`
`
`
`LAW OFFICE OF
`FRANCIS J. FLYNN, JR.
`Francis J. “Casey” Flynn, Jr., SBN
`304712
`422 S. Curson Avenue
`Los Angeles, California 90036
`Tele: 314-662-2836
`Email: casey@lawofficeflynn.com
`
`MORGAN & MORGAN
`COMPLEX LITIGATION GROUP
`John A. Yanchunis*
`201 N. Franklin Street, 7th Floor
`Tampa, Florida 33602
`Telephone: 813/223-5505
`Facsimile: (813) 223-5402
`jyanchunis@forthepeople.com
`
` to seek pro hac vice admission
`Attorneys for Plaintiff and the putative
`class
`
` *
`
`
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`CERNTRAL DISTRICT OF CALIFORNIA
`
`
`
`
`JOHN BAKER ORANGE on behalf of
`himself and all others similarly
`situated,
`
`
`
`
`
`CASE NO.:
`2:19-cv-10899
`
`CLASS ACTION
`
`COMPLAINT FOR DAMAGES,
`EQUITABLE, DECLARATORY,
`AND INJUNCTIVE RELIEF FOR:
`
`(1) NEGLIGENCE
`(2) INVASION OF PRIVACY
`(3) BREACH OF THE IMPLIED
`WARRANTY OF
`MERCHANTABILITY
`(4) BREACH OF IMPLIED
`CONTRACT
`(5) UNJUST ENRICHMENT
`(6) VIOLATION OF THE
`UNFAIR COMPETITION
`CLASS ACTION COMPLAINT
`
`1
`
`Plaintiff
`
`
`
`
`v.
`
`RING LLC and
`AMAZON.COM, INC.
`
`
`
`
`Defendant.
`__________
`
`
`
`
`
`
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 2 of 30 Page ID #:2
`
`
`
`
`
`LAW (“UCL”) CAL. BUS.
`PROF. CODE § 17200
`
`
`
`DEMAND FOR JURY TRIAL
`
`
`Plaintiff John Baker Orange (“Plaintiff”), individually, by and through his
`
`undersigned counsel, brings this class action lawsuit against Ring LLC and
`Amazon.com, Inc. (collectively, “Defendants,” or “Ring”), on behalf of himself and
`all others similarly situated, and alleges, based upon information and belief and the
`investigation of his counsel as follows:
`JURISDICTION AND VENUE
`1.
`This Court has subject matter jurisdiction over this action under the Class
`Action Fairness Act, 28 U.S.C. § 1332(d)(2) because (a) the aggregated claims of
`putative class members exceeds $5 million, exclusive of interest and costs; (b) there
`are at least hundreds of putative class members; and (c) at least one of the members of
`the putative class is a citizen of a different state than Defendants.
`2.
`This Court has personal
`jurisdiction over Defendants because
`Defendants, directly or through their agents, conduct business in the State of
`California and within this District.
` Specifically, Defendant Ring maintains
`headquarters in this District and operate in this District. Through their business
`operations in this District, Defendants intentionally avail themselves of the markets
`within this District to render the exercise of jurisdiction by this Court just and proper.
`3.
`Through its business operations in this District, Defendants intentionally
`availed themselves of the markets within this District and have sufficient minimum
`contacts with this State to render the exercise of jurisdiction by this Court just and
`proper.
`4.
`Venue is proper in this Court pursuant to 28 U.S.C. § 1391(a)(1) because
`a substantial part of the events and omissions giving rise to this action occurred in this
`
`
`
`
`
`
`
`2
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 3 of 30 Page ID #:3
`
`
`
`District and Ring is headquartered in this District.
`
`INTRODUCTION
`
`5.
`Ring is a security and safety company which manufactures, markets and
`sells alarms, video doorbells, security systems, and cameras. At its core, Ring’s
`products are designed to promote the safety of its customers and to protect their
`privacy.
`6. Wi-Fi cameras are among Ring’s most popular offerings. They are
`designed to be strategically placed throughout a property, enabling authorized users to
`see covered areas in high definition and to communicate directly with occupants via a
`two-way speaker-microphone system.
`7.
