Notice2021-19388
Support King, LLC (SpyFone.com); Analysis of Proposed Consent Order To Aid Public Comment
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 8, 2021
Issuing agencies
Federal Trade Commission
Abstract
The consent agreement in this matter settles alleged violations of federal law prohibiting unfair or deceptive acts or practices. The attached Analysis of Proposed Consent Order to Aid Public Comment describes both the allegations in the draft complaint and the terms of the consent order--embodied in the consent agreement-- that would settle these allegations.
Full Text
<html>
<head>
<title>Federal Register, Volume 86 Issue 171 (Wednesday, September 8, 2021)</title>
</head>
<body><pre>
[Federal Register Volume 86, Number 171 (Wednesday, September 8, 2021)]
[Notices]
[Pages 50357-50359]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2021-19388]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
[File No. 192 3003]
Support King, LLC (<a href="http://SpyFone.com">SpyFone.com</a>); Analysis of Proposed Consent
Order To Aid Public Comment
AGENCY: Federal Trade Commission.
ACTION: Proposed consent agreement; request for comment.
-----------------------------------------------------------------------
SUMMARY: The consent agreement in this matter settles alleged
violations of federal law prohibiting unfair or deceptive acts or
practices. The attached Analysis of Proposed Consent Order to Aid
Public Comment describes both the allegations in the draft complaint
and the terms of the consent order--embodied in the consent agreement--
that would settle these allegations.
DATES: Comments must be received on or before October 8, 2021.
ADDRESSES: Interested parties may file comments online or on paper by
following the instructions in the Request for Comment part of the
SUPPLEMENTARY INFORMATION section below. Please write ``Support King,
LLC (<a href="http://SpyFone.com">SpyFone.com</a>); File No. 192 3003'' on your comment, and file your
comment online at <a href="https://www.regulations.gov">https://www.regulations.gov</a> by following the
instructions on the web-based form. If you prefer to file your comment
on paper, mail your comment to the following address: Federal Trade
Commission, Office of the Secretary,
[[Page 50358]]
600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D), Washington, DC
20580, or deliver your comment to the following address: Federal Trade
Commission, Office of the Secretary, Constitution Center, 400 7th
Street SW, 5th Floor, Suite 5610 (Annex D), Washington, DC 20024.
FOR FURTHER INFORMATION CONTACT: Thomas B. Carter (214-979-9372),
Federal Trade Commission, Southwest Regional Office, 199 Bryan Street,
Suite 2150, Dallas, TX 75201.
SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule 2.34, 16 CFR 2.34,
notice is hereby given that the above-captioned consent agreement
containing a consent order to cease and desist, having been filed with
and accepted, subject to final approval, by the Commission, has been
placed on the public record for a period of thirty (30) days. The
following Analysis to Aid Public Comment describes the terms of the
consent agreement and the allegations in the complaint. An electronic
copy of the full text of the consent agreement package can be obtained
at <a href="https://www.ftc.gov/news-events/commission-actions">https://www.ftc.gov/news-events/commission-actions</a>.
You can file a comment online or on paper. For the Commission to
consider your comment, we must receive it on or before October 8, 2021.
Write ``Support King, LLC (<a href="http://SpyFone.com">SpyFone.com</a>); File No. 192 3003'' on your
comment. Your comment--including your name and your state--will be
placed on the public record of this proceeding, including, to the
extent practicable, on the <a href="https://www.regulations.gov">https://www.regulations.gov</a> website.
Due to the COVID-19 pandemic and the agency's heightened security
screening, postal mail addressed to the Commission will be subject to
delay. We strongly encourage you to submit your comments online through
the <a href="https://www.regulations.gov">https://www.regulations.gov</a> website.
If you prefer to file your comment on paper, write ``Support King,
LLC (<a href="http://SpyFone.com">SpyFone.com</a>); File No. 192 3003'' on your comment and on the
envelope, and mail your comment to the following address: Federal Trade
Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite
CC-5610 (Annex D), Washington, DC 20580. If possible, submit your paper
comment to the Commission by overnight service.
Because your comment will be placed on the publicly accessible
website at <a href="https://www.regulations.gov">https://www.regulations.gov</a>, you are solely responsible for
making sure your comment does not include any sensitive or confidential
information. In particular, your comment should not include sensitive
personal information, such as your or anyone else's Social Security
number; date of birth; driver's license number or other state
identification number, or foreign country equivalent; passport number;
financial account number; or credit or debit card number. You are also
solely responsible for making sure your comment does not include
sensitive health information, such as medical records or other
individually identifiable health information. In addition, your comment
should not include any ``trade secret or any commercial or financial
information which . . . is privileged or confidential''--as provided by
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2),
16 CFR 4.10(a)(2)--including in particular competitively sensitive
information such as costs, sales statistics, inventories, formulas,
patterns, devices, manufacturing processes, or customer names.
