Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CAUSE OF ACTION INSTITUTE 

JOHN J. VECCHIONE [admitted pro hac vice] [Lead Counsel] 

 john.vecchione@causeofaction.org 

MICHAEL D. PEPSON [admitted pro hac vice] 

Admitted only in Maryland. 

Practice limited to matters and proceedings before United States Courts and agencies. 

 michael.pepson@causeofaction.org 

JESSICA LEE THOMPSON [admitted pro hac vice] 

 jessica.thompson@causeofaction.org 

ASHLEY SALVINO [admitted pro hac vice] 

 ashley.salvino@causeofaction.org 

JOSHUA N. SCHOPF [admitted pro hac vice] 

 josh.schopf@causeofaction.org 

NICHOLE C. WILSON [admitted pro hac vice] 

 nichole.wilson@causeofaction.org 

KARA E. MCKENNA [admitted pro hac vice] 

 kara.mckenna@causeofaction.org 

CYNTHIA CRAWFORD [admitted pro hac vice] 

 cynthia.crawford@causeofaction.org 

1875 Eye Street N.W., Suite 800 

Washington, DC 20006 

Telephone: (202) 422-4332/Facsimile: (202) 330-5842 

Christine Yang (SBN 102048) 

 chrisyang@sjclawpc.com 

LAW OFFICES OF S.J. CHRISTINE YANG

17220 Newhope Street, Suites 101 &102 

Fountain Valley, CA 92708 

Telephone: 714.641.4022 

Facsimile: 714.641.2082 

Christopher Kao (SBN 237716) 

 christopher.kao@pillsburylaw.com 

Brock S. Weber (SBN 261383) 

 brock.weber@pillsburylaw.com 

PILLSBURY WINTHROP SHAW PITTMAN LLP 

Four Embarcadero Center, 22nd Floor 

San Francisco, CA 94111-5998 

Tel.: 415.983.1000 / Facsimile: 415.983.1200 

FEDERAL TRADE COMMISSION, 

Plaintiff, 

v. 

D-LINK SYSTEMS, INC., 

Defendants. 

 Case No. 3:17-cv-00039-JD 

DECLARATION OF WILLIAM BROWN IN 

SUPPORT OF DEFENDANT D-LINK 

SYSTEMS, INC.’S OPPOSITION TO 

PLAINTIFF FTC’S MOTION FOR SUMMARY 

JUDGMENT 

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 1 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment

1 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DECLARATION OF WILLIAM BROWN 

The undersigned declarant, William Brown, states: 

1. I am Chief Information Security Officer at D-Link Systems, Inc. (“D-Link Systems” 

or “DLS”). The following facts are based on my own personal knowledge and, if called as a 

witness, I could and would testify competently thereto. 

DCS-2310L Persistent Guest Account 

2. The guest account feature in the firmware version 1.00.03 for the DCS-2310L and 

other (primarily business) cameras had a good faith purpose at the time of creation in 2012 

for preventing open access to video on the device’s home webpage. Consistent with the 

industry standard practice at that time, this account feature was meant to avoid open access to 

the device’s home webpage for video images. At that time, by design, IP surveillance 

cameras would have one or more default user accounts (that is, administrator and/or guest). 

This generation of camera firmware features had two levels of access to help mitigate open 

access to the video or configuration of the camera. First, a persistent guest account with 

default (but not persistent) password could help protect access the device’s main webpage of 

the camera; however, the account could not be used to reconfigure the camera. Second, there 

is also the administrative account, which, upon installation, instructed the user to set a unique 

password that allows access to all features and configuration of the device’s web interface. 

The guest account was used at the time of their creation to avoid open access to the device’s 

home webpage with no credentials after out-of-the-box setup installation. 

3. On or about March 19, 2013, DLS became aware that a non-obvious persistent guest 

account may be was present in certain first-generation DLS IP cameras designed to operate 

with the mydlink Cloud Service, which was publicly launched in 2012. The default 

password was not hardcoded and could therefore be changed by end-users, but the persistent 

guest account was not made obvious to end-users. 

4. Upon learning of the potential issue associated with guest account feature in the 

device, DLS immediately demanded, through D-Link Corporation (“DKC”), that the 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 2 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

2 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

responsible third-party vendors that made those products create firmware fixes as quickly as 

possible to address this artifact of the prior generation of commercial IP cameras. 

5. On or about May 9, 2013, DLS developed a Guest User Account Security 

Advisement, which was prominently posted on the support pages for those products, to alert 

end-users of this issue, as well as a way to remedy even without a firmware fix. This Guest 

User Account Security Advisement advised end-users of the primarily business IP cameras 

about how to change the password for the guest account in these products. 