`Ring promises its customers “peace of mind” with its Wi-Fi enabled
`smart security systems. Unfortunately, Ring’s cameras fail to deliver on its most basic
`promise. Lax security standards and protocols render its camera systems vulnerable to
`cyber-attack. Indeed, over the past several months numerous Ring customers reported
`that their camera systems had been hacked by malicious third parties who gained
`access to the video and two-way speaker-microphone system which they used to
`invade the privacy of customers’ homes and terrorize unsuspecting occupants, many
`of whom are children.
`8. While Ring quickly attempted to distance itself from liability by blaming
`customers for failing to create strong security passwords, it is Ring who failed to
`provide sufficiently robust security measures such as two-factor authentication and
`other protocols necessary to maintain the integrity and inviolability of its cameras. As
`a result of Ring’s defective design, and its failure to imbue its Wi-Fi cameras with
`sufficient security protocols, its customers’ most basic privacy rights were violated
`along with the security and sanctity of their homes.
`9.
`Plaintiff, on behalf of all others similarly situated, alleges claims for
`negligence, invasion of privacy, breach of implied contract, breach of implied
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`3
`
`CLASS ACTION COMPLAINT
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 4 of 30 Page ID #:4
`
`
`
`warranty and unjust enrichment. In addition, Plaintiff seeks damages, injunctive and
`
`declaratory relief.
`
`PARTIES
`10. Plaintiff John Baker Orange is a resident of Jefferson County Alabama.
`He purchased a Ring outdoor camera for his house in July 2019 for approximately
`$249.00. The Ring camera was installed over his garage with a view of the driveway.
`Mr. Orange purchased the Ring camera to provide additional security for him and his
`family which include his wife and three children aged 7, 9, and 10. Recently, Mr.
`Orange’s children were playing basketball when a voice came on through the
`camera’s two-way speaker system. An unknown person engaged with Mr. Orange’s
`children commenting on their basketball play and encouraging them to get closer to
`the camera. Once Mr. Orange learned of the incident, he changed the password on the
`Ring camera and enabled two-factor authentication. Prior to changing his password,
`Mr. Orange protected his Ring camera with a medium-strong password.
`11. Prior to the recent hacking incidents, Mr. Orange was unaware of and
`believes that Ring did not provide users the ability to secure their systems with two-
`factor authentication.
`12. Defendant Ring LLC is a home security and smart home company that
`manufactures a range of home security products including Wi-Fi enabled smart
`cameras. Ring LLC is a wholly owned subsidiary of Amazon.com with its place of
`business located at 1523 26th St, Santa Monica, California 90404.
`13. Defendant Amazon.com Inc. is a Delaware corporation headquartered at
`410 Terry Avenue North Seattle, Washington 98109-5210. Ring was acquired by
`Amazon in February 2018 for an estimated value of between $1.2 billion and $1.8
`billion.
`
`JURISDICTION AND VENUE
`14. This Court has subject matter jurisdiction over this action under the Class
`
`
`
`
`
`
`
`4
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 5 of 30 Page ID #:5
`
`
`
`Action Fairness Act, 28 U.S.C. § 1332(d)(2). The amount in controversy exceeds $5
`
`million, exclusive of interest and costs. There are thousands of putative class
`members, and at least some of whom have a different citizenship from Defendants.
`15. This Court has jurisdiction over the Defendants which operate in this
`District. Through their business operations in this District, Defendants intentionally
`avail themselves of the markets within this District to render the exercise of
`jurisdiction by this Court just and proper.
`16. Venue is proper in this Court pursuant to 28 U.S.C. § 1391(a)(1) because
`a substantial part of the events and omissions giving rise to this action occurred in this
`District and Ring is headquartered in this District.
`STATEMENT OF FACTS
`A. Ring Products and Wi-Fi Connectivity
`17. Ring offers a variety of Wi-Fi enabled security and safety devices, most
`notably video doorbells and cameras. The Ring video doorbell is the company’s
`flagship product. It is a smart doorbell that contains a high-definition camera, a
`motion sensor, a microphone and speaker for two-way audio communication. It
`integrates with an associated mobile app, which allows users to view real-time video
`from the camera, receive notifications when the doorbell is rung, and communicate
`with visitors at the door via the integrated speaker.
