UNITED STATES OF AMERICA 

Federal Trade Commission 

WASHINGTON, D.C. 20580 

Bureau of Consumer Protection 

Division of Privacy and Identity Protection 

 

September 4, 2018 

Via ECF (Chambers Copy via FedEx) 

The Honorable James Donato 

United States District Court 

Northern District of California 

San Francisco Federal Courthouse 

450 Golden Gate Ave., Courtroom 11, 19th Floor 

San Francisco, CA 94102 

Re: Federal Trade Commission v. D-Link Systems, Inc., Case No. 3:17-cv-00039-JD 

Dear Judge Donato: 

Pursuant to Federal Rule of Civil Procedure 16, the Federal Trade Commission (“FTC”) 

respectfully requests the Court permit the FTC to supplement its Rule 26(a) disclosures for good 

cause. Less than two weeks ago, the FTC learned that some of D-Link Systems, Inc.’s primary 

online sales channels continue to sell D-Link IP cameras with easily-guessable backdoor 

credentials that D-Link Systems, Inc. (“D-Link Systems”) represented it fixed in 2013. In 

addition, the software D-Link Systems provides consumers to set up these IP cameras continues 

to make deceptive representations at issue in the FTC’s Complaint. This contradicts information 

that D-Link Systems, Inc. (“D-Link Systems”) provided during the FTC’s investigation and in 

discovery, on which the FTC relied. 

This information is relevant to Court’s consideration of liability for deceptive 

representations, as well as the relief necessary to remedy the deception in this case. These newly 

learned facts mean that D-Link Systems continues to mislead consumers about the security of 

their IP cameras, which still have built-in backdoors. There is good cause for the FTC to 

supplement its disclosures because this information did not come to light until late August 2018. 

See Fed. R. Civ. P. 16(b)(4). Pursuant to the Court’s Standing Order and Local Rule 37-1(a), I 

certify that the parties met and conferred telephonically on August 30, 2018, and are unable to 

resolve this dispute without the Court’s intervention. 

Background 

Counts II and VI of the Complaint allege that Defendant D-Link Systems deceived 

consumers with representations regarding the security of its IP cameras from unauthorized access 

when in fact, among other things, some of its cameras contained secret backdoor credentials.1

 

For example, in 2013, D-Link Systems acknowledged an undisclosed “guest” login account in 

eighteen of its IP cameras with the username “guest” and password “guest.” This “guest/guest 

                                                            

1 See, e.g., Compl. (Dkt. 44) ¶¶ 15-20, 24, 31-33, 43-45. Count II also addresses D-Link Systems routers. 

Case 3:17-cv-00039-JD Document 168 Filed 09/17/18 Page 1 of 3
Hon. James Donato 

September 4, 2018 

Page 2 

account” is a backdoor that permits third parties to view D-Link camera feeds for internetconnected IP cameras.2

 D-Link Systems never alerted consumers to this backdoor account 

during the setup process (or otherwise) and, in fact, D-Link made representations during setup 

that the consumer’s password would secure the device—implying that the consumer’s password 

was the only one. See Compl. ¶¶ 24, 43-45, Ex. 11. In its May 2013 public acknowledgement of 

the backdoor, D-Link represented that it was fixing the issue, including for the DCS-2310L.3 

In August 2018, the FTC decided to purchase two DCS-2310L IP cameras. The decision 

arose out of counsel for D-Link Systems’ demand to inspect the DCS-2310L that was used for 

the survey executed by the FTC’s testifying expert, Dr. Kent Van Liere.4

 Before producing the 

camera to D-Link Systems pursuant to FRCP 34(b), an FTC employee, Jamie Hine, at FTC 

counsel’s request, supervised the purchase of two additional, identical cameras,5

 and captured 

certain photographic and videographic evidence of the cameras’ setup. 

On August 28, 2018, the FTC served counsel for D-Link Systems with Mr. Hine’s 

declaration describing his anticipated testimony, attached hereto as Exhibit A, and amended 

initial disclosures describing his testimony.6

 On Friday, August 31, 2018, the FTC produced to 

D-Link Systems all the videos and the photos included in Mr. Hine’s declaration. The FTC has 

offered to make Mr. Hine available for a deposition on the matters described in his declaration. 

The FTC now seeks leave of court to permit reliance on these newly discovered facts. 

Argument 

There is good cause to allow the FTC to amend its disclosures past the deadline for fact 

discovery. The discovery less than two weeks ago that D-Link Systems IP cameras are currently 

being sold with deceptive representations and secret backdoor credentials was not the result of 

the FTC’s lack of diligence.7 The FTC did not reasonably expect that routers and IP cameras 

currently on sale would be a fruitful source of information on D-Link Systems’ past 

vulnerabilities and practices at issue (which extend back to 2011). 

In addition, the FTC reasonably relied on information provided by D-Link Systems in 

investigation and discovery that is contradicted by Mr. Hine’s very recent observations. The 

                                                            

2

 Although not all owners of D-Link Systems IP cameras connect their cameras directly to the internet, D-Link 

Systems provides instructions for how to do so in the cameras’ user manuals. 

