No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4818-9994-9888.v1 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 CAUSE OF ACTION INSTITUTE 

JOHN J. VECCHIONE [admitted pro hac vice] [Lead Counsel] 

patrick.massari@causeofaction.org 

MICHAEL D. PEPSON [admitted pro hac vice] 

Admitted only in Maryland. 

Practice limited to matters and proceedings before United States Courts and agencies. 

michael.pepson@causeofaction.org 

JESSICA LEE THOMPSON [admitted pro hac vice] 

jessica.thompson@causeofaction.org 

ASHLEY SALVINO [admitted pro hac vice] 

ashley.salvino@causeofaction.org 

JOSHUA N. SCHOPF [admitted pro hac vice] 

josh.schopf@causeofaction.org 

NICHOLE C. WILSON [admitted pro hac vice] 

nichole.wilson@causeofaction.org 

KARA E. MCKENNA [admitted pro hac vice] 

kara.mckenna@causeofaction.org 

1875 Eye Street N.W., Suite 800 

Washington, D.C. 20006 

Telephone: (202) 422-4332/Facsimile: (202) 330-5842 

Christine Yang (SBN 102048) Christopher Kao (SBN 237716) 

LAW OFFICES OF S.J. CHRISTINE YANG ckao@pillsburylaw.com 

17220 Newhope Street, Suites 101 &102 PILLSBURY WINTHROP SHAW 

Fountain Valley, California 92708 PITTMAN LLP 

Email: chrisyang@sjclawpc.com Four Embarcadero Center, 22nd Floor 

Tel: (714)641-4022/Fax: (714)641-2082 San Francisco, CA 94111 

 Tel: (415)983-1000/Fax: 415.651.8786 

Attorneys for Defendant D-Link Systems, Inc.

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

SAN FRANCISCO DIVISION 

FEDERAL TRADE COMMISSION, 

Plaintiff, 

vs. 

D-LINK SYSTEMS, INC., 

Defendant.

No. 3:17-cv-00039-JD 

DECLARATION OF WILLIAM BROWN 

IN SUPPORT OF DEFENDANT D-LINK 

SYSTEMS, INC.’S MOTION FOR 

SUMMARY JUDGMENT 
-1- 

No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DECLARATION OF WILLIAM BROWN 

The undersigned declarant, William Brown, states: 

1. I am Chief Information Security Officer at D-Link Systems, Inc. (“D-Link 

Systems” or “DLS”). Unless stated otherwise, the following facts are based on my own 

personal knowledge and, if called as a witness, I could and would testify competently 

thereto. 

2. I have reviewed the FTC Complaint and the exhibits attached thereto I have been 

told are relevant to the FTC’s remaining “deception” claims (PX 1-PX 5, PX10-PX11). 

Count II Challenged Statements (PX 1) 

3. On or about September 24, 2015, a Security Event Response Policy (“SERP”) 

(that is, Exhibit PX1 to the Complaint), which was previously posted on DLS’s tech 

support website at http://securityadvisories.dlink.com/security/ (which is now redirected 

to https://support.dlink.com/ReportVulnerabilities.aspx), was removed from this website. 

After that, PX 1 was no longer on and could not be accessed through DLS’s support 

website. 

4. When the SERP was removed from DLS’s support website in September 2015, 

the .PDF of the files that were linked to that support page could no longer be seen or 

accessed through DLS’s support website, and archived into an FTP server, 

ftp://ftp2.dlink.com. This FTP server holds the entire file archive for support.dlink.com 

of files (e.g., .PDFs, firmware, software, and other digital assets) that were previously 

linked to DLS’s support webpage. 

5. Since on or about September 24, 2015, the link referenced in paragraph 20 of the 

FTC’s Complaint, http://support.dlink.com/securityadvisories.aspx, redirects to a URL, 

https://support.dlink.com/ReportVulnerabilities.aspx, which allows security researchers 

and others to report what they view as potential vulnerabilities. Security researchers may 

also report what they believe to be potential vulnerabilities to DLS through 
-2- 

No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4818-9994-9888.v1 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

http://us.dlink.com, through a public reporting form available at the following URL: 

http://us.dlink.com/security-advisories/report-vulnerabilities/. 