`18.
`In 2015, Ring released the first of its internal wireless IP cameras. Like
`the video doorbell, the cameras provide high definition video and microphone-speaker
`functionality for two-way communication. Since 2015, Ring has expanded its
`selection to include a range of indoor and outdoor cameras, each with video and two-
`way audio communication. 1
`19. Ring products are designed to operate through a users’ Wi-Fi network.
`
`1 https://support.ring.com/hc/en-us/sections/360006380112-Indoor-Cam
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`5
`
`CLASS ACTION COMPLAINT
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 6 of 30 Page ID #:6
`
`
`
`Once connected, the cameras enable users to see a high definition video stream in the
`
`camera’s range and listen to and/or communicate with nearby occupants.
`20. Creating a Ring account to fully enable the system involves a 4 step
`process: (1) download the Ring App; (2) Launch the app and click on the Setup
`Device button; (3) Create an Account at the bottom of the screen; (4) Enter your first
`and last name, email address and password.
`21. Ring cameras are relatively affordable, easy to install, simple to use, and
`heavily marketed by Amazon, making them one of the best-selling home security and
`surveillance devices on the market.
`22.
`In addition to their own direct-to-consumer marketing efforts, Ring has
`signed partnership agreements with hundreds of police departments around the
`country, many of which have marketed and sold Ring devices on the company’s
`behalf.
`23. Ring promises its customers “peace of mind” with “smart security here,
`there, everywhere.”2
`At the core of Ring, and guiding every action we take, is respect
`for the privacy and security of our neighbors (what we call our
`customers). This includes giving our neighbors effective, easy-
`to-use and affordable products and services to help protect their
`homes. It also means taking extremely seriously the privacy,
`security and control of their devices and personal information.
`Below you will find Ring’s guiding principles.
`
`We know you have many options to choose from so protecting
`your privacy and data security is a job we take seriously. We
`know that you place a huge amount of trust in us and we have
`every intention of continuing to earn that trust. 3
`
`
`
`
`2 https://shop.ring.com/pages/security-cameras
`3 https://shop.ring.com/pages/privacy
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`6
`
`CLASS ACTION COMPLAINT
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 7 of 30 Page ID #:7
`
`
`
`24. Unfortunately, Ring does not fulfill its core promise of providing privacy
`
`and security for its customers, as its camera systems are fatally flawed. The Ring
`system is Wi-Fi enabled, meaning that it will not work without internet connectivity.
`Once connected, however, any internet device can be seen by the on-line community,
`making it incumbent upon its manufacturer to design the device such that it can be
`properly secured for only intended use. This obligation is even more critical in
`instances where the device, like the Ring camera, is related to the safety and security
`of person and property.
`25. Ring failed to meet this most basic obligation by not ensuring its Wi-Fi
`enabled cameras were protected against cyber-attack. Notably, Ring only required
`users enter a basic password and did not offer or did not compel two-factor
`authentication.
`26. Dual factor or two-factor authentication (“2FA”) is a security process in
`which the user provides two different authentication factors to verify themselves to
`better protect both the user’s credentials and the resources the user can access. 2FA
`provides a higher level of assurance than authentication methods that depend on
`single-factor authentication, in which the user provides only one factor -- typically a
`password. 2FA adds an additional layer of security to the authentication process by
`making it harder for attackers to gain access to a person’s devices or online accounts,
`because knowing the victim’s password alone is not enough to pass the authentication
`check. Two-factor authentication has long been used to control access to sensitive
`systems and data, and online service providers are increasingly using 2FA to protect
`their users’ credentials from being used by hackers who have stolen a password
`database or used phishing campaigns to obtain user passwords.4
`27. Ring was certainly aware of the infirmity of its cameras and the necessity
`
`4 https://searchsecurity.techtarget.com/definition/two-factor-authentication
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`7
`
`CLASS ACTION COMPLAINT
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 8 of 30 Page ID #:8
`
`
`
`to employ good security practices which included, at a minimum, insistence on robust
`
`passwords and dual factor authentication.