6. In June 2013, a firmware update resolving this issue was also created by the 

responsible vendor. Attached hereto as Exhibit A is a true and correct copy of the DCS2310L Firmware Release Notes published June 18, 2013, which explains that the update 

Firmware Version: V1.01.10 resolves the issue. 

7. On or about June 18, 2013, it was promptly made publicly available via a variety of 

means including: 

a. End-users of the DCS-2310L who registered with mydlink were automatically 

notified of the latest firmware and received the firmware updates through the mobile 

application. Attached hereto as Exhibit B are true and correct copies of documents 

submitted to the FTC during the pre-Complaint investigation illustrating the general 

form of the notification. 

b. DLS made this firmware available on its support website, http://support.dlink.com. 

c. D-Link forums advertised the availability of the firmware upgrade. 

d. DLS customer care and customer support personnel are trained to instruct end-users 

to make sure to use the latest firmware upgrade. 

8. DLS business and consumer IP camera models manufactured after June 18, 2013, 

would not be preloaded with the firmware with the multiple account feature but would 

instead be preloaded with the latest firmware (for example, Firmware Version: V1.01.10 for 

the DCS-2310L) and therefore did not contain a persistent guest user account or the default 

guest/guest credential. 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 3 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

3 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

9. A Quick Install Guide (“QIG”) was provided with the retail packaging to provide 

typical end-users with easy-to-understand setup instructions. The QIG for DCS 2310L 

expressly advises: “You must have an active mydlink.com account to use this camera.” For 

end-users following the recommended setup process, the QIG states: “From any computer, 

open a web browser, go to http://www.mydlink.com and log into your account. Once mydlink 

detects your camera, a notice will appear that there is a new device detected. Click on your 

camera from the New Devices list and then click Yes to add your camera.” (emphasis added); 

The QIG only contained instructions for setting up the DCS-2310L behind a router, which 

means that it would have a private IP address (e.g., an IP address beginning with the numbers 

10.x.x.x or 192.168,x,x defined and referenced in the IETF standard RFC1918). Attached as 

Exhibit C is a true and correct copy of the QIG for the DCS-2310L. 

10. DLS IP cameras, like the DCS-2310L, are preloaded with the most recent available 

firmware when they are manufactured. However, given that the products may remain in 

storage in a warehouse for a long period of time before ultimately purchased by an end-user, 

the setup process has always been designed to make every effort to ensure that an end-user 

must upgrade and utilize the most recent firmware.

11. For example, as stated above, the QIG for the DCS-2310L specifically instructs endusers to create/use a mydlink.com account as a precondition for setting up the product. In 

fact, a mydlink.com account is a necessary precondition for normal use of the core features 

of this IP camera—the ability to view the camera feed from a mobile device (e.g., a smart 

phone or tablet) using the mydlink or mydlink lite mobile app or alternatively to view the 

camera through mydlink.com. 

12. Any end-user that follows the normal setup process and creates a mydlink.com 

account and registers the mydlink device with the account will be automatically notified of 

the availability of the most recent firmware versions and instructed to download and use this 

firmware. In addition, for a product like the DCS-2310L, the end-user upon visiting 

mydlink.com who follows the instructions in the QIG will see a “Download mydlink Mobile 

App” screen that states: “Setting up your mydlink camera is even easier. Your camera can 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 4 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

4 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

now be set up directly from the mydlink Lite mobile app. This app allows you to easily set up 

your camera directly from your phone or tablet. Get the mydlink Lite app for free.” 

(emphasis added); If the end-user with a mydlink account follows the recommendations and 

uses the free mydlink Lite mobile app, the end-user will be directed through the process of 

updating the firmware.

13. The mydlink website portal (https://www.mydlink.com) only offers the latest and 

synchronized mydlink Setup Wizards for Windows (and for some cameras macOS), User 

Manual, device firmware, and QIG for each model and hardware revision of device. The 

mydlink website portal does not post legacy firmware, because all pieces (mydlink Setup 

Wizards for Windows (and for some cameras macOS), User Manual, firmware, and QIG) 

have to be from the same version to function successfully. As a result, an end-user of a 

mydlink enabled IP cameras, such as the DCS-2310L, cannot use the mydlink features (the 

primary features of the product) or register the camera to the user’s mydlink account unless 

the end-user uses the most up-to-date firmware, which is also made available on the mydlink 

website portal. 

14. During the setup process for the DCS-2310L, even for end-users who have chosen to 

ignore the recommendations in the QIG and the mydlink website and instead use the legacy 

Microsoft Windows Setup Wizard, the end-user would be warned of the consequences of not 

registering with mydlink during the setup process. 