6. Since September, 2015, DLS has not posted any other security policy on its main 

website, us.dlink.com, or on its tech support webpage, support.dlink.com, or anywhere 

else. 

7. To the best of my knowledge, the SERP depicted in Exhibit PX 1 to the FTC’s 

Complaint, and the archived .PDF, is the only instance where the language that is block 

quoted in paragraph 20 of the FTC Complaint has been publicly posted on a DLS 

website. To the best of my knowledge, DLS has not made that statement in any public 

communications since September, 2015. 

8. On September 20, 2018, I last accessed 

http://support.dlink.com/securityadvisories.aspx, by placing pasting the URL into a web 

browser, which redirected me to a URL, 

https://support.dlink.com/ReportVulnerabilities.aspx ; I reviewed the webpage. The top 

right portion of this webpage states “Report Vulnerabilities.” Other than providing an 

opportunity for security researchers and others to enter their contact information and 

reCAPTHA , the only text contained in this document is as follows: 

“Reporting a Suspected Security Vulnerability”

If you would like to report a security issue, vulnerability, or exploit; please fill out this 

form and our Security Incident Report Team will respond. 

NOTE: Customers seeking Technical Support Assistance, please Click HERE to submit 

your Support request. 

Your Enquiry” 
-3- 

No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4818-9994-9888.v1 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Count III: Archived DLS Data Sheets (PX 2-PX 5) 

9. PX 2-PX 5 are documents DLS refers to as “data sheets” for four router models: 

DIR-615 (PX 2) (first sold by DLS in March 2007); DIR-412 (PX 3) (first sold by DLS 

in September 2010); DIR-815 (PX 4) (first sold by DLS in September 2010); and DIR645 (PX 5) (first sold by DLS in September 2011). These datasheets were originally 

created in 2010 (PX 3), 2011 (PX 2, PX 5), and 2012 (PX 4). 

10. DLS datasheets are stand-alone documents, which, among other things, 

communicate information regarding the functions and features of DLS products. 

11. These data sheets, like other DLS data sheets, are not distributed by DLS in paper 

form to via mailings or otherwise to potential purchasers of individual DLS products for 

personal use. Instead, during the time period that DLS was marketing/selling these router 

models at issue in Count III, these data sheets would have been primarily distributed to 

DLS’s brick-and-mortar and online retail partners and distributors for those retail 

partners. As further described below, these documents would have been used to describe 

the functions of the products to DLS’s sales channel partners and distributors near the 

date stated directly on each of Exhibits PX 2-5. 

12. These data sheets are different in appearance and content from the boxes these 

routers were sold in, as well as the user manuals and quick install guides for these routers. 

Attached, for example, as Exhibit A are true and correct copies of the standard retail 

packaging for the DIR-615, DIR-645, and DIR-815. 

13. DLS has not shipped/sold any DIR-615 routers since October 2016. 

14. DLS has not shipped/sold any DIR-412 since October 2015. 

15. DLS has not shipped/sold any DIR-815 routers since December 2015. 

16. DLS has not shipped/sold any DIR-645 routers since March 2015. 

17. After DLS has stopped shipping/selling the associated product, DLS data sheets 

like PX 2-PX 5 are subsequently archived into the support webpage, 
-4- 

No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4818-9994-9888.v1 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

http://support.dlink.com, in order to facilitate DLS’s ability to continue to provide 

technical support, when requested by the end users. These archived data sheets enable 

the support engineers and technicians to discern different versions and models of the 

products and correlate each version/model to its respective datasheet, specifications, and 

other related information in order to assist end-users with technical support issues. 

18. Accordingly, after that, the data sheets for these products (PX 2-PX 5) remained 

archived and only accessible through a series of steps on DLS’s support website for the 

purpose of facilitating technical support if requested by end-users. 

