United States of America

FEDERAL TRADE COMMISSION

WASHINGTON, D.C. 20580

Bureau of Consumer Protection

Division of Privacy and Identity Protection

February 15, 2018

Via E-filing (Chambers Copy via hand-delivery to the Clerk’s Office)

The Honorable James Donato

United States District Court

Northern District of California

San Francisco Federal Courthouse

45 Golden Gate Ave., Courtroom 11, 19th Floor

San Francisco, CA 94102

Re: Federal Trade Commission v. D-Link Systems, Inc., Case No. 3:17-cv-00039-JD

Dear Judge Donato:

Pursuant to the Court’s Standing Order of April 25, 2014, Plaintiff Federal Trade Commission 

(“FTC”) requests discovery relief. Pursuant to the Order and Local Rule 37-1(a), I certify that 

the parties conferred in person on February 1, 2018, and telephonically on February 6, 2018, and 

February 18, 2018, and are unable to resolve this dispute without Court intervention. Plaintiff 

respectfully requests that the Court enter an Order limiting Defendant’s subpoena to third-party 

Shodan, LLC, to protect Plaintiff’s work product and statutory rights under the Stored 

Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712 (2012), part of the Electronic 

Communications Privacy Act.

Background of Discovery Dispute

Defendant recently served on Shodan, LLC (“Shodan”), a Subpoena for Production of 

Documents, Electronically Stored Information, or Tangible Things and a Subpoena to Testify at 

a Deposition in a Civil Action. Defendant included in its subpoenas specific requests and topics

that would reveal information from Shodan accounts created by FTC staff working at the 

direction of FTC counsel in this case.1

 

Shodan is a search engine for internet-connected devices. When a device connects to the 

internet, it broadcasts metadata from its IP address that may include the device type (router, 

camera, server, etc.); device details (brand, model number, and software version); and location, 

among other things. Shodan crawls the internet to index these devices, creating a database of the 

devices and their associated, publicly-available metadata. 

 1 Exhibit A (Subpoena for Production of Documents, Electronically Stored Information, or Tangible Things, 

Specifications 1-5, and Subpoena to Testify at a Deposition in a Civil Action, Topics 1-2). 

Case 3:17-cv-00039-JD Document 108 Filed 02/15/18 Page 1 of 3
Hon. James Donato

February 15, 2018

Page 2

Here, at the direction of Plaintiff’s counsel – first, in anticipation of litigation and then, during 

the pendency of this case – two FTC employees created Shodan accounts and used Shodan’s 

search engine to discover the online presence of certain devices. Defendant’s subpoenas would 

require Shodan to provide information from these FTC Shodan accounts and reveal Plaintiff’s 

protected work product related to this litigation.2 In addition, Shodan is restricted from 

providing this same information by the SCA. 18 U.S.C. § 2702(a)(2). Plaintiff does not consent 

to Shodan divulging the information it collected and stored related to the FTC’s Shodan 

accounts. See 18 U.S.C. §§ 2702(b)(3), 2702(c)(2) (consent exceptions to SCA restrictions). 

Plaintiff informed Shodan of its objection on February 1, 2018.

Information related to FTC staff’s Shodan accounts is protected work product.

The information requested by Defendant of Shodan related to the FTC Shodan accounts is 

Plaintiff’s work product, and Defendant cannot establish a substantial need for this information. 

See Fed. R. Civ. P. 26(b)(3)(A), (B); Hickman v. Taylor, 329 U.S. 495, 510 (1947). Therefore, 

Defendant should not be able to discover Plaintiff’s work product related to its use of Shodan. 

In anticipation of and during this litigation, and in furtherance of it, Plaintiff’s counsel directed 

FTC staff to create Shodan accounts and run searches designed and scripted by Plaintiff’s 

counsel. As such, any information retained by Shodan related to these searches reflects the 

mental impressions of Plaintiff’s counsel. Without the Court’s intervention, Defendant’s 

subpoenas would elicit this work product from Shodan. 

The use of Shodan’s search engine by FTC staff is not a disclosure of work product to an 

adversarial third party, and therefore, Plaintiff did not waive its work product protection. See 

Huddleston v. Cty. of San Francisco, No. 16-cv-01998-JCS, 2017 WL 6059273, at *9 (N.D. Cal.

