In The News

FTC May Increase Enforcement of Connected Devices After Smart Lock Company's Security Slipup

By Dan Clark
April 7, 2020
Corporate Counsel

Photo of attorney Michelle Hon Donovan

Michelle Hon Donovan

Tapplock Inc., a Canadian company that makes a fingerprint-enabled padlock that can connect to smartphones, settled claims with the Federal Trade Commission on Monday that it allegedly made misrepresentations on how secure its locks are and failed to properly secure consumers’ personal information.

Experts say the FTC will likely continue to ramp up enforcement on companies that make the Internet of Things products if they do not include information security in the initial design of their products and work to more carefully market those products.[...]

Tapplock said its smart lock has an “unbreakable design” and that it is “bold,” “sturdy” and “secure.”

The FTC alleged the lock could be bypassed by simply unscrewing the back panel in “a matter of seconds.” The agency further alleged that researchers were able to bypass the account authentication process to gain access to consumers’ personal information.

Tapplock agreed to implement a security program and the FTC banned the company from making deceptive statements about the security of its devices. It has also agreed to a third-party review of its security program. There is no monetary fine. However, the company faces a fine of $43,280 for each instance that it violates the settlement agreement. A representative for Tapplock did not respond to a request for comment on Tuesday.[...]

False or misleading statements on the security of products are what allows the FTC to investigate a company under the Federal Trade Commission Act, Michelle Hon Donovan, a partner at Duane Morris in San Diego, said.

“I think these companies historically have not been known to have substantial information security protections in place for these devices,” Donovan said. “We’re seeing a paradigm shift in how legislatures and regulators view and enforce security requirements.”

Donovan said that companies making these kinds of devices must implement a “security by design” process to mitigate the risk of an investigation.

“Someone who is an information security expert needs to be on the design team for anything that is going to be connected to the internet,” Donovan said.

It is likely that the FTC will file more complaints against companies who fail to take consumer data seriously. In July, the FTC ordered Facebook to pay $5 billion over how it collected user data.

“That order that came out last year was unprecedented in its depth and breadth,” Donovan said. “The FTC has said to expect to see more of this.”

Reprinted with permission from Corporate Counsel, © ALM Media Properties LLC. All rights reserved.