19. The process for accessing archived “datasheets” like PX2-PX5 through DLS’s 

website involves multiple steps (in most cases used by DLS engineers when rendering the 

tech support to end users): (1) visit DLS’s homepage, http://us.dlink.com/ ; (2) click the 

“Support” button on top navigation bar, which redirects to https://support.dlink.com/; (3) 

in the open field titled “Search for products, downloads, answers, etc.,” type the product 

model number (e.g., “DIR-615”) and then click Search button next to field; (4) once the 

site responds with a list of models associated with the search-text input click on the 

product image/model, which will redirect to the support page for the specific product 

model (e.g., https://support.dlink.com/ProductInfo.aspx?m=DIR-412615); 

(6) for products with multiple hardware revisions an additional drop down menu must be 

selected to get the specific product revision information; and (7) click “Download” button 

for the “Datasheet.” 

20. Attached hereto as Exhibit B are true and correct copies of the support pages for 

the DIR-615, DIR-412, DIR-815, and DIR-645 router models that were, in the past, sold 

by DLS, which I understand that the FTC produced to DLS’s counsel. All of these 

documents state in the upper left quadrant as follows: “This product has been 

discontinued.” 
-5- 

No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4818-9994-9888.v1 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

21. Since 2014, DLS management has instructed DLS personnel not to use challenged 

statements or similar language on http://us.dlink.com. 

22. With the exception of archived data sheets and user manuals accessible through 

DLS’s technical support website, http://support.dlink.com, the challenged statements do 

not appear currently on the DLS website, http://us.dlink.com/, or in product advertising. 

This is DLS’s standard practice today, which also now includes quarterly audits 

conducted by DLS in an effort to ensure that the challenged statements do not appear on 

http://us.dlink.com or in product advertising. 

23. With the exception of a vulnerability affecting the DIR-412 (PX3) (a legacy 3G 

product that DLS stopped selling in March 2015), which also became incompatible with 

new mobile LTE technology, firmware fixes have been released for all potential security 

vulnerabilities reported for the versions of accused routers for Count III (DIR-615, DIR845, DIR-645) that have been sold by D-Link Systems before 2017. 

 

 Count VI: Microsoft Windows IP Camera SetUp Wizards (PX 10 and PX 11) 

24. PX 10 and PX 11 are not advertisements, were not intended for marketing 

purposes, and have never been used for marketing purposes. Instead, PX 10 and PX 11 

are one of many images of the graphical user interface (GUI) an end-user would have 

briefly seen when using DLS specific and outdated Setup Wizards for Microsoft 

Windows PCs only after purchasing the camera and during the setup process. For 

instance, before encountering the screen containing the challenged statements using this 

particular setup wizard, an end-user would be required to agree to an End User License 

Agreement (EULA) containing various disclosures and disclaimers relating to the 

security of the product. 

25. PX 10 and PX 11 are screenshots of isolated images appearing in quadrants of 

DLS user manuals. None of these user manuals appears on DLS’s main website, 
-6- 

No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4818-9994-9888.v1 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

us.dlink.com. As with the router data sheets (PX 2- PX 5), these user manuals remain 

archived on DLS’s tech support website, support.dlink.com , to facilitate DLS’s ability to 

provide technical support, as stated in paragraphs 18 of this Declaration, above. 

Attached hereto as Exhibit C are true and correct copies of excerpts from user manuals 

for the DCS-2310L and DCS-3410, which I understand have been produced in discovery 

in this case. 

26. Attached hereto as Exhibit D are true and correct copies of excerpts from DLS 

“Document/Artwork Approval” forms, which DLS refers to as “pink sheets,” for DLS 

user manuals containing the accused images (PX 10-PX11), which provide the date on 

which these materials were approved. 

