Years Later, FTC Wins Case Against Roca Labs For Its Bogus Non-Disparagement Clause

from the not-to-mention-junk-weight-loss-claims dept

Remember Roca Labs? A few years back we wrote about them extensively. The company (along with Don Juravin, who ran it), had cooked up quite a scheme. They were selling what they claimed was a "weight loss" product, which involved ingesting something that one doctor summarized as "consist[ing] primarily of industrial food thickening agents." If that wasn't already sketchy enough, the company more or less required purchasers to agree to a non-disparagement contract in order to order the stuff. Roca claimed that you were just getting a "discount" if you agreed to the non-disaparagement clause, but it was unclear if there was any other way to order. Roca had a "doctor" vouching for its product, but it turned out it was a doctor who had lost his medical license. The company came to our attention when it sued Pissedconsumer because some of its many unhappy customers had ignored the non-disparagement clause and complained about Roca Labs on that site.

The company then trotted out nearly every sketchy trick in the book -- including threatening legal action against us, actually suing PissedConsumer's lawyer, Marc Randazza (over something that we had written on Techdirt), and filing bogus DMCA notices to try to delete negative reviews -- before the FTC finally went after the company in September of 2015.

That case has continued for years (during which PissedConsumer won its case against Roca) and now the FTC has finally prevailed against Roca and Juravin as well. Eric Goldman has a good write-up on the ruling as well.

Roca lost on basically every point. The key one is that its anti-disparagement clause was considered an "unfair" practice by the FTC. Roca tried to argue that this clause was legal because it was a clickwrap contract, and clickwrap contracts have been found to be legal. The court points out hat that's not even the issue here at all. It's a question of whether or not what's in that contract is an "unfair practice." And here it's pretty clearly established First, the FTC clearly showed the harm of suppressing critical reviews:

Because Defendants admittedly suppressed negative information about the products and because Dr. Pavlou testified that the absence of negative information could make a consumer more inclined to purchase Roca Labs products, the Court finds that Defendants’ practices have caused or were likely to cause substantial injury to consumers. The record demonstrates that some consumers paid hundreds of dollars for the Roca Labs products and unsuccessfully sought refunds because of Defendants’ practice of issuing threats under the guise of enforcing the gag clause. Thus, the Court finds that there is no genuine issue of fact on this basis that would preclude summary judgment in favor of the FTC.

The court is not impressed by the argument that potential purchasers should have just read the terms and used a different weight loss program if they didn't like Roca Labs' nonsense:

Defendants offer no evidence that their practices did not prohibit the availability of negative reviews or that their practices were reasonably avoidable by the prospective consumer. Rather, Defendants argue that prospective customers could have reasonably avoided any injury by reading the contract that contained the gag clause or joining another weight loss program. (Dkt. 212 at 17–18) Defendants’ argument misses the mark. Under this prong of the FTC Act, the FTC alleges that Defendants’ practices relating to the gag clause, not the gag clause itself, were unfair. Further, because Defendants offer no facts to support a claim that prospective customers could reasonably avoid a dearth of negative reviews, which the Defendants assiduously prevented from being available, there is no genuine issue of a material fact in dispute on this issue.

Roca also tried to argue that the gag clause was okay because (get this) losing weight makes people feel good, and that's a benefit. But, as the court notes, this was in response to questions about the gag clause, not the product itself:

Defendants’ recitation of the benefits they claim consumers received from using the products ignores the issue presented in this claim, which is whether Defendants’ gag clause practices, not their products and services, presented a countervailing benefit.

Roca also gets in trouble for claiming that the price everyone got was "discounted," but only if they agreed to the non-disparagement clause. As the court points out, Roca advertised the "discounted" price all over the place as if it were the actual price, and only put in the fine print that you had to pay a lot more if you didn't want to be gagged:

Defendants created an overall net impression that the price of the product was $480 without reference to a discount or any concessions as to publishing negative comments. Defendants advertised that the basic package of Roca Labs products costs $480 for purchasers with a “valid health insurance.”... In multiple online advertisements, including those that appeared on Google, Bing, and Facebook, Defendants advertised the cost as simply $480, at least for a basic package of Roca Labs products.... At the top of the “Roca Labs Procedure Cost” page of Defendants’ Websites, Defendants state “Only $480 and NO surgery to gastric bypass cost of $8,000 + health insurance payments. Save yourself from surgery that can cost your life. Save 90%.” ... Farther down on that page, in smaller print, Defendants state that the “Roca Labs Formula is available for as low as $480” and display a chart showing the various packages, from the basic package for $480 to the customized package for $1,080.... The price differences in the packages reflect the quantity of products ordered and the level of customer service provided.... Several of the banner ads that appear online typically have five words: “GASTRIC BYPASS NO SURGERY $480.”... Scores of search advertisements also convey the price as $480, stating, for example, “Mini Gastric Bypass $480” followed by “Official Site: No Surgery Solution! Reduce Stomach Size & Lose Weight.” ... The advertisements did not contain any disclaimers that the price was discounted or subsidized in exchange for a customer’s agreement to refrain from publishing negative comments. As such, Defendants created an overall net impression that the price was $480, with no exceptions or limitations.