`B. Hacking Incidents
`28. Over the past several weeks, news media has been inundated with reports
`of hackers gaining unauthorized access to homes across the country via insecure Ring
`devices. Once in, hackers routinely terrorizing occupants, invade their privacy and
`undermine their sense of safety and security. While the dramatic nature of these
`hacking incidents, which involved interactions between the hackers and occupants of
`the home, many of whom were children, caught the attention of mainstream media,
`the insecurity of the cameras poses an additional and more looming threat. Hackers
`who choose not to interact with occupants have gone unnoticed for days, month and
`even years during which time they spied on occupants and their homes, gathering an
`array of private which can subsequently be sold and used for a host of nefarious
`purposes:
`(a) Mississippi Incident
`
`Pedophile Hacker Hacked 8yo Girl’s Room – Told Her That
`He Is Santa Claus
`
`
`
`Parents will do anything to keep their child safe. This includes
`installing a CCTV inside the child’s room so that they can monitor
`their child while at work. However, for a couple in US, this move has
`caused their 8-year-old daughter to be harassed by a hacker.
`The mother, Ashley LeMay told CNN that she installed the camera
`so that she could make sure that they are OK while she’s at the
`overnight shift but four days after the camera was installed, a hacker
`managed to get through the system.
`From the CCTV footage, it can be seen that their daughter went into
`her room after hearing song being played from inside her room.
`Alyssa went on to ask who was playing the song and a voice came
`through the speaker of the camera. He said, “I’m your best friend.
`
`
`
`
`
`
`
`8
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 9 of 30 Page ID #:9
`
`I’m Santa Claus. Don’t you want to be my best friend?”
`
`When the couple’s 8-year-old daughter, Alyssa, checked on the
`music and turned on the lights, a man started speaking to her,
`repeatedly calling her a racial slur and saying he was Santa Claus.
`She screamed for her mother. 5
`
`“She won’t even sleep in her room,” Ms. LeMay said on Saturday.
`“She actually spent the night with a friend the other night because
`she didn’t want to be here.” “I did a lot of research on these before I
`got them. You know, I really felt like it was safe,”
`
` A big part of Ring's marketing strategy revolves around making
`customers feel like their own homes are unsafe, so that they’ll turn
`to surveillance devices to ease those fears. 6
`
`(b) Waterbury, Connecticut Incident
`
`Ed Slaughter told NBC Connecticut last week that he felt
`“violated” after a hacker started yelling obscenities and woke up
`his mother-in-law, who had been sleeping in the basement where
`he had installed a Ring camera. 7
`(c) Cape Coral, Florida Incident
`
`Josefine Brown told NBC 2 that she was frightened by an
`episode in which a hacker could be heard in footage from a Ring
`security camera provided to the station asking the interracial
`couple if their son was a “baboon.”
`
`In an email on Sunday, Ms. Brown said: “We are very
`
`5 How Hackers Are Breaking Into Ring Cameras, Vice, December 11, 2009,
`https://www.vice.com/en_us/article/3a88k5/how-hackers-are-breaking-into-ring-
`cameras
`6 https://www.worldofbuzz.com/pedophile-hacker-hacked-8yo-girls-room-cctv-in-the-
`us-told-her-that-he-is-santa-claus/ (December 15, 2019)
`7 Somebody’s Watching: Hackers Breach Ring Home Security Cameras, NY Times,
`December 15, 2019, https://www.nytimes.com/2019/12/15/us/Hacked-ring-home-
`security-cameras.html.
`
`
`
`
`
`
`
`
`9
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 10 of 30 Page ID #:10
`
`
`
`
`concerned about our safety and privacy because we thought
`having a security camera will keep us safe. We don’t know how
`long someone has been watching us. It is very scary.” Id.
`(d) Staten Island, New York Incident
`Gina Scarlato’s 13-year-old son, was terrorized by a hacker
`who followed the boy from camera to camera throughout
`the house. 8
`(e) North Texas Incident
` “The first thing that they heard was like a siren that went
`off,” said Lue Mayora of Forney. Wednesday night, while
`Mayora and her husband were coming home from work,
`someone hacked into their Ring cameras.
`They were shouting profanities, racial slurs and threats at their
`9-year-old and 11-year-old children who they said ran out of
`the house in terror.