27. On May 2, 2018, I went through the setup process using the DCS-2310L 

Microsoft Windows Setup Wizard (“Setup Wizard”) from which the screenshot that 

became PX 11 was derived; during this process I captured various screenshots 

(disclaimers and disclosures in End User License Agreements) of what a user would 

actually see before encountering the screen that became PX 11. Attached as Exhibit E is 

a true and correct copy of screenshots I made when I went through the setup process 

using the mydlink Setup Wizard for Microsoft Windows for the DCS-2310L camera on 

May 2, 2018. 

28. On May 2, 2018, I went through the setup process using the DCS-3716 Microsoft 

Windows Setup Wizard (“Setup Wizard”) from which the screenshot that became PX 10 

was derived; during this process I captured various screenshots (disclaimers and 

disclosures in End User License Agreements) of what a user would actually see before 

encountering the screen became PX 10. Attached as Exhibit F is a true and correct copy 

of screenshots I made when I went through the setup process for the DCS-3716 camera 

on May 2, 2018. 
-7- 

No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4818-9994-9888.v1 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29. Since 2010 forward, if a user registers his or her device using the mydlink web 

portal, the web portal would notify the end-user of firmware updates automatically. Since 

2013, if a DLS device uses a mydlink mobile application or mydlink lite mobile 

application and is registered with mydlink, the end-user will be automatically notified of 

the latest firmware and receive firmware updates through the mobile application. 

30. Since January 2015, end-users not only have had the option, but also have been 

expressly directed to utilize mydlink mobile application for the set-up of DLS consumer 

IP cameras. The mydlink mobile application setup process does not involve or expose 

end-users to any of the challenged statements at issue in Count VI. Neither PX 11 nor 

PX 10 nor the challenged statements contained in those images have ever been shown to 

end users who set up their DLS IP cameras using a mydlink mobile application. For 

example, the DCS-960L was first manufactured after January 2015, and the users were 

expressly directed by the Quick Install Guide to use the mydlink mobile applications. 

31. PX 10 appears as an image in quadrants of isolated middle pages of DLS user 

manuals for certain Business Class IP cameras intended for use by businesses for 

commercial purposes such as store surveillance which would be installed by the 

educated, and technically knowledgeable technicians, not ordinary consumers. Attached 

as Exhibit G is a true and correct copy of an excerpt from the user manual for the DCS7513. PX 10 appears on page 24. The Microsoft Windows “Securicam” CD Setup 

Wizard from which the image that became PX 10 was derived was exclusively used for 

DLS Business IP Camera products that are intended to be sold for commercial purposes 

to help monitor locations such as warehouses and retail establishments. 

32. Installation of the commercial products requires more sophisticated technical 

knowledge and/or experience in electronic networking area and is normally performed by 

educated technicians, not by the ordinary consumers. This is because Business IP 

cameras are generally deployed on private networks and require coordination and 
-8- 

No. 3:17-cv-00039-JD 

BROWN DECL. ISO D-LINK SYSTEMS’S 

MOTION FOR SUMMARY JUDGMENT 

4818-9994-9888.v1 

4812-8887-2001.v1 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

technical training/knowledge to be integrated in to other third-party Video Surveillance 

Software applications. 

33. Generally, the Business IP Cameras DLS sells are more expensive than consumer 

models, with some models selling for around $5,000.00. These commercial products are 

not sold by retail stores like Best Buy and Walmart to general consumers and are instead 

distributed by technically trained resellers, which are also professional installers. 

Information about the Business Cameras that DLS sells is found on different part of 

DLS’s main website, http://us.dlink.com/product-category/business-solutions/ipsurveillance/business-ip-cameras/ 

 Potential Vulnerabilities Fixed 

34. All reported potential vulnerabilities that FTC has complained about have all been 

voluntarily addressed and resolved by DLS via firmware upgrades or alternative 

resolutions. 

35. I have been employed by DLS since February 1993. With the exception of the 

FTC’s lawsuit against DLS, during the entire time I have worked for DLS, and even 

before I joined the company, DLS has never been sued for allegedly deficient security 

practices. 

 

I declare under penalty of perjury under the laws of the United States that the foregoing is 

true and correct.