And, thus, it's a deceptive practice to make people think they could pay $480 and still criticize the product, when the terms of the deal were quite different:

Defendants’ misrepresentation is material and deceptive because it is an express claim that involves important information to customers: the price of the product and limitations on what customers could say about the products or Defendants. A customer would likely be misled to believe that he or she had the option to purchase the product at “full” price and maintain the ability to post negative but truthful comments. Customers also would likely to be misled to believe that they had actually agreed to refrain from posting negative comments, when they had not agreed to do so, by paying the purportedly discounted price.

The court also takes on a bunch of issues regarding Roca Labs' products, and agrees (surprise surprise) that Roca Labs' claims about weight loss from its products were unfair and deceptive:

The FTC has established that Defendants’ claims are false in that they were material and likely to mislead consumers. As discussed above, Defendants made express claims regarding weight loss. Those express claims, which significantly involve health, are inherently material... Defendants disseminated their claims online—through the Roca Labs Websites and online advertisements—to direct consumers to the Roca Labs Websites to purchase the products. The ads intentionally contained medical images and terminology to bolster the credibility of Defendants’ claims and induce customers to believe that the claims were scientifically validated by the medical community. Thus, the Court concludes that the claims were likely to mislead consumers acting reasonably under the circumstances.

The FTC also has established that Defendants had no reasonable basis to assert the claims because they lack competent and reliable scientific evidence. For healthrelated claims, including weight-loss claims, an advertiser must demonstrate that it has competent and reliable scientific evidence to support any claimed reasonable basis to assert that the claims are true.... Additionally, the FTC’s expert, Dr. Steven Heymsfield (“Dr. Heymsfield”), a medical doctor at the Pennington Biomedical Research Center at Louisiana State University and an expert in obesity treatment and weight loss, opined that no competent and reliable scientific evidence for Defendants’ claims existed.... To prove a weight-loss claim, “experts in the field of obesity treatment and weight loss would require well-designed and properly conducted clinical trials.” ... Dr. Heymsfield explained that a trial should be doubleblind and placebo-controlled so that the testers and participants are unaware of who is assigned to a particular group.... Dr. Heymsfield also explained that a valid clinical trial would have at least eighty participants and last at least three months.... He stated that a clinical trial should test the substance, not the individual ingredients, for which the claims are made because it is well established in the scientific community that the efficacy of individual ingredients is insufficient to establish the efficacy of those ingredients combined.

Not surprisingly, Roca Labs did none of that. Ridiculously, Roca Labs' defense was to say that a randomized controlled test wasn't necessary after completely misreading a different case, involving Bayer, in which Bayer was accused of violating a consent decree, whereas the court ruled that the consent decree did not require a randomized controlled test. But, that's got nothing to do with this case, as there was no consent decree at issue. But, even beyond that, the court notes that Roca Labs' offering certainly appears to be snake oil:

Defendants failed to produce any competent and reliable scientific evidence to substantiate their claims. In September 2015, the same month that the FTC filed this Complaint, Defendants’ products were studied by the Center for Applied Health Sciences, which issued a report after a clinical trial on the Roca Labs products.... Dr. Heymsfield reviewed the study, which Defendants provided to the FTC.... The study tested thirty-one overweight adults, including seventeen adults who used the Roca Labs products for twenty-eight days.... The results showed that the participants did not lose weight after taking the Roca Labs products and that there was a “slight but statistically insignificant ‘trend’ that active users reported feeling less hungry three hours after taking the product.” ... He noted the study reflected that there was no “lasting reduction in gastric capacity.” ... Dr. Heymsfield determined that the trial did not provide any competent or reliable scientific evidence because the trial design was flawed....

Additionally, Dr. Heymsfield opined that the scientific articles on weight loss and individual dietary fibers, the specific articles posted on Roca Labs Websites, and other materials provided by Roca Labs do not offer any competent and reliable scientific evidence in support of Defendants’ claims.

In a footnote, it also points out that one of the articles on Roca's site supporting its claims for weight loss was... authored by Don Juravin himself "who has not been identified as an expert."

The court further notes that Roca's claim on its website of a "ninety-percent success rate" is, shall we say... a problem:

the FTC also has demonstrated that Defendants’ claim that the use of Formula and Anti-Cravings is scientifically proven to have a ninety-percent success rate in forcing users to eat half their usual food intake and cause substantial weight loss is false. This representation of success is an establishment claim because the claim purports to be supported by scientific evidence. By law, an establishment claim is required to have a certain level of scientific proof to support of the claim.... The advertiser must have sufficient evidence to satisfy the relevant scientific community of the claim’s truth.... Defendants have advertised the “scientifically proven” claim online, but they have not produced any evidence to support the claim.... As discussed above, Defendants have failed to provide any evidence of a valid clinical study on the Roca Labs products. Hence, the unsubstantiated claim is false and likely to mislead consumers into believing that it was supported when it was not.

Roca also gets in trouble for running a related site that pretended to be independent and paying people for testimonials about Roca on this supposedly independent third party website. As you can imagine, that's not an acceptable way to market a product.