3 See Guest User Security Advisement (May 9, 2013), ftp://ftp2.dlink.com/SECURITY%20ADVISEMENTS/DLINK_IP_CAMERA_GUEST_USER_ACCOUNT_SECURITY-ADVISEMENT.PDF (“D-Link is modifying 

select IP camera firmware to remove the guest account.”). 4 Dr. Van Liere disclosed in his expert report, served July 6, 2018, and August 15, 2018 deposition that a member of 

his staff took screenshots of the DCS-2310L camera’s setup process to use in a survey instrument. 5

 The DCS-2310L was not available for purchase from D-Link Systems directly, which is consistent with D-Link 

Systems’ discovery responses. D-Link Systems stated that it shipped DCS-2310L until March 2018. 6

 The FTC’s Fourth Amended Initial Disclosures state that Mr. Hine will testify on “[t]he installed firmware 

versions, configuration interface, and set-up process for IP cameras purchased in August 2018.” The FTC 

simultaneously removed other topics to which Mr. Hine might testify from its Initial Disclosures, which were 

rendered moot by D-Link Systems’ responses to the FTC’s requests for admission. 7 See, e.g., Trask v. Olin Corp., 298 F.R.D. 244, 267 (W.D. Pa. 2014) (“[T]he existence of ‘good cause’ turns on a 

variety of factors, including: (1) whether the moving party’s lack of diligence or the opposing party’s conduct 

contributed to the delay; (2) potential prejudice caused by the discovery extension; and (3) any other factors the trial 

court, in its discretion, determines to be relevant.”). 

Case 3:17-cv-00039-JD Document 168 Filed 09/17/18 Page 2 of 3
Hon. James Donato 

September 4, 2018 

Page 3 

FTC did not previously have reason to doubt these assertions. Contrary to the testimony and 

statements by D-Link Systems: (1) IP cameras are still being sold to consumers with a 

guest/guest credential backdoor that D-Link Systems represented was fixed in 20138; (2) the 

setup wizard for the IP cameras, which makes the deceptive representation illustrated in 

Complaint Exhibit 11, still works and is being distributed to consumers on a D-Link Systems 

website9; and (3) consumers are not prompted when setting up IP cameras of the availability of 

updated firmware that fixes security flaws like the guest/guest credential backdoor.10 

D-Link Systems will not be prejudiced by this evidence because it represents facts that 

have always been in D-Link Systems’ possession. In addition, the FTC has produced Mr. Hine’s 

declaration, photos, and videos, and will make him available for a deposition on the subject of 

his declaration. 

Finally, the evidence the FTC seeks to add to its disclosures will be valuable to the fact 

finder in determining liability on Complaint Counts II and IV, and the scope of relief should the 

FTC prevail on either of those counts. This evidence indicates that until 2018, D-Link Systems 

continued to sell IP cameras preloaded with a backdoor and no means to trigger consumers to 

update their firmware during setup. That includes sales during the time D-Link Systems 

published its Security Event Response Policy (SERP), which represented that D-Link Systems 

prohibits, among other things, “undocumented account credentials” and “backdoors.” See DLink Sys. Answer ¶ 20 (SERP published December 2013 to September 2015); Compl. ¶¶ 31-33, 

Ex. 1 (Count II). And D-Link Systems has continued to make the representations in Complaint 

paragraph 24 and Exhibit 11 via the setup wizard that consumers are prompted to download from 

D-Link Systems’ website (Count VI). These facts are also relevant to the scope of an injunction 

to prevent future deception or cure past conduct.11 

For the foregoing reasons, the FTC respectfully requests the Court grant leave for the 

FTC to supplement fact discovery with the evidence described above. 

 Respectfully submitted, 

 /s/ Jarad Brown 

 Attorney for Plaintiff Federal Trade Commission 

cc: All Counsel (via ECF) 

                                                            

8

 All three DCS-2310L cameras the FTC purchased came with firmware version 1.00.03 installed that has the 

undisclosed guest/guest credential, which Mr. Hine personally observed. 

9

 The setup wizard—which the DCS-2310L’s installation guide instructed Mr. Hine to download from 

www.mydlink.com/download—ran successfully on the computers Mr. Hine used, and included the representation 

shown in Complaint Exhibit 11. This is contrary to William Brown’s testimony on behalf of D-Link Systems that 

since 2015 consumers could not run the setup wizard. D-Link Sys. 30(b)(6) Dep. 192:16-193:8 (Apr. 25, 2018). 

10 The setup wizard Mr. Hine viewed did not prompt him to update the IP cameras’ firmware. This rebuts D-Link 

Systems’ testimony and written submissions stating that users are prompted if new firmware is available during 

setup. E.g., Gilman Mem. to FTC in re D-Link Systems 2 (Feb. 17, 2015) (D-Link Systems’ counsel submission 

stating that “the Setup Wizard automatically checks for the latest firmware version”). See Trask, 298 F.R.D. at 268 

(permitting reopening where delay caused by opposing party’s misrepresentations. 

11 See, e.g., In re Rail Freight Fuel Surcharge Antitrust Litig., 281 F.R.D. 12, 14 (D.D.C. 2011) (“the likelihood that 

discovery will lead to relevant evidence” is a factor when determining good cause to reopen discovery). 

Case 3:17-cv-00039-JD Document 168 Filed 09/17/18 Page 3 of 3