Comments containing material for which confidential treatment is
requested must be filed in paper form, must be clearly labeled
``Confidential,'' and must comply with FTC Rule 4.9(c). In particular,
the written request for confidential treatment that accompanies the
comment must include the factual and legal basis for the request, and
must identify the specific portions of the comment to be withheld from
the public record. See FTC Rule 4.9(c). Your comment will be kept
confidential only if the General Counsel grants your request in
accordance with the law and the public interest. Once your comment has
been posted on the <a href="https://www.regulations.gov">https://www.regulations.gov</a> website--as legally
required by FTC Rule 4.9(b)--we cannot redact or remove your comment
from that website, unless you submit a confidentiality request that
meets the requirements for such treatment under FTC Rule 4.9(c), and
the General Counsel grants that request.
Visit the FTC website at <a href="http://www.ftc.gov">http://www.ftc.gov</a> to read this Notice and
the news release describing the proposed settlement. The FTC Act and
other laws that the Commission administers permit the collection of
public comments to consider and use in this proceeding, as appropriate.
The Commission will consider all timely and responsive public comments
that it receives on or before October 8, 2021. For information on the
Commission's privacy policy, including routine uses permitted by the
Privacy Act, see <a href="https://www.ftc.gov/site-information/privacy-policy">https://www.ftc.gov/site-information/privacy-policy</a>.
Analysis of Proposed Consent Order To Aid Public Comment
The Federal Trade Commission (``Commission'') has accepted, subject
to final approval, an agreement containing a consent order from Support
King, LLC, formerly d/b/a <a href="http://SpyFone.com">SpyFone.com</a> (``Corporate Respondent''), and
Scott Zuckerman (``Individual Respondent'') (collectively,
``Respondents'').
The Commission has placed the proposed consent order (``Proposed
Order'') on the public record for thirty (30) days for receipt of
comments by interested persons. Comments received during this period
will become part of the public record. After thirty (30) days, the
Commission again will review the agreement and the comments received,
and will decide whether it should withdraw from the agreement or make
final the agreement's Proposed Order.
Support King has sold various monitoring products and services,
each of which allowed a purchaser to monitor surreptitiously another
person's activities on that person's mobile device. Scott Zuckerman is
the president, founder, resident agent, and chief executive of Support
King. Individually or in concert with others, Mr. Zuckerman controlled
or had the authority to control, or participated in the acts and
practices alleged in the proposed complaint.
Respondents' monitoring products and services included SpyFone for
Android Basic, Premium, Xtreme, and Xpress. These monitoring products
and services had varying capabilities and costs. Purchasers of these
products had to take steps to bypass numerous restrictions implemented
by the operating system or the mobile device manufacturer on the
monitored mobile device during installation. To enable certain
functions of the monitoring products and services, purchasers had to
gain administrative privileges, exposing mobile devices to various
security vulnerabilities.
All of Respondents' monitoring products and services required that
the purchaser have physical access to the device user's mobile device
for installation, and then the purchaser could remotely monitor the
device user's activities from an online dashboard. Once installed, the
monitoring products and services ran surreptitiously, meaning that the
device user was unaware that he or she was being monitored. The SpyFone
software would then only be found by navigating through the device's
``Settings,'' where, according to SpyFone's website, it is labeled as
``System Service'' in order ``to be more stealthy[.]''
[[Page 50359]]
Device users surreptitiously monitored by Respondents' monitoring
products and services could not uninstall or remove Respondents'
monitoring products and services because they did not know that they
were being monitored. Device users often had no way of knowing that
Respondents' monitoring products and services were being used on their
phones. Respondents did not take any steps to ensure that purchasers
would use Respondents' monitoring products and services for legitimate
purposes.
Moreover, Respondents did not take steps to secure the personal
information collected from device users being monitored despite
stating, ``SpyFone cares about the integrity and security of your
personal information. We will take all reasonable precautions to
safeguard customer information, including but not limited to contact
information, personally identifiable information (PII), and payment
details,'' and ``SpyFone uses its databases to store your encrypted
personal information.'' Respondents engaged in a number of practices
that, taken together, failed to provide reasonable data security to
protect the personal information collected from device users.
As a result of these unreasonable data security practices, in
August 2018, an unauthorized third party accessed Respondents' server,
gaining access to the data of approximately 2,200 consumers.