Material misrepresentations or omissions on which a consumer would likely rely to decide whether to make a purchase constitute deceptive advertising... Juravin testified that he created Gastricbypass.me to “educate and scare people about” gastric bypass surgery.... Only Roca Labs products were discussed favorably on the site, although there was no disclosure of the affiliation with Defendants.... Juravin stated that Gastricbypass.me was controlled by Roca Labs and that he was responsible for the content, but he did not see any value in letting consumers know “[h]ey we are Roca Labs.”

Oh, it gets worse:

Purportedly satisfied customers—“Carla” and “Roxie”—depicted in the videos posted on RocaLabs.com were actually Defendants’ employees.... Defendants directed their employees to create blogs or fictitious posts. For example, Roca Labs General Manager Sharon King (“King”) testified that she wrote a Roca Labs product review under the name of “Fran,” which was a fictitious name, and that Juravin edited the review.... Juravin also directed King to instruct “the Customer Service people” to write posts or reviews and comment on Roca Labs Facebook advertisements.... Defendants did not instruct the employees to disclose their affiliation with Defendants... Roca Labs employee Sharon Hensley (“Hensley”), who appeared on video as “Roxie,” testified that she was asked to post positive comments monthly on Facebook about Roca Labs monthly and did not state her association with Defendants.

Amusingly, Roca Labs tried to defend some of their employees' posts saying that they really did lose weight using the product. As the court points out, this argument "misses the point." It's not the weight loss that's the issue. It's failing to disclose the relationship with the company.

So, if you're keeping score at home: the company posted a ton of fake reviews, pretending they were from satisfied customers, selling a product that promoted weight loss with no scientific basis, and barred actual customers from posting any negative reviews. And, let's not forget they threatened to sue us for reporting all of that originally.

And that doesn't even touch on the fact that Roca Labs didn't keep its customers private health information secret (despite promising to do so). Roca's defense on that one is even worse: it claims that the health info was public (it was not) and that it needed to share the info in response to customers breaching the contract...

What does this all mean for Roca and Juravin? The court agrees to a permanent injunction, and notes that while Juravin has dropped the Roca name, he's still playing the same game:

Juravin testified that he has moved away from using the Roca Labs brand and is now using “gastric.care,” but “[t]he formula is the same formula.”... Juravin also stated that he is marketing the products on Facebook, a “Lost 100” Website, and online videos and chat.... In his deposition, Juravin also said he told his Facebook boot camp customers: “I’m allowed to tell you anything I want; to do anything I want with you that would lead you to a healthy weight . . .” ... He also testified that he will show the customers “any images I want. I will do anything I want for them for as long as I lead them to achieve a healthy weight.” ... Based on Defendants’ extended history of deceptive and unfair practices and Defendants’ continued promotion of their products and comparisons to gastric bypass surgery, the FTC has proven that a cognizable danger of recurrent violation exists. Thus, a permanent injunction prohibiting Defendants’ deceptive and unfair practices is justified.

Then there's how much money Juravin needs to pay for all of this. The FTC asked the court to make Juravin hand over the net revenue earned in selling all this junk, while Juravin attempted a sillier formula, saying that he should only have to pay back $350 for each Better Business Bureau complaint there was, as those were the only dissatisfied customers. It takes quite a lot of guts to make such a claim, considering the bullshit contract he used barred customers from complaining to the BBB. The FTC showed that Juravin made an astounding $26 million from this scam, but because he failed to accurately document how much Roca had to pay back in refunds, the court asks him to provide some more info -- but it certainly appears that Juravin is going to be facing a hefty invoice from the US government before long.

Incredibly, so much attention was driven in the direction of Roca because it first sued PissedConsumer. It is entirely possible that the FTC would have cracked down on Roca and Juravin eventually no matter what, but it certainly appears that getting aggressive and suing others helped bring about Roca's and Juravin's downfall.

Filed Under: deceptive, don juravin, ftc, unfair
Companies: roca labs

Complaint To FTC Says It’s 'Deceptive' For Google To Not Recognize 'Right To Be Forgotten' In US

from the what-the...? dept

If you want an understanding of my general philosophy on business and economics, it's that companies should focus on serving their customers better. That's it. It's a very customer-centric view of capitalism. I think companies that screw over their customers and users will have it come back to bite them, and thus it's a better strategy for everyone if companies focus on providing good products and services to consumers, without screwing them over. And, I'm super supportive of organizations that focus on holding companies' feet to the fire when they fail to live up to that promise. Consumerist (owned by Consumer Reports) is really fantastic at this kind of thing, for example. Consumer Watchdog, on the other hand, despite its name, appears to have very little to do with actually protecting consumers' interests. Instead, it seems like some crazy people who absolutely hate Google, and pretend that they're "protecting" consumers from Google by attacking the company at every opportunity. If Consumer Watchdog actually had relevant points, that might be useful, but nearly every attack on Google is so ridiculous that all it does is make Consumer Watchdog look like a complete joke and undermine whatever credibility the organization might have.

In the past, we've covered an anti-Google video that company put out that contained so many factual errors that it was a complete joke (and was later revealed as nothing more than a stunt to sell some books). Then there was the attempt to argue that Gmail was an illegal wiretap. It's hard to take the organization seriously when it does that kind of thing.