15. Since 2015, any attempt to access the DCS-2310L web configuration for any camera 

using the original firmware from Chrome, Firefox, Microsoft Internet Explorer, or Microsoft 

Edge PC web browsers will fail security checks, alerting the end-user to the need to consult 

technical support or troubleshoot the issue. 

16. In order to configure a DLS IP camera like the DCS-2310L without mydlink, the 

user must either seek help from DLS technical support (contact information provided in the 

QIG immediately following the recommended setup wizard steps) or use the User Manual 

that is linked on the mydlink website support page for the device 

(https://www.mydlink.com/download). DLS technical support personnel are trained to 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 5 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

5 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

instruct end-users who request assistance setting up DLS products, such as IP cameras, to 

download the latest available firmware during the setup process. 

17. The User Manual for the DCS-2310L was not contained in the retail packaging for 

the camera. Instead, it was made available on DLS’s technical support website, 

http://support.dlink.com, for technical support purposes as primarily a resource for DLS 

technical support staff to facilitate technical support if an end-user called with questions. 

The User Manual recommends setting up a mydlink account (pages 25-26) and also contains 

step-by-step instructions for upgrading the firmware for the DCS- 2310L (page 75). 

18. A mydlink IP camera that is not registered to then end-user’s mydlink account is not 

accessible outside the home unless further configuration is done at the home’s internet 

connection router or the end-user has arranged a special direct connection on the internet 

from an internet service provider. 

19. The DCS-2310L only can connect to a data network via its included Ethernet cable. It 

does not have any wireless features and therefore, is not directly accessible over WiFi datanetworks and not affected by WiFi security exploits. 

20. DLS does not distribute its products to “Great Daily Buys” and “A2Z Wireless,” 

which are unaffiliated third-party resellers that may sell DLS products through Amazon.com 

or Newegg.com. 

IP Cameras Are Not Intended to Be Used To Perform Data-Security Functions 

21. IP cameras sold by DLS are network connected devices capable of capturing video 

and sending over the network to an end-user or to another device that can analyze the video 

then trigger a response. The purpose of the consumer IP cameras sold by DLS is reflected on 

the datasheet and packaging as “Surveillance” or monitoring the IP Cameras viewing area 

over the network. 

22. It is a broad mischaracterization and technically inaccurate that consumer IP cameras 

sold by DLS are devices designed to serve a data-security-related function. Consumer IP 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 6 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

6 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

cameras sold by DLS have integrated features to help secure the captured video sent over the 

connected network; but their function is not to protect the network’s data security or the 

network’s data-privacy. If a consumer IP camera is connected to the Internet, it will be 

required to pass communication through devices, such as IP routers or IP gateways, that have 

features to help protect the network’s data-security and data-privacy. 

23. For these reasons—and unlike, for example, antivirus software products—enhancing 

the data security of a network cannot be said to be a central function of an IP camera, let 

alone the central function, even though the IP camera has certain security-related features. 

That said, DLS has always taken the security of its products seriously and would address 

them promptly when a potential security vulnerability regarding its products is raised. 

24. DLS does not market its IP cameras as serving data-security functions. Take, for 

example, the DCS-2310L. The datasheet, retail product packaging, QIG, and brochure 

accompanying it do not claim that the product serves a data-security function. Nor does the 

User Manual. Conversely, the accused legacy Microsoft Windows Setup Wizard GUI for 

that product affirmatively discloses (in disclaimer) to end-users that IP cameras cannot be 

guaranteed to be perfectly secure or free from security vulnerability as part of the End User 

License Agreement (EULA), which the end-user must agree to as a condition of using the 

camera. 

Three Tabs on DLS Security Advisories Website: “Security Advisories List”, “Report a 

Potential Vulnerability”, and “Security Event Response Policy” 

25. During the time period when PX 1(the tab for “ Security Event Response Policy”) 

was posted on DLS’s technical support website, and even before then, DLS retained 

additional third-party experts to test products. For example, in 2012, DLS hired Jason Doyle 

to conduct penetration testing on both the DIR-505 and also DIR-826. Attached as Exhibit D 

are true and correct copies of excerpts from those reports. 