Dec. 7, 2017) (quoting Westinghouse Elec. Corp. v. Republic of Philippines, 951 F.2d 1414, 

1428 (3d Cir. 1991)) (“[D]isclosure of work product to a third party does not necessarily waive 

the protection,” unless it “‘enable[s] an adversary to gain access to the information.’”). FTC 

staff had no reason to believe that searching Shodan would enable Defendant to access to their 

search history. Moreover, the act of executing searches and receiving results from Shodan’s 

database is not a disclosure to a third party; it is merely the use of an online tool to process and 

search public information, similar to an attorney’s use of Westlaw. 

Finally, Defendant cannot show a substantial need for the information related to Plaintiff’s 

Shodan accounts because Defendant can obtain equivalent information by other means. See Fed. 

R. Civ. P. 26(b)(3)(A). Defendant is free to run its own searches through Shodan to discover 

which devices currently connect to the internet, or otherwise seek equivalent information from 

Shodan. See Hatamian v. Advanced Micro Devices, Inc., No. 14-cv-00226-YGR(JSC), 2016 

WL 2606830, at *5-6 (N.D. Cal. May 6, 2016) (rejecting substantial need for investigator notes 

 2 Defendant’s broad subpoenas could also require Shodan to provide information to Defendant’s counsel from other 

FTC Shodan accounts that may have been created in other, non-public investigations. 15 U.S.C. § 57b-2 (2012); 16 

C.F.R. § 4.10.

Case 3:17-cv-00039-JD Document 108 Filed 02/15/18 Page 2 of 3
Hon. James Donato

February 15, 2018

Page 3

where party did not show why it could not acquire the same information from witnesses 

themselves). In addition, Defendant can access publicly-available Shodan reports that reflect DLink devices accessible on past occasions. See, e.g., Shodan, “D-Link Internet Intelligence” 

(Feb. 7, 2016), https://www.shodan.io/report/XDmzwhWb (detailing the distribution of D-Link 

products by country, service, ISP, and other metrics). Without the Court’s intervention, 

Defendant’s subpoena to third-party Shodan, LLC threatens to vitiate Plaintiff’s work product. 

Information related to FTC staff’s Shodan accounts is protected under the SCA.

The SCA prohibits Shodan from divulging information related to FTC accounts to Defendant in 

response to Defendant’s subpoenas, absent an exception. Under the SCA, Shodan is a “remote 

computing service” (“RCS”) because of the offsite data processing and storage functions it 

provides. 18 U.S.C. § 2711(2); see also Low v. LinkedIn, 900 F. Supp. 2d 1010, 1022 (N.D. Cal. 

2012) (stating that an RCS refers to the processing or storage of data by an offsite third party, 

including acting as a virtual file cabinet). The RCS functions Shodan performed for the FTC 

accounts include processing queries, providing an electronic copy of queries via email, and 

providing search history upon login (a virtual file cabinet). Sections 2702(b) and (c) set forth the 

conditions under which an RCS may voluntarily disclose customer communications or records. 

Plaintiff’s counsel informed Shodan on February 1, 2018, that it does not consent to disclosure of 

its communications or records to Defendant under these sections. No other exception under 

§ 2702 applies, and therefore, the SCA does not permit Shodan to disclose the information 

related to the FTC’s Shodan accounts to Defendant in response to Defendant’s civil subpoenas. 

See Hone v. Presidente U.S.A., Inc., No. C08-80071 JF(HRL), 2008 WL 9010061, at *1 (N.D. 

Cal. July 21, 2008) (quashing subpoena duces tecum on SCA grounds, where consent was not 

given and no other exception applied).

For the foregoing reasons, Plaintiff respectfully requests that the Court protect Plaintiff’s work 

product and statutory rights under the SCA and limit Defendant’s subpoenas to Shodan to 

exclude all information related to the FTC’s Shodan accounts.

Respectfully submitted,

/s/ Cathlin Tully

cc: All Counsel (via ECF)

Reid Wittliff, Counsel for Shodan (via email)

Case 3:17-cv-00039-JD Document 108 Filed 02/15/18 Page 3 of 3