary Judgment 

In Favor of the FTC on Count 6. 

1. There Are Material Factual Disputes as to the Representations Made in 

the DLS Business and Consumer IP Camera User Manuals and Graphical 

User Interfaces.

As with Count 2, the FTC claims as to the representations made by PX 10 and PX 11, see 

FTC Motion at 22–23, are divorced from the context in which these images appeared and, in any 

event, are contradicted by evidence in the record. Notably, the actual DLS IP camera retail 

packaging is not accused as deceptive by FTC and is not at issue in this case. 

Most troublingly, the FTC’s MSJ does not even provide the Court with the full, complete 

materials and information required to conduct a proper “facial” net impression analysis, even under 

the FTC’s administrative case law. The FTC’s MSJ fails to present the full actual setup process that 

end users would follow when using Microsoft Windows GUIs containing PX 10 (used exclusively 

for business cameras) or PX 11. Nor does the FTC’s MSJ present a complete User Manual 

containing within it PX 10.15 

This failure alone is fatal to the FTC’s MSJ with respect to Count 6. To determine what 

representations were allegedly made, even the FTC examines the entire advertisement and assesses 

the overall ‘net impression’ it conveys.” In re POM Wonderful LLC, 2013 FTC LEXIS 6, at *21–

22 (citation omitted and emphasis added). Advertisements are not at issue in Count 6. Brown 

Decl., Dkt. No. 190, ¶ 24. Instead, Count 6 is based on isolated images that appear in outdated (and 

voluminous) DLS user manuals that were posted on DLS’ technical support website,16 and which 

would also briefly be seen by end users (for PX 10, mainly businesses working with professional 

installers) as one of many images in the GUI during the middle of the camera setup process. 

 

15 The image in PX11 of the Complaint was reproduced from one example of a User Manual for a 

DLS IP Camera that [an] FTC Investigator ... downloaded from a DLS website.” Ex. 8 (FTC RFA 

Resp.) at 41 (Nos. 79, 81). The FTC then copied and pasted this image from a page of a DLS User 

Manual into a new document, and enlarged it for better viewing.” Id. at 42 (No. 81). 

16 Most end users would have no need to consult these user manuals, which were not even shipped 

with many of the products. See also Supp. Brown Decl. ¶ 17. 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

22 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Brown Decl., Dkt. No. 190, ¶¶ 24-33, Exs. C, E–G; Ex. 2 (DLS 30(b)(6) Tr.) at 187:6–188:13, 

189:1–24; Ex. 8 (FTC RFA Resp.) at 41–42 (Nos. 78-82 (PX11)). Thus, in order to conduct a 

proper net impression analysis of the challenged images, the entire user manuals must be read, and 

the entire GUI setup process and associated information—such as the End User License 

Agreements (“EULA”) presented before setup, and the relevant product’s packaging and quick 

install guides—must be considered. The FTC has never even attempted to do this, instead relying 

solely on the challenged images. 

The FTC has not submitted any extrinsic evidence regarding the net impression an end user 

would have based on reading the entirety of the user manuals containing the challenged images. 

Likewise, FTC has not submitted any extrinsic evidence regarding the net impression an end user 

would have of the full graphical user interface (GUI) setup process—including the disclaimers and 

disclosures—as well as the other information the end-user would be exposed to before encountering 

the challenged images (e.g., the product packaging, quick install guides). Nor does the FTC have 

any evidence that even a single person was actually “deceived” by the challenged images in the real 

world. 

The absence of this extrinsic evidence underscores why FTC cannot possibly meet its 

burden of showing that the DLS ever represented in the user manuals or GUIs that the business and 

consumer IP cameras “were secure from unauthorized access or control,” see Compl. ¶ 43, which is 

the representation the FTC’s Complaint alleges was false or misleading. See Compl. ¶¶ 44–45. 