26. During the time period when PX 1 was posted on DLS’s technical support website, it 

was available at http://support.dlink.com/securityadvisories. Within PX 1 is a Security 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 7 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

7 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Advisories List tab, which was intended to be prominent on that page. These Security 

Advisories provided information about reported potential vulnerabilities, the status of 

investigation and testing of these potential vulnerabilities, and the status and availability of 

any firmware updates resolving verified potential vulnerabilities. The Security Advisory had 

a list of the open or closed high-reported potential security vulnerabilities concerning D-Link 

brand products. Attached is Exhibit E are true and correct copies of portions of the list of 

Security Advisories that would be seen if the “Security Advisories List” tab was clicked by a 

website visitor, which I understand the FTC obtained via the Internet Way Back Machine and 

produced to DLS in discovery. At the top of those documents can be found two tabs. One 

is titled “Report a Potential Vulnerability”; the other is titled “Security Event Response 

Policy.” 

27. More specific Security Advisories could also be viewed by, among other things, 

clicking the links in the Security Advisories List. Attached as Exhibit F are true and correct 

copies of example Security Advisories. 

28. Also, within PX 1 is a tab titled “Report a Potential Vulnerability,” which allowed 

security researchers and others to report what they perceive as potential security 

vulnerabilities. Attached hereto as Exhibit G is a true and correct copy of a printout from the 

Internet Way Back Machine I understand the FTC produced in discovery showing what 

http://support.dlink.com/securityadvisories looked like in November 2013, before PX 1 was 

posted there. 

29. PX 1, in the context of DLS’s website when it was posted, operated in tandem with 

related tabs and documents, such as the Security Advisories List and Report a Potential 

Vulnerability tabs described hereto, among other things, advise of the status of reported 

potential vulnerabilities—both through the Security Advisories List and also through more 

specific Security Advisories—and to provide an open communications channel through 

which security researchers could report to DLS what they perceive to be potential theoretical 

vulnerabilities (the “Report a Potential Vulnerability Form”). 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 8 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

8 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

30. The “Report a Potential Vulnerability” and “Security Advisories List” tabs were 

present on DLS’s support website before PX 1 was posted to integrate the three components 

(Security Advisories List, Report a Potential Vulnerability, and Security Event Response 

Policy) together into a holistic website experience for visitors to the “Security Advisories” 

section of DLS’s website. 

31. The only way for a visitor to DLS’s main webpage to have directly navigated to PX 1 

during the time period it was posted would be to click on a small link at the very bottom of 

the homepage titled “Security Advisories.” 

32. Alternatively, if a visitor to DLS’s main webpage clicked on the tab to DLS’s product 

support website, he or she could then navigate to the Security Advisories page by clicking a 

tab that was at the top of the support page during the time period that PX 1 was posted. 

33. By way of additional context regarding the creation of the holistic Security 

Advisories experience: In January 2013, no direct competitor that manufacture, marketed, 

and sold consumer IP Cameras and/or consumer IP routers offered a published security 

response policy. DLS’ primary goal was to create a transparent and clear way for thirdparties to report what they perceived to be potential security issues with our products and 

systems (particularly technically sophisticated security researchers highly familiar with these 

issues, as they pertain to products like routers and IP cameras). The purpose of the 

publishing PX1 was to better communicate directly to the third-party data-networking 

security experts. PX1 was intended and utilized terminology for security trained 

professionals. 

34. The “security advisories” that were a component of the Security Advisories website 

were compiled from various source, including directly from the third-party reports including 

accreditation to the authors, patch information from the vendors, and DLS model/revision 

specific response. 

35. The third-party reports were copied and pasted into the “security advisories” 

regardless of validation, so we did not misrepresent the author’s position and claims. This 

means that portions of the “security advisories” were not drafted by DLS and would not 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 9 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

9 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

necessarily reflect DLS’s position as to the reported issues, or the results of investigations 

into the factual accuracy of these reports conducted by DLS, DKC, Institute for Information 

Industry (“III”)/Onward Security, and the vendors that make the reportedly affected products. 

Put different, by pasting into the “security advisories” the verbatim content of the third-party 

researcher reports DLS in no way accepted or vouched for or otherwise agreed to the 

accuracy of these reports, or the author’s characterizations of what the author perceived to be 

a potential security vulnerability. 

36. After pasting into the “security advisory” the author’s report, generally verbatim, I 

would frame our resolution and response around the report. Resolutions to potential security 

issues included correcting third party misunderstandings of the issues, explaining that 

implementing the solution as reported by the third-party would disable the device, or vendor 

creation of patches to close the potential security issue in the firmware after validation of the 

report. 

37. The security advisories are technical documents that became only useful to security 

knowledgeable experts with highly technical, specialized knowledge about potential security 

issues that may affect devices like routers and IP cameras—not the average US consumer. 

38. This is why in September 2015 we abandoned the previous “Security Advisories” 

website flow, including PX1; simplified the technical language; integrated the security event 

disclosure directly into each individual firmware release notes; and began posting a 

technically simplified “support announcement” that is listed on the front web page of 

http://support.dlink.com so the average US consumer can better understand these security 

issues.