Its latest, however, takes the crazy to new levels. John Simpson, Consumer Watchdog's resident "old man yells at cloud" impersonator, recently filed a complaint with the FTC against Google. In it, he not only argues that Google should offer the "Right to be Forgotten" in the US, but says that the failure to do that is an "unfair and deceptive practice." Really.

As you know by now, since an EU court ruling last year, Google has been forced to enable a right to be forgotten in the EU, in which it will "delink" certain results from the searches on certain names, if the people argue that the links are no longer "relevant." Some in the EU have been pressing Google to make that "right to be forgotten" global -- which Google refuses to do, noting that it would violate the First Amendment in the US and would allow the most restrictive, anti-free speech regime in the world to censor the global internet.

But, apparently John Simpson likes censorship and supporting free speech-destroying regimes. Because he argues Google must allow such censorship in the US. How could Google's refusal to implement "right to be forgotten" possibly be "deceptive"? Well, in Simpson's world, it's because Google presents itself as "being deeply committed to privacy" but then doesn't abide by a global right to be forgotten. Really.

“The Internet giant aggressively and repeatedly holds itself out to users as being deeply committed to privacy. Without a doubt requesting the removal of a search engine link from one’s name to irrelevant data under the Right To Be Forgotten (or Right to Relevancy) is an important privacy option,” Consumer Watchdog’s complaint said. “Though Google claims it is concerned about users’ privacy, it does not offer U.S. users the ability to make such a basic request. Describing yourself as championing users’ privacy and not offering a key privacy tool – indeed one offered all across Europe – is deceptive behavior.”

That's, uh, not how this all works. In his complaint to the FTC, Simpson's theory is laid out in all its kooky nuttiness. Basically, because in the past we didn't have technology, and things would get forgotten thanks to obscurity -- and because Google claims to support privacy, it must magically pretend that we still live in such an age, and agree to forget stuff people want it to forget. He'd also, apparently, like Google to get off his lawn.

Here is why the Right To Be Forgotten – or Right of Relevancy – is so important to protecting consumers’ privacy in the digital age: Before the Internet if someone did something foolish when they were young – and most of us probably did – there might well be a public record of what happened. Over time, as they aged, people tended to forget whatever embarrassing things someone did in their youth. They would be judged mostly based on their current circumstances, not on information no longer relevant. If someone else were highly motivated, they could go back into paper files and folders and dig up a person’s past. Usually this required effort and motivation. For a reporter, for instance, this sort of deep digging was routine with, say, candidates for public office, not for Joe Blow citizen. This reality that our youthful indiscretions and embarrassments and other matters no longer relevant slipped from the general public’s consciousness is Privacy By Obscurity. The Digital Age has ended that. Everything – all our digital footprints – are instantly available with a few clicks on a computer or taps on a mobile device.

[....]

Google’s anti-consumer behavior around privacy issues is deceptive. The Internet giant holds itself out to be committed to users’ privacy, but does not honor requests that provide a key privacy protection. Google explains: “We know security and privacy are important to you – and they are important to us, too. We make it a priority to provide strong security and give you confidence that your information is safe and accessible when you need it. We’re constantly working to ensure strong security, protect your privacy, and make Google even more effective and efficient for you.” Recently Google said, “Protecting the privacy and security of our customers’ information is a top priority, and we take compliance very seriously.” In its Privacy & Terms Technologies and Principles Google claims, “We comply with privacy laws, and additionally work internally and with regulators and industry partners to develop and implement strong privacy standards… People have different privacy concerns and needs. To best serve the full range of our users, Google strives to offer them meaningful and fine-gained choices over the use of their personal information.”

In other words the Internet giant aggressively and repeatedly holds itself out to users as being deeply committed to privacy. Without a doubt requesting the removal of a search engine link from one’s name to irrelevant data under the Right To Be Forgotten (or Right to Relevancy) is an important privacy option. Though Google claims it is concerned about users’ privacy, it does not offer U.S. users the ability to make this basic request. Describing yourself as championing users’ privacy while not offering a key privacy tool – indeed one offered all across Europe – is deceptive behavior.

This is an absolutely insane interpretation of "deceptive." A company that supports user privacy is not being deceptive just because its definition of privacy doesn't match your crazy definition. It's just a different policy. If Google had flat out said that it would support a "right to be forgotten" in the US and then refused to process any requests, that would be deceptive. But accurately stating what the company does is not deceptive, no matter what Simpson seems to think.

What about the "unfair" part of "unfair and deceptive"? I honestly can't summarize the logic because there is none. Apparently, some people might not like what searches on their name turn up, and that's bad and thus... unfair?