`“I heard real, real screaming and I came out and said what’s
`going on,” Mayora’s neighbor Johnny Davila said. “They said
`someone is in house yelling they’re going to kill us.”
`Mayora’s neighbor got his gun and ran next door thinking
`someone was inside the home.
`As he heard the voice coming from the camera, he eventually
`realized it had been hacked.
`“It made me so mad that they’re targeting our kids,” he said.
`“They don’t want to sleep by themselves,” Mayora said.
`“They don’t want to be in the house.” Mayora has now
`deactivated her Ring cameras and said she will be getting rid
`
`
`8 Staten Island Family’s Ring Camera Hacked, CBS News NY, December 14, 2019,
`https://newyork.cbslocal.com/video/4236747-staten-island-familys-ring-camera-
`hacked/
`
`
`
`
`
`
`
`10
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 11 of 30 Page ID #:11
`
`
`
`
`of them this weekend.9
`(f) Georgia Incident
`A Georgia woman was given a terrifying wake-up call by a
`man who hacked into her Ring security camera and began
`speaking to her in the middle of the night.
`The woman was in bed when an unidentified man called to
`her through the camera, which she and her boyfriend
`installed to keep an eye on their new puppy, Beau, during
`working hours.
`In footage of the encounter, which a friend of the woman's
`shared on Twitter, the stranger can be heard clapping, calling
`to the puppy and telling the woman to “wake up!”
`“Hello? Hello? Come here, puppy,” he shouts.
`“Hello? Hello?” he says after multiple ignored commands. “I
`can see you in the bed, come on, wake the f*** up.” 10
`(g) Texas Incident
` Ring hackers demand $350,000 in Bitcoin from Texas
` Couple
`
`
` One of the most bizarre recent reports comes from Grand
`Prairie, Texas, where a couple says they awoke in the middle
`of the night to an alarm coming from their Ring camera. But
`that’s not all they heard; After the couple came to investigate,
`a voice over the Ring’s built-in speaker claimed that the
`couple’s Ring account had been terminated, and that they
`themselves would be “terminated” if they didn’t fork over a
`hefty haul of cryptocurrency.
`
`9 North Texas Family Furious After Ring Camera Hacker Terrorizes Their Children,
`https://texasbreakingnews.com/breaking/texas-family-furious-ring-camera-hacker-
`terrorizes-children/
`10 Yahoo, December 13, 2019, https://www.yahoo.com/now/woman-horrified-as-
`stranger-wakes-her-through-ring-security-camera-200838818.html
`
`
`
`
`
`
`
`11
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 12 of 30 Page ID #:12
`
`
`The “hackers” demanded a whopping 50 bitcoins. Going by
`the current conversion rate, that’s over $350,000.
`
` * * *
`[W]hat makes this whole thing scary is that they also gained
`control over the home’s Ring doorbell. They used their
`access to the doorbell to spoof their presence outside of the
`couple’s home, making
`the homeowners believe
`that
`someone was actually stalking
`their property while
`demanding the ransom.11
`C. Ring’s Response
`29.
`In response to the swath of hacking incidents across the country, Ring
`said only that it takes the security of its devices seriously, and then proceeded to
`blame Ring users for the hacking.
`“Our security team has investigated this incident and we have no
`evidence of an unauthorized intrusion or compromise of Ring’s
`systems or network,” the statement said. “Recently, we were
`made aware of an incident where malicious actors obtained
`some Ring users’ account credentials (e.g., username and
`password) from a separate, external, non-Ring service and
`reused them to log in to some Ring accounts.”12
`30. According
`to Ring,
`the hacked cameras were accessed when
`unauthorized third parties were able to login as authentic users with a proper
`password. Ring places the blame squarely on its customers suggesting these hacks are
`possible because people are using weak passwords that have previously been
`
`
`11 Ring hackers demand $350,000 in Bitcoin from Texas couple, but something so
`simple ruined their plot, BGR, December 12, 2019, https://bgr.com/2019/12/12/ring-
`hackers-texas-bitcoin-privacy-security/
`12 Somebody’s Watching: Hackers Breach Ring Home Security Cameras, NY Times,
`December 15, 2019
`
`
`
`
`
`
`
`12
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 13 of 30 Page ID #:13
`
`
`compromised.13
`
`31. By so doing, however, Ring ignores the fact that it allows its products –
`whose very purpose is to provide customers with safety and security – to be setup in a
`manner that makes it unreasonably susceptible to hacking.