DLS Customs and Practices For Communicating With Third Party Researchers 

39. To properly understand, in context, my written interactions with various third-parties, 

including security researchers and various “grey hat” hackers, I provide the following 

additional background. 

40. It is important to understand that the third-party researchers that coordinate with DLS 

regarding security issues sometimes seek compensation for their reports or, more frequently, 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 10 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

10 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

seek public credit for their published work. Some of these third-parties want to help DLS 

and perform a public service. Others third-parties have different motivations. The customs 

and practices of this highly specialized community, with its various norms of conduct and 

communication patterns, inform DLS’s written interactions with these third-parties. By way 

of example, attached hereto as Exhibit H are true and correct copies of two emails with 

security researchers, Mr. Robert Paleari and Mr. Daniel Romero. 

41. It is also important to understand that both DLS and D-Link brand globally welcome 

all third-party reports and do significant research with contracted third-parties and also, as 

part of the investigation into these reports, attempt to validate using DKC’s D-LAB. Once the 

vendor learns of a third-party report, they also have to understand, test, and attempt to 

validate the contents. At times, third-party experts like Onward Security are brought in also 

to attempt to verify the reported potential vulnerability. Sometimes, it turns out that the 

reported vulnerability cannot be duplicated because the reporter’s investigation was made in 

a controlled environment, the investigation and all of these layers of testing reveal that the 

reported vulnerability is, as further described below, inaccurately reported to DLS. As such, 

the reported vulnerability must be validated by efforts of vendors and/or independent security 

expert (e.g. III/Onward). 

42. The third-parties’ written reports—including those that I have pasted verbatim into 

“security advisories” in the past—frequently use inflammatory language, including adjectives 

like “critical” or “remote access,” that, in many cases, does not represent the potential 

theoretical security issue accurately. When I pasted the reports into the “security advisories” 

neither DLS nor I intended to adopt the unverified statements of third-parties, including their 

characterizations of what they believe to be a theoretical security vulnerability. 

43. In addition, in many instances, these reports reflect the results of theoretical potential 

vulnerabilities tested in lab conditions using sophisticated tools and reverse engineer to 

attempt to demonstrate what is known as proof of concept (“PoC”). This is overwhelmingly 

done through very specialized, unnatural configurations of the devices over a Local Area 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 11 of 13
Declaration of William Brown In Support of D-Link 

Systems’ Opposition to FTC’s Motion for Summary 

Judgment 

11 Case No. 17-cv-00039-JD 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Network (“LAN”), meaning that for the attack to possibly work the theoretical attacker 

would need to be, for example, in the same house. 

44. In other instances, the consequences of the theoretical exploit of the potential 

vulnerability may be what I call a functional nuisance, meaning it would not result in a data 

breach or privacy injury. Take, for example, a theoretical vulnerability that could, even if 

exploited, result in at most a DDoS (that is, “distributed denial of service”) attack on a router, 

which would automatically reboot, at most inconveniencing the user briefly. Nonetheless, 

the reporting party may describe the potential vulnerability in sensational terms for the 

above-stated reasons. 

45. The third party’s self-motivation and the factual disagreements about theoretical 

vulnerabilities that could, at most, result in functional nuisances is why DLS currently has 

third-parties apply for their own CVE-ID and supports their own public disclosure, in which 

we publicly publish a security announcement as our factual response. 

Datasheets for Count 3 Routers Accurately Described Product Security Features 

46. The router models at issue in Count 3 were made to have certain specific securityrelated features, which underwent QA testing and the existence of technical features and 

functions as intended and as further described below have been confirmed: 

a. DIR-615: Wi-Fi Protected Access /WPA. WPA2; Network Address Translation 

(NAT) and Stateful Packet Inspection (SPI) firewall features; VPN Passthrough IP 

Multi sessions PPTP I LZTP / IP Sec 

b. DIR-412: 64/128-bit WEP (Wired Equivalent Privacy); Wi-Fi Protected AccessTM 

(WPA & WPA2); WPS (PBC/PIN); Network Address Translation (NAT); Stateful 

Packet Inspection (SPI); MAC Address Filtering; Website Filtering; 

L2TP/PPTP/IPSEC VPN Pass-through; PPTP/L2TP Connection 

c. DIR-815: WiFi Protected Access (WPA, WPA2); Stateful Packet Inspection (SPI) 

firewalls 

Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 12 of 13
Case 3:17-cv-00039-JD Document 206-31 Filed 10/05/18 Page 13 of 13