Not offering Americans a basic privacy tool, while providing it to millions of users across Europe, is also an unfair practice. Acts or practices by a business are unfair under Section 5 of the Federal Trade Commission Act if they cause or are likely to cause substantial injury to consumers that consumers cannot reasonably avoid themselves and that is not outweighed by countervailing benefits to consumers or competition.6 Here are some examples of people who have been harmed by Google’s refusal to honor Right of Relevancy or Right To Be Forgotten removal requests in the United States. Clearly there is no countervailing benefit in continuing to link to the items from search results. Consider these examples:

• A young California woman was decapitated in a tragic auto accident. Photos from the grisly accident scene were wrongfully leaked by California Highway Patrol officers and posted to the Internet. A search on her name still returns the horrible photographs.
• A guidance counselor was fired in 2012 after modeling photos from 20 years prior surfaced. She was a lingerie model between the ages of 18-20, and she had disclosed her prior career when she first was hired. Despite this, when a photo was found online and shown to the principal of her school, she was fired.

I don't see how any of this is "protecting consumers." It's seems quite the opposite, actually. It seems to be assuming that the public is made up of pure idiots who can't ever figure out context or understand that sometimes bad things happen. But that's not true. People learn and adapt and adjust to new technologies, even as people like John Simpson fear them. When cameras first started becoming popular they were banned from beaches because people might take photographs of other people there. But people grew up and realized that wasn't destroying anyone's privacy. Simpson has this weird infatuation not with protecting consumers, but with censoring the internet to keep the public from knowing factual information, because apparently he thinks the public can't handle it.

Last week, on On The Media, host Bob Garfield pointed out to Simpson how ridiculous all of this was, and Simpson doesn't have a single reasonable response. Garfield points out that public information, even embarrassing public information, is, by definition, not private information, and thus there's no privacy violation here. And all Simpson can do is pull his nostalgia gig about how things used to be different when people would forget your embarrassing things in the past. But that doesn't answer the question at all. It just makes Simpson seem totally out of touch with the modern world.

Filed Under: consumers, deceptive, ftc, john simpson, privacy, right to be forgotten, unfair
Companies: consumer watchdog, google

Appeals Court: Yes, The FTC Can Go After Companies That Got Hacked Over Their Weak Security Practices

from the secure-your-sites-kids dept

Way back in 2004, we noted that the FTC went after Tower Records for getting hacked and leaking customer records. At the time, we wondered if this was appropriate. Companies get hacked all the time, even those with good security practices. So, at what point can it be determined if the company is being negligent, or if it's just that those looking to crack their systems are just that good. Well, the FTC had decided that it can draw the line, and for companies that do a particularly egregious job in not protecting user data, it's made it clear that it's going to go after them. A few years back, the FTC went after Wyndham Hotels for failing to secure user data, and Wyndham tried to argue that the FTC had no authority to do so. Last year, a district court sided with the FTC and now the Third Circuit appeals court has upheld that ruling, giving the FTC much more power to crack down on companies who fail to protect user data from leaking.

The ruling doesn't fully answer the question of where can the FTC draw that line, but it certainly suggests that if your security is laughably bad then, absolutely, the FTC can go after you. And, yes, Wyndham's security was laughably bad. From the court ruling:

The company allowed Wyndham-branded hotels to store payment card information in clear readable text.

Wyndham allowed the use of easily guessed passwords to access the property management systems. For example, to gain “remote access to at least one hotel’s system,” which was developed by Micros Systems, Inc., the user ID and password were both “micros.”...

Wyndham failed to use “readily available security measures”—such as firewalls—to “limit access between [the] hotels’ property management systems, . . . corporate network, and the Internet.” ...

Wyndham allowed hotel property management systems to connect to its network without taking appropriate cybersecurity precautions. It did not ensure that the hotels implemented “adequate information security policies and procedures.” ... Also, it knowingly allowed at least one hotel to connect to the Wyndham network with an out-of-date operating system that had not received a security update in over three years. It allowed hotel servers to connect to Wyndham’s network even though “default user IDs and passwords were enabled . . . , which were easily available to hackers through simple Internet searches.” ... And, because it failed to maintain an “adequate[] inventory [of] computers connected to [Wyndham’s] network [to] manage the devices,” it was unable to identify the source of at least one of the cybersecurity attacks.

Wyndham failed to “adequately restrict” the access of third-party vendors to its network and the servers of Wyndham-branded hotels. ... For example, it did not “restrict[] connections to specified IP addresses or grant[] temporary, limited access, as necessary.”

It failed to employ “reasonable measures to detect and prevent unauthorized access” to its computer network or to “conduct security investigations.”

It did not follow “proper incident response procedures.” ... The hackers used similar methods in each attack, and yet Wyndham failed to monitor its network for malware used in the previous intrusions.

So, yeah. This wasn't a situation where determined malicious hackers had to carefully dismantle a security apparatus. There was no security apparatus, basically. The ruling also mentions that the Wyndham website claimed to encrypt credit card data and use firewalls and other things -- none of which it actually did. Oops. And, of course, hackers broke in multiple times and Wyndham did basically nothing.

As noted, on three occasions in 2008 and 2009 hackers accessed Wyndham’s network and the property management systems of Wyndham-branded hotels. In April 2008, hackers first broke into the local network of a hotel in Phoenix, Arizona, which was connected to Wyndham’s network and the Internet. They then used the brute-force method—repeatedly guessing users’ login IDs and passwords—to access an administrator account on Wyndham’s network. This enabled them to obtain consumer data on computers throughout the network. In total, the hackers obtained unencrypted information for over 500,000 accounts, which they sent to a domain in Russia.

