Tapplock is a Canadian company based in Ontario that sells smart locks. These locks are able to be lock and unlocked via bluetooth and consumers are able to give and resend access to these locks to any number of people. Tapplock also claims that their locks are unbreakable.
In May of 2020 the FTC filed a complaint against Tapplock, the makers of smartlock, alleging that they mislead customers when they told their customers that their locks were unbreakable and that their data was secure. The FTC alleged that the locks were in fact not secure and that the company failed to take part in industry standard practice to protect the data of their customers. When security researchers looked into the locks they found that they had both physical and electronic vulnerabilities. The FTC also alleged that the company did not have in place any security program or take any steps in detecting potential vulnerabilities.
In a 5 to 0 vote to commission voted to finalize the settlement between the FTC and Smartlock. Under this settlement Smartlock is required to implement a comprehensive security program and to not mislead their clients on how secure their product is. As part of the settlement Smartlock must have biannual third party assessments of their cyber security and must certify their compliance annually.
The FTC filing against Smartlock is similar to that of the FTC filing of Wyndham. In both instances the companies did not have any basic securities in place. In the case of Wyndham they were held liable for not having any defenses and in the case of Smartlock all it took to bypass their lock was a screw driver and a couple of seconds.
Sources
“FTC Gives Final Approval to Settlement with Smart Lock Maker.” Federal Trade Commission, 20 May 2020, http://www.ftc.gov/news-events/press-releases/2020/05/ftc-gives-final-approval-settlement-smart-lock-maker.
By Preston Sulfstede
RIT Cyber Security Policy and Law Class Blog 