`32. Although Ring is in the business of home security and was certainly
`aware that its Wi-Fi enabled product, was vulnerable to attack, it took no steps to
`“require camera owners to use two-factor authentication, which could help prevent
`these types of attacks…”14 Moreover, it knew, or should have known, in an era of
`pervasive data breaches, that logging in with user emails instead of unique account
`names, and not requiring at least 2FA, put its Wi-Fi enabled product at an
`unreasonable risk of being compromised.
`33. Not only was Ring aware that its cameras were inadequately secured, it
`was also aware of the existence of “online forums where hackers discussed how to
`break into Ring accounts connected to the cameras.” 15
`34. According to Motherboard,
`Ring was aware that the hacking community developed
`dedicated software for breaking into Ring security cameras. 16
`Indeed, several posts on different crime forums where hackers
`discuss creating tools for breaking into the Ring accounts which
`are connected to cameras.
`
`https://www.theguardian.com/technology/2019/dec/13/ring-hackers-reportedly-
`13
`watching-talking-strangers-in-home-cameras
`14 Hackers are getting really good at hacking Ring cameras and the results are
`terrifying, Mashable, December 15, 2019, https://mashable.com/article/ring-cameras-
`easily-hacked-and-its-terrifying/
`15
`https://www.theguardian.com/technology/2019/dec/13/ring-hackers-reportedly-
`watching-talking-strangers-in-home-cameras
`16 How Hackers Are Breaking Into Ring Cameras, Vice, December 11, 2009,
`https://www.vice.com/en_us/article/3a88k5/how-hackers-are-breaking-into-ring-
`cameras
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`13
`
`CLASS ACTION COMPLAINT
`
`
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 14 of 30 Page ID #:14
`
`
`
`
`‘Ring Video Doorbell Config,’ one thread on a hacking forum
`reads. A config is a file use to drive special software for rapidly
`churning through usernames or email addresses and passwords
`and trying to use them to log into accounts. Hackers have
`developed configs for a wide variety of websites and online
`services, from Uber to Facebook.
`
`The thread title adds that the config has a “High CPM,” or high
`“check per minute,” meaning it can test if a username and
`password allows access to a Ring camera quickly. In a different
`thread, one hacker is offering a Ring.com checker for $6.17
`35. Sadly, Ring hacking events have become so common place that there is
`even a podcast dedicated to live and recorded hacking events wherein malevolent third
`parties take control of Ring devices and terrorize occupants for entertainment.18 “The
`NulledCast is a podcast livestreamed to Discord.19 It's a show in which hackers take
`over people’s Ring and Nest smart home cameras and use their speakers to talk to and
`harass their unsuspecting owners.” 20 “‘Sit back and relax to over 45 minutes of
`
`
`17 How Hackers Are Breaking Into Ring Cameras, Vice, December 11, 2009,
`https://www.vice.com/en_us/article/3a88k5/how-hackers-are-breaking-into-ring-
`cameras
`18 Hackers are taking Control of Ring Cameras and using them to taunt both adults
`and children, Inc., https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-
`bitcoin-ransom-security.html
`19 Discord is a proprietary freeware voice over internet protocol application and digital
`distribution platform designed for video gaming communities, that specializes in text,
`image, video and audio communication between users in a chat channel. As of July
`2019, there are over 250 million unique users of the software.
`https://en.wikipedia.org/wiki/Discord_(software)
`20 Inside the Podcast that Hacks Ring Camera Owners Live on Air, Vice, December
`13, 2019, https://www.vice.com/en_us/article/z3bbq4/podcast-livestreams-hacked-
`ring-cameras-nulledcast.