In March 2009, hackers attacked again, this time by accessing Wyndham’s network through an administrative account. The FTC claims that Wyndham was unaware of the attack for two months until consumers filed complaints about fraudulent charges. Wyndham then discovered “memory-scraping malware” used in the previous attack on more than thirty hotels’ computer systems.... The FTC asserts that, due to Wyndham’s “failure to monitor [the network] for the malware used in the previous attack, hackers had unauthorized access to [its] network for approximately two months.” ... In this second attack, the hackers obtained unencrypted payment card information for approximately 50,000 consumers from the property management systems of 39 hotels.

Hackers in late 2009 breached Wyndham’s cybersecurity a third time by accessing an administrator account on one of its networks. Because Wyndham “had still not adequately limited access between . . . the Wyndham-branded hotels’ property management systems, [Wyndham’s network], and the Internet,” the hackers had access to the property management servers of multiple hotels.... Wyndham only learned of the intrusion in January 2010 when a credit card company received complaints from cardholders. In this third attack, hackers obtained payment card information for approximately 69,000 customers from the property management systems of 28 hotels.

The FTC alleges that, in total, the hackers obtained payment card information from over 619,000 consumers, which (as noted) resulted in at least $10.6 million in fraud loss. It further states that consumers suffered financial injury through “unreimbursed fraudulent charges, increased costs, and lost access to funds or credit,” ..., and that they “expended time and money resolving fraudulent charges and mitigating subsequent harm.”

And yet, still, Wyndham insisted that the FTC had no mandate to go after them for this rather egregious behavior. The appeals court agrees with the lower court in saying "of course the FTC can go after such behavior." The main question: Is this an "unfair" practice by Wyndham? The company argued that it's not unfair because it's the victim here. The court doesn't buy it.

Wyndham asserts that a business “does not treat its customers in an ‘unfair’ manner when the business itself is victimized by criminals.”... It offers no reasoning or authority for this principle, and we can think of none ourselves.

Also: it's generally not a good thing when a court refers to your legal argument as "a reductio ad aburdum" (i.e., taking something to such an extreme as to be ridiculous).

Finally, Wyndham posits a reductio ad absurdum, arguing that if the FTC’s unfairness authority extends to Wyndham’s conduct, then the FTC also has the authority to “regulate the locks on hotel room doors, . . . to require every store in the land to post an armed guard at the door,” ... and to sue supermarkets that are “sloppy about sweeping up banana peels,” ... The argument is alarmist to say the least. And it invites the tart retort that, were Wyndham a supermarket, leaving so many banana peels all over the place that 619,000 customers fall hardly suggests it should be immune from liability under § 45(a).

Going for a due process move, Wyndham tries to argue that there was not "fair notice" of what kinds of security practices the FTC required. I'm actually marginally sympathetic to this argument. If this is ever amorphous, then that is really challenging for companies who just don't know if their security practices meet the vague non-public standard of "okay" for the FTC. But, if you're running a company -- especially one as large as Wyndham Hotels -- it's not unreasonable to suggest that your tech staff at least understand some basic fundamentals about security, like not using default passwords, encrypting credit card data, and using firewalls. This isn't advanced computer security here. This is pretty basic stuff. Furthermore, the court basically says Wyndham doesn't need specific rules from the FTC, but rather just should know that the law about "unfair" practices exists.

Wyndham is entitled to a relatively low level of statutory notice for several reasons. Subsection 45(a) does not implicate any constitutional rights here.... It is a civil rather than criminal statute.... And statutes regulating economic activity receive a “less strict” test because their “subject matter is often more narrow, and because businesses, which face economic demands to plan behavior carefully, can be expected to consult relevant legislation in advance of action.”

In this context, the relevant legal rule is not “so vague as to be ‘no rule or standard at all.’”... Subsection 45(n) asks whether “the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.” While far from precise, this standard informs parties that the relevant inquiry here is a cost-benefit analysis,... that considers a number of relevant factors, including the probability and expected size of reasonably unavoidable harms to consumers given a certain level of cybersecurity and the costs to consumers that would arise from investment in stronger cybersecurity. We acknowledge there will be borderline cases where it is unclear if a particular company’s conduct falls below the requisite legal threshold. But under a due process analysis a company is not entitled to such precision as would eliminate all close calls.

And, the court notes, Wyndham's behavior here is so egregious that no reasonable person could find it surprising that the FTC went after the company for its [lack of] security practices.

As the FTC points out in its brief, the complaint does not allege that Wyndham used weak firewalls, IP address restrictions, encryption software, and passwords. Rather, it alleges that Wyndham failed to use any firewall at critical network points, did not restrict specific IP addresses at all, did not use any encryption for certain customer files, and did not require some users to change their default or factory-setting passwords at all.

Which leads to the kicker in the following sentence:

Wyndham did not respond to this argument in its reply brief.

Ouch.

