Privacy & Information Security Law Blog

On February 22, 2013, the Federal Trade Commission announced that it had settled charges against HTC America, Inc. (“HTC”) alleging that the mobile device manufacturer “failed to take reasonable steps to secure the software it developed for its smartphones and tablet computers, introducing security flaws that placed sensitive information about millions of consumers at risk.” This settlement marks the FTC’s first case against a mobile device manufacturer.

According to the FTC’s complaint, HTC did not employ “reasonable and appropriate security in the design and customization of the software” on its mobile devices because the company failed to (1) provide its engineering staff with adequate security and privacy training, (2) audit and test the software on its mobile devices for potential security vulnerabilities, (3) adopt commonly accepted, secure programming practices, and (4) establish a process for receiving and addressing vulnerability reports from third parties.

In its complaint, the FTC alleged that, while customizing its Android-based mobile devices with pre-installed applications and components, HTC introduced a number of security vulnerabilities. For example, the complaint stated that HTC failed to include appropriate “permission check code” to protect its pre-installed applications from exploitation. HTC allegedly undermined the Android operating system’s “permission-based security model” by adding certain “permission re-delegation” vulnerabilities through custom, pre-installed apps that enabled applications that had permission to access sensitive information to grant other applications the same permission level without first requesting the user’s consent. This practice allegedly enabled any third-party application to command the relevant HTC applications to access sensitive information and sensitive device functionalities (e.g., the device’s microphone) on behalf of the third-party application.

Similarly, the complaint stated that third-party applications could command HTC’s pre-installed application to download additional applications from any server without the user’s knowledge or consent. The complaint indicated that HTC also placed sensitive information at risk by failing to use “readily-available and documented secure communications mechanisms in implementing logging applications on its devices.” In addition, the FTC asserted that HTC failed to deactivate the “debug code” before shipping out its devices to consumers. This failure caused sensitive information to be written to the system logs on HTC devices, making the data accessible to HTC and any third-party application with permission to read the logs. Given that the security vulnerabilities made the devices more susceptible to malware (which could be used to send or record users’ sensitive data without their knowledge or consent), the FTC alleged the vulnerabilities put consumers at risk of financial and physical injury and other harm.

The FTC’s complaint contained counts against HTC for: (1) unfair security practices (for HTC’s failure to employ reasonable and appropriate security practices in the design and customization of its device software), (2) false or misleading representations in HTC’s user manual (because third-party applications could access sensitive information without notifying or obtaining consent from users before installation, contrary to the representations), and (3) deceptive practices with respect to the Tell HTC application user interface (because location data was sent to HTC along with users’ error reports, even when users did not check the “Add location data” button in the Tell HTC user interface).

The FTC’s settlement agreement and consent order bars HTC from misrepresenting the extent to which it maintains and protects the security of the devices and the security, privacy, confidentiality and integrity of consumers’ sensitive information. The settlement also requires HTC to establish and implement a comprehensive information security program which will be assessed for compliance on a biennial basis for 20 years. In addition, HTC must develop, release and notify consumers about security patches to fix the security vulnerabilities on affected devices.

Read our previous posts regarding mobile apps.

Update: On July 2, 2013, the FTC approved the final settlement order with HTC.