`
`
`
`
`
`
`
`14
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 15 of 30 Page ID #:15
`
`
`entertainment,’ an advertisement for the podcast posted to a hacking forum called
`
`Nulled reads. ‘Join us as we go on completely random tangents such as; Ring & Nest
`Trolling, telling shelter owners we killed a kitten, Nulled drama, and more ridiculous
`topics. Be sure to join our Discord to watch the shows live.’” 21 As reported in
`Slashgear:
`
`Reality [] has taken on a frightening turn for owners of
`Ring security cameras who suddenly find virtual
`intruders in their homes, thanks to hackers who break
`into the security system and live stream their harassment
`for the entertainment of a few.
`
`The irony is probably lost on no one that the very devices
`that are supposed to keep homes and their owners safe
`have become the very vehicle for violations of their
`privacy. Tools to hack Ring security cameras have
`unfortunately become widespread enough to become
`almost common. And to show off their abilities and get a
`few kicks, some of these hackers have taken to live
`streaming their activities in bold defiance to authorities.
`22
`36. The podcast and other online hacker forums even feature software
`specifically designed to hack Ring cameras. The software churns through previously
`compromised email addresses and passwords to break into Ring cameras at scale. Id.
`37. Despite active knowledge of such forums Ring continued to blame these
`hacking incidents on poor security practices by users. Ring contends that in each of
`the hacking incidents, “credentials stolen during a data breach are sold on the black
`
`
`21 Nulledcast: a podcast where hackers play live audio of themselves breaking into
`Ring cameras and tormenting their owners, BoingBoing, December 13, 2019,
`https://boingboing.net/2019/12/13/nulledcast.html
`22 Ring camera hacking has become entertainment for some people, Slashgear,
`December 12, 2019, https://www.slashgear.com/ring-camera-hacking-has-become-
`entertainment-for-some-people-12603149/
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`15
`
`CLASS ACTION COMPLAINT
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 16 of 30 Page ID #:16
`
`
`market and used for hacking into accounts…. Due to the fact that customers often use
`
`the same username and password for their various accounts and subscriptions, bad
`actors often re-use credentials stolen or leaked from one service on other services."
`Ring’s explanation, however, neither eliminates its responsibility, nor accurately
`attributes the fault. As one hacking victim, Tania Amador, explained, her Ring
`password is 21 characters long and only used for that account. 23
`38. Moreover, “Ring’s status as a maker of home security cameras makes it
`much more sensitive than most accounts. Ring could probably do more to encourage
`users to choose strong passwords and set up two-factor authentication. For example,
`Google-owned Nest recently switches to Google logins, which have industry-leading
`security features. It also pesters people in the app to configure two-factor if they
`haven’t already.”24
`“Additionally, Ring does not alert users of attempted log-in from an
`39.
`unknown IP address, or tell users how many others are logged into an account at
`one time. Because of this, there is no obvious way to know whether any bad
`actors have logged into people’s compromised Ring accounts without their
`consent.”25
`40. Ring’s failure to employ good security practices in the design and
`implementation of its camera systems has directly resulted in the unlawful exposure of
`Plaintiff and Class Members’ person and property and has damaged them thereby.
`
`23 Hackers are taking Control of Ring Cameras and using them to taunt both adults
`and children, Inc., https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-
`bitcoin-ransom-security.html
`24
`https://www.extremetech.com/internet/303296-hackers-openly-peddle-tools-to-
`hack-ring-cameras
`https://www.buzzfeednews.com/article/carolinehaskins1/data-leak-exposes-
`25
`personal-data-over-3000-ring-camera-users
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`16
`
`CLASS ACTION COMPLAINT
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 17 of 30 Page ID #:17
`
`
`
`
`D.
`Plaintiff and Class Members Suffered Damages
`41. The ramifications of Defendant’s failure to properly secure their cameras
`and attendant access protocols may be felt for years to come. While the immediate in
`terrorem effects resulting from unauthorized access may be assuaged by disconnecting
`the camera, hackers have had access to information derived from those cameras for
`years, including but not limited to intimate details of household members, work
`schedules, and property contents. This information can be sold and used for a host of
`nefarious purposes.
`42. The hacking was a direct and proximate result of Ring’s failure to: (a)
`properly secure its camera systems in order to prevent, or at least minimize, the ability
`of unauthorized third parties to gain access; (b) establish and im