Respondents then disseminated a notice to purchasers following the
unauthorized access, representing that Respondents had ``partner[ed]
with leading data security firms to assist in our investigation'' and
that they would ``coordinate with law enforcement authorities'' on the
matter. In reality, Respondents did not partner with any data security
firms or coordinate with law enforcement authorities.
The Commission's proposed three-count complaint alleges that
Respondents violated Section 5(a) of the Federal Trade Commission Act.
The first count alleges that Respondents unfairly sell or have sold
monitoring products and services that operate surreptitiously on mobile
devices without taking reasonable steps to ensure that the purchasers
use the monitoring products and services only for legitimate and lawful
purposes.
The second count alleges Respondents deceived consumers about
Respondents' data security practices by falsely representing that it
would take all reasonable precautions to safeguard customer
information, including by using their database to store consumers'
personal information encrypted. Respondents failed to implement
appropriate security procedures to protect the personal information
they collected from consumers, such as by: (1) Failing to encrypt
personal information stored on Respondents' server; (2) failing to
ensure access to Respondents' server was properly configured so that
only authorized users could access consumers' personal information; (3)
failing to adequately assess and address vulnerabilities of its
Application Programing Interfaces (APIs); (4) transmitting purchasers'
passwords for their SpyFone accounts in plain text; and (5) failing to
contractually require its service provider to adopt and implement data
security standards, policies, procedures or practices.
The third count alleges Respondents deceived consumers about
Respondents' data breach response, when Respondents stated they were
partnering with leading data security firms to investigate the data
breach and coordinating with law enforcement authorities, when in fact
Respondents did not.
The Proposed Order contains provisions designed to prevent
Respondents from engaging in the same or similar acts or practices in
the future.
Part I of the Proposed Order requires Respondents to disable
immediately all access to any information collected through a monitored
mobile device, and immediately to cease collection of any data through
any monitoring software. Part II requires that within 30 days of the
entry of the Proposed Order, Respondents must delete all consumer data
collected.
Part III of the Proposed Order requires Respondents to provide
notice on all of Support King's websites, and to provide notice through
emails to purchasers and trial users, stating that the FTC alleged
Support King sold illegal monitoring products and services, that
Support King agreed to disable the software, and that Respondents'
previous notice of June 2020 was inaccurate. Respondents must also
provide notice to each user of a monitored device, through an on-screen
notification, informing the user that Support King collected
information from his or her phone, and that the phone may not be
secure.
Part IV of the Proposed Order bans Respondents from licensing,
advertising, marketing, promoting, distributing, selling, or assisting
in any of the former, any monitoring product or service to consumers.
Part V of the Proposed Order prohibits Respondents from making any
misrepresentations about the extent to which Respondents work with
privacy or security firms, or the extent to which Respondents maintain
and protect the privacy, security, confidentiality, and integrity of
personal information. Part VI of the Proposed Order prohibits Corporate
Respondent, and any Covered Business (any business controlled, directly
or indirectly, by either Corporate Respondent or Individual Respondent)
from transferring, selling, sharing, collecting, maintaining, or
storing personal information unless it establishes and implements, and
thereafter maintains, a comprehensive information security program that
protects the security, confidentiality, and integrity of such personal
information.
Part VII requires Respondents to obtain initial and biennial data
security assessments for twenty years for any Covered Business that
collects personal information online. Part VIII of the Proposed Order
requires Respondents to disclose all material facts to the assessor and
prohibits Respondents from misrepresenting any fact material to the
assessments required by Part VII.
Part IX requires Respondents to submit an annual certification from
a senior corporate manager (or senior officer responsible for its
information security program), that Respondents have implemented the
requirements of the Proposed Order, are not aware of any material
noncompliance that has not been corrected or disclosed to the
Commission, and includes a brief description of any covered incident
involving unauthorized access to or acquisition of personal
information. Part X requires Respondents to submit a report to the
Commission following their discovery of any covered incident.
Parts XI through XIV of the Proposed Order are reporting and
compliance provisions, which include recordkeeping requirements and
provisions requiring Respondents to provide information or documents
necessary for the Commission to monitor compliance. Part XV states that
the Proposed Order will remain in effect for twenty (20) years, with
certain exceptions.
The purpose of this analysis is to aid public comment on the
Proposed Order. It is not intended to constitute an official
interpretation of the complaint or Proposed Order, or to modify in any
way the Proposed Order's terms.
By direction of the Commission.
April J. Tabor,
Secretary.
[FR Doc. 2021-19388 Filed 9-7-21; 8:45 am]
BILLING CODE 6750-01-P
</pre></body>
</html>Indexed from Federal Register on September 8, 2021.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.