Furthermore, end users of the now obsolete DLS consumer IP cameras that could be set up 

using a Microsoft Windows Setup Wizard that would briefly show the end-user PX 11 would first 

encounter and agree to a EULA, which, among other things, advises that neither perfect security nor 

the absence of vulnerabilities can be guaranteed and in bolded, all-capitalized text offers end users a 

refund, should they chose not to agree to the terms of the EULA. See Brown Decl., Dkt. No. 190, 

¶ 27, Ex. E. The FTC does not allege that the disclaimers and disclosures that end users would 

necessarily see before encountering the challenged images (PX 10 and PX 11) were in any way 

inadequate. Ex. 6 (FTC 30(b)(6) Tr.) at 321:3–15. Nor is the FTC alleging that DLS committed 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

23 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

“deception” by failing to disclose to end users any information that it should have. Ex. 6 (FTC 

30(b)(6) Tr.) at 276:15–277:2, 319:15–320:10. 

Although FTC suggests otherwise, see FTC MSJ at 22:12–23:10, 24:19–23, it is the FTC’s 

burden to show, with evidence, what representations were made. See DIRECTV, Inc., 2018 WL 

3911196, at *2 (as Plaintiff, FTC bears burden of proving each element of its case by 

preponderance of evidence); see also id. at *12–19 (FTC failed to meet burden of proving 

defendant’s print advertisements were likely to mislead reasonable consumer). The FTC cannot do 

so here, and its summary judgment should be denied as to Count 6 on this basis. At a minimum, as 

shown in the deposition testimony, DLS’ supporting declarations, and exhibits providing evidence 

of the actual materials that PX 10 and PX 11 were derived from, there are factual questions whether 

the actual GUIs and user manuals could possibly create the “net impression” urged by the FTC, and 

even if so, whether this would be important to consumers. See, e.g., Jarad Brown Decl. Ex. 19, Dkt. 

No. 178-21; Brown Decl., Dkt. No. 190, Exs. E-F; Ex. 14 (Hine Tr.) at 62-63. 

2. There are Material Factual Disputes Regarding the Security of the Accused 

IP Cameras. 

 Contrary to the FTC’s MSJ, see FTC MSJ at 23:13–24:16, DLS and its security experts also 

dispute the FTC’s claim that the IP cameras at issue in Count 6 were not secure from unauthorized 

access. 

 To begin with, both of DLS’ security experts offer opinions contradicting the FTC’s claim 

that IP cameras at issue in Count 6 were insecure, as a practical matter. See, e.g., Radcliffe Decl. 

¶ 3, Ex. B (Rebuttal) ¶¶ 9, 10; Schaumont Decl. ¶¶ 3, Ex. B (Rebuttal) ¶¶ 18, 26, 51–52. This alone 

defeats summary judgment as to Count 6. 

Regardless, there are additional genuine disputes of material fact that independently warrant 

denial of FTC’s MSJ. For instance, the FTC inaccurately relies on one of Mr. Brown’s emails as 

proof that “the guest/guest vulnerability was trivially easy to exploit” through use of a controversial 

website. See FTC MSJ at 24. But this is not true, as Mr. Brown has testified to at length. See Ex. 

10 (Brown IHT) at 755–84 (discussing business need for default enabled guest account for business 

products, which may be made intentionally public like “surf line camera[s]”; explaining that 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

24 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

consumer IP cameras are behind routers and thus have private IP addresses, absent extraordinary 

circumstances); Ex. 3 (Brown Tr.) at 205–09 (discussing email about the website); see also Ex. 5 

(Wang Tr.) at 228–32 (explaining why hidden user account enabled by default was necessary for 

business cameras to function properly and also “industry standard”). Most consumer IP cameras 

and most business IP cameras sit behind routers and use private IP addresses. Ex. 10 (Brown IHT) 

at 561:16–586:2; Supp. Brown Decl. ¶ 9; see also Schaumont Decl. ¶¶ 3, Ex. B (Rebuttal) ¶¶ 30–31. 

