## Facts

- TRENDnet, Inc. sold Internet-connected “SecurView” IP cameras for remote monitoring of private areas in homes and workplaces.
- TRENDnet advertised that the cameras provided secure remote viewing and, by default, were supposed to restrict access to authorized users with login credentials.
- Security vulnerabilities in TRENDnet’s software allowed unauthorized users to access certain live video streams without authentication, including by directly requesting a streaming endpoint on the camera.
- In early 2012, information enabling search and access to exposed feeds was indexed through a device-search service, increasing the number of publicly accessible camera feeds.
- Exposed live feeds showed sensitive activity inside private spaces, including infants and children in homes.
- TRENDnet learned of the vulnerability after a customer contacted technical support following public reporting.
- The FTC alleged TRENDnet failed to use reasonable security practices, including storing credentials in readable form, failing to test and remediate vulnerabilities, transmitting credentials and video in clear text, and lacking reasonable access controls and secure development practices.
- The matter resolved through a consent agreement, and the FTC issued a final Decision and Order rather than a litigated merits decision.

## Issues

1. Whether TRENDnet made materially false or misleading representations that its cameras and related software were secure, constituting deception under § 5(a) of the FTC Act.
2. Whether TRENDnet’s failure to implement reasonable and appropriate security for live feeds and related consumer information constituted an unfair practice under § 5(a) of the FTC Act.

## Decision

- The FTC issued a Decision and Order based on a consent agreement, concluding that the alleged conduct constituted violations of § 5(a) through deceptive security representations and unreasonable security practices.
- TRENDnet was prohibited from misrepresenting the security of its devices, software, and services, including the extent to which they protect consumer information and live feeds.
- TRENDnet was required to implement a comprehensive information-security program addressing risks of unauthorized access to personal information and camera feeds.
- TRENDnet was required to obtain independent, third-party security assessments on a recurring basis for a long-term compliance period.
- TRENDnet was required to provide notice and support to affected consumers, including security updates or other remedies.

## Legal Principles

- Under § 5(a) of the FTC Act, security-related marketing claims can be deceptive when a company represents that it took reasonable steps to secure consumer data or communications but failed to implement reasonable safeguards.
- Unreasonable data-security practices may constitute unfairness under § 5(a) when they cause or are likely to cause substantial consumer injury that consumers cannot reasonably avoid and that is not outweighed by countervailing benefits.
- Exposure of sensitive in-home video and related access credentials can constitute cognizable consumer injury even without direct financial loss.
- FTC data-security remedies commonly include (i) a written security program, (ii) ongoing risk assessment and controls, (iii) independent assessments, and (iv) restrictions on future security representations.

## Conclusion

The FTC’s consent order treated TRENDnet’s “secure” camera marketing claims and its deficient safeguards as deceptive and unfair under § 5(a), and imposed long-term compliance duties centered on security governance, independent assessments, consumer notice, and limits on future security statements.


In re TRENDnet, Inc., F.T.C. File No. 122-3090 (2014)