The court also notes that maybe Wyndham's response would be more reasonable if the company had only been hacked once. But three times is a bit much:

Wyndham’s as-applied challenge is even weaker given it was hacked not one or two, but three, times. At least after the second attack, it should have been painfully clear to Wyndham that a court could find its conduct failed the cost-benefit analysis.... [C]ertainly after the second time Wyndham was hacked, it was on notice of the possibility that a court could find that its practices fail the cost-benefit analysis.

And thus, while I'm still a little nervous about going after companies who get hacked, it seems in this case, where there appears to be overwhelming evidence of near total gross negligence on the part of Wyndham to secure user data, it does seem reasonable for the FTC to be able to proceed, and now both a district and appeals court agree.

Filed Under: computer security, consumer protection, encryption, ftc, security, unfair, weak security
Companies: wyndham

Did Lenovo/Superfish Break The Law?

from the certainly-can-make-an-argument-that-way dept

For many years, it's been something of an open question if creating a major security or privacy vulnerability was illegal. For the most part, courts have ruled that without actual proven harm, it's difficult to show real standing for the sake of a civil lawsuit. In practical terms, this has meant that if you just introduce a massive security risk, without it directly being abused (in a way that people know about), a company's liability is fairly limited. Obviously, that could change quickly if there was an actual abuse. Not surprisingly, class action law firms still love to file these kinds of lawsuits after a major privacy/security breach just in case. So it was totally expected to see a class action firm jump in and sue Lenovo over the Superfish malware that we've been discussing for the past few days.

The folks over at CDT, however, have a very good discussion over whether or not enabling such HTTPS hijacking really is illegal. The article compares the Superfish story to the other recent story about in-flight Wi-Fi provider GoGo doing something similar, and explores whether or not these man-in-the-middle attacks run afoul of Section 5 of the FTC Act, which is the broad rules under which the FTC "protects consumers." The rules basically say companies cannot do things that are "deceptive" or "unfair," but the definitions of both of those words matters quite a bit.

Here's the exploration of whether this kind of man-in-the-middle attack is "deceptive":

At a technical level, these SSL-breaking technologies trick your browser by forging SSL certificates, implying that their service operates encrypted websites like YouTube.com and BankofAmerica.com. In fact, instead of passing encrypted traffic on to the appropriate destination, these technologies enact the previously described “man-in-the-middle attack,” gaining access to potentially sensitive information that should rightly be kept between you and, for example, your bank or health care provider. Though these practices do not directly deceive the end user, they do effectively deceive the user’s software that acts as a “user agent.”  It’s not settled that this is prohibited by deceptive practices authority; in the past, the FTC has been reluctant to pursue deceptive practices cases merely on the grounds of tricking a browser: the FTC declined to pursue companies that issued bogus machine-readable P3P policies to get around Internet Explorer privacy restrictions or against companies that evaded Apple Safari’s default cookie settings in order to place third party cookies.^[3] On the other hand, six state Attorneys General did bring a deceptive practices claim under their own version of Section 5 against companies that tricked Safari browsers into accepting third-party cookies.

Alternatively, the FTC could argue that failure to disclose that encrypted transmissions were being intercepted constituted a material omission — that is, failure to explain the practice would be a deceptive means to prevent a consumer from meaningfully evaluating the product. The FTC has brought a number of cases arguing that failure to disclose highly invasive or controversial practices either in a privacy policy or in clear, upfront language could constitute a deceptive practice.  For instance, the FTC has found that failure to disclose access to your phone’s contact information or precise geolocation could constitute a material omission.

From what I can tell, neither Gogo nor Lenovo went out of their way to tell users about these practices. If anything, Gogo’s privacy policy would lead users to think that their SSL-protected communications were safe from eavesdropping.

For Lenovo, a post to one of its user forums says that users had to agree to the Superfish privacy policy and terms of service. I don’t know what these documents said exactly, though the Superfish documents available on their website say nothing about these practices.  Even if Lenovo had disclosed in fine print what it does, regulators could make the case that SSL interception was so controversial that permission needed to be obtained outside of a boilerplate legal agreement. A service could certainly try to make a value proposition to consumers that some feature was worth the cost of breaking web encryption – but that’s not what happened here.

What about the question of "unfair"? Apparently, the FTC prefers to use "unfair" in the cases it brings, rather than deceptive, so that is the more likely option.

In order to be “unfair” under Section 5, a business practice has to meet three criteria – it must:

1. Cause significant consumer harm,
2. Not be reasonably avoidable by consumers, and
3. Not be offset by countervailing benefits to consumers.

If breaking encryption exposes consumers to significant security vulnerabilities, regulators will likely have a very strong case for an unfairness violation.

On causing significant harm, this seems fairly straightforward in Lenovo’s case: its partner Superfish configured its software to intercept all SSL requests — using the same decryption key across all devices. This key was easily reverse engineered soon after the story broke, meaning that any malicious attacker could use this key to intercept any encrypted communication. That’s a huge security vulnerability, and at least as concerning as several other vulnerabilities that the FTC has previously alleged to have harmed consumers. Gogo’s SSL interception also raised security concerns — it arguably inures users to security warnings and exposes them to attackers posing as Gogo’s network — but the risk is probably not as great as in the Lenovo case. The FTC has brought actions against device manufacturers in the past for weakening security; in its case against phone manufacturer HTC, the FTC alleged that badly designed software that let app developers piggyback on HTC’s access to certain phone functionality without user permission was an unfair business practice.