This means that they are not directly visible as Internet hosts. See Schaumont Decl. ¶¶ 3, Ex. B 

(Rebuttal) ¶ 30. In other instances, IP addresses are dynamic, which prevents any potential attacker 

from associating a specific IP camera with a specific IP address. See Schaumont Decl. ¶¶ 3, Ex. B 

(Rebuttal) ¶ 30. Therefore, the website discussed in Mr. Brown’s email would be ineffective, 

except theoretically in instances where, for example, a business camera was intentionally made 

publicly accessible via the Internet.17 

Moreover, the persistent guest account issue was resolved in June 2013, one month after the 

email was sent, as explained above. See Supp. Brown Decl. ¶¶ 6-8 & Ex. A; Supp. Tsai Decl. 

¶¶ 12-20 & Exs. B-C. 

In any event, there is no evidence in the record that even a single DLS camera in the U.S. 

was accessible via the website, or that any DLS IP camera was compromised in the real world. 

Indeed, the FTC’s 30(b)(6) witness and security expert both admitted the FTC has no such 

evidence. See Ex. 6 (FTC 30(b)(6) Tr.) at 100:12–101:21, 352:11–15; Ex. 7 (Graff Tr.) at 200:5–

10, 271:17–272:2 (Count 6 IP Cameras); Jarad Brown Decl. Ex. 57 (Graff Report) at p.88 ¶ 173.18

3. There are Material Factual Disputes Regarding the “Materiality” of 

Challenged Images.

Likewise, the FTC’s MSJ is not supported by any extrinsic evidence that the challenged 

statements, as viewed by end users using the full actual GUI or reading the entirety of the user 

 

17 Some businesses choose to make IP camera feeds publicly viewable over the Internet (e.g., ski 

resort webcams, surf cams). 

18 The FTC has never differentiated between “consumer” and “business” cameras in this action. 

Congress did not intend for the “consumer” protection provisions of Section 5 to apply to 

commercial practices and products. 
D-Link Systems’ Opposition to FTC’s Motion for 

Summary Judgment

25 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

manuals, are at all important to the businesses and individuals that purchase and use those products. 

The FTC appears to have abandoned its reliance on the hypothetical popup “disclaimers” survey of 

PX 11 conducted by Dr. Kent Van Liere using a heavily modified hypothetical GUI setup wizard. 

Cf. Zamani v. Carnes, 491 F.3d 990, 997 (9th Cir. 2007) (“[D]istrict court[s] need not consider 

arguments raised for the first time in a reply brief.”); Provenz v. Miller, 102 F.3d 1478, 1483 (9th 

Cir. 1996) (“[W]here new evidence is presented in a reply to a motion for summary judgment, the 

district court should not consider the new evidence without giving the non-movant an opportunity to 

respond.”) (original brackets omitted). In any case, this survey does not support FTC’s MSJ, as 

DLS’s survey expert has explained, see Poret Decl. ¶¶ 3–4, Ex. B (Rebuttal Report), and for the 

reasons set forth in DLS’s Motion to Exclude the Expert Report and Opinions of Dr. Kent D. Van 

Liere, Dkt. No. 182. Simply put, this survey is utterly irrelevant to the facts of this case and did not 

even purport to test the “net impression” of either the full setup process of the actual GUIs, 

including the actual disclosures presented by the EULA, or the “net impression” of the full User 

Manuals. See Brown Decl., Dkt. No. 190, Ex. E (screenshots of setup process); Jarad Brown Decl. 

Ex. 19 (full DCS-2310L User Manual); see Poret Decl. ¶¶ 3–4, Ex. B (Rebuttal Report) at pp. 20–

21. The FTC’s Complaint does not allege that DLS committed deception because its disclaimers 

were inadequate or because DLS did not adequately disclose information it should have, as the FTC 

30(b)(6) witness admitted. Ex. 6 (FTC 30(b)(6) Tr.) at 276:15–277:2, 319:15–320:10, 321:3–15. 

IV. CONCLUSION 

For the foregoing reasons, DLS respectfully requests that the Court deny the FTC’s Motion 

for Summary Judgment. 

Dated: October 5, 2018 Respectfully submitted, 

CAUSE OF ACTION INSTITUTE 

By: /s/ John Vecchione 

 JOHN VECCHIONE [admitted pro hac vice] 

 

Attorneys for Defendant 

D-Link Systems, Inc.

 (Additional counsel listed on caption page)