On the second part of the unfairness test, it’s hard to argue how these practices are avoidable by ordinary consumers. They may have clicked though legalistic agreements, but as far as we can tell, none of these documents made any disclosure about these sorts of tactics — or the vulnerabilities to which they exposed consumers. Certainly, neither Gogo nor Lenovo presented information outside of a legal document where consumers were likely to notice. As a result, consumers weren’t provided with actionable information that they could have used to avoid these problems.

Finally, it’s hard to see that the security vulnerabilities introduced by SSL-interception were outweighed by any benefits to the practice. Gogo used this tactic to block bandwidth-heavy video applications on planes with limited internet access — a worthy goal, but one better accomplished through less destructive means. Lenovo allowed its partner to break encryption in order to view private communications for targeted advertising.  It is doubtful that many consumers would find this trade-off beneficial, even if it lowered prices significantly; in any event, Lenovo claims that they didn’t make much money from its deal with Superfish, and the pre-installed adware was simply designed to improve the user experience. Since exposure of these practices, both companies have backtracked and ended use of the encryption-breaking technologies.

But there's a much bigger question: will the FTC actually bother? The fact that Lenovo reacted pretty quickly to this mess probably suggests that the FTC may not bother. Yes, Lenovo's initial reaction wasn't great, but it did change its tune within less than 48 hours, and has been pretty vocal and active in apologizing and fixing things since then. That may be enough reason for the FTC to think it's not necessary to go after the company. Of course, it may feel differently about Superfish itself -- since that company still denies there's any problem and basically refuses to admit its role in this whole mess. It's still standing by its bogus statement that it did nothing wrong and claiming that Lenovo will clear things up -- even as Lenovo has clearly said otherwise.

Filed Under: deceptive, ftc, https, malware, man in the middle, section 5, unfair
Companies: komodia, lenovo, superfish

School Administrator Accused Of Child Porn Because He Investigated Sexting At School

from the just-sad dept

There have been a lot of stories recently about the rise of "sexting" (kids sending naked photos of themselves via mobile phones) and how its leading to child porn charges. It's quite clear that this is an overreaction to the law. Kids definitely need to be educated about doing such things, but charging them with child pornography is highly questionable. Even more ridiculous is the idea of slapping recipients of such photos with child pornography charges, even if they didn't request the images. This is just one problem (of many) with current child pornography laws. Since possession alone is considered a crime, if you want to make someone guilty of a crime, you just need to send them illegal photos.

That leads to even more ridiculous situations, like the story in Wired about an assistant principal, Ting-Yi Oei, at a high school in Virginia. After rumors were spreading about "sexting" happening at the school, he was asked by the principal to investigate. In the course of the investigation, a male student showed him a photo he had received of the torso of a woman wearing a bra and covering her breasts with her arms. The principal told Oei to preserve a copy of the image. Not being very computer literate, he asked the student with the photo how to get a copy himself. The student sent it to Oei's phone and told him how to email it to his own computer, which Oei did. After investigating the matter, Oei did not believe the student in the photo went to the school, and informed the principal about everything.

Later, due to a variety of other events, the original student who had the photo was suspended. In anger, his mother called the police, telling them about the photo, which resulted in the police investigating Oei... and charging him with "failure to report suspicion of child abuse." Of course, he had reported everything to the principal (what was legally required) and it wasn't clear that there was actually any child abuse. And, finally, the fact that he couldn't identify the student meant that he had no way of actually reporting who was abused.

But, rather than drop the charges, prosecutors kept on going. They added more charges, including possession of child porn (a felony, rather than the misdemeanor) and then later adding charges of "contributing to the delinquency of a minor" for asking the original student to send him the photo (which, remember, the principal had told him to archive).

Oei's name was all over the news, accused of child pornography. He was stripped of his job since he couldn't be seen at the school around students. He had to raise money to fight the charges and is now in tremendous debt. Last week, a court finally tossed out the charges, noting that the photo itself isn't even pornographic (let alone all the other problems with the lawsuit).

Child porn is a very real and very serious issue that needs to be dealt with. But we seem to have put together a set of laws that allow for massive reputation-destroying witch hunts, rather than actually tackling the real issues. This story should horrify anyone who thinks that current child porn laws make sense.

Filed Under: investigation, unfair

National Consumer Council Notices That EULAs Are Unfair

from the you-just-noticed? dept

This seems rather obvious at this point, but the National Consumer Council in the UK has released a report pointing out that software end-user license agreements (EULAs) are unfair. The problems with EULAs have been widely discussed before. They're generally dense and full of legal language, so that users have no idea what they're agreeing to. They're non-negotiable, so it's not like a standard contract either. Often people need to agree to them before they can even read all the terms ("by opening his package, you have agreed to..."). The end result, of course, is that no one reads them. If you did, you would probably never agree to what they said anyway. So, while this is nothing new, it's nice to see consumer protection groups shining a light on how EULAs are very often unfair.

Filed Under: eulas, national consumer council, unfair