LifeLock 2015 Annual Report Download - page 278

Case 3:15-cv-00258-HSG Document 49-1 Filed 11/04/15 Page 120 of 289
54. Second, LifeLock’s systems and personnel are not equipped to handle the level of administrative, technical, and physical safeguards that is
necessary to provide the promised protections.
55. More specifically, all Lifelock subscribers, including Plaintiffs and all members of the proposed Class, provide Lifelock with sensitive personal
data, including credit card, social security and bank account numbers. The FTC Order, in addition to what has previously been listed, ordered LifeLock (as
well as any business entity controlled by Davis that collects, maintains, or stores personal information from or about consumers) to “establish and implement,
and thereafter maintain, a comprehensive information security program that is designed to protect the security, confidentiality, and integrity of personal
information collected from or about consumers. Such program, the content and implementation of which must be fully documented in writing, shall contain
administrative, technical, and physical safeguards appropriate to the entity’s size and complexity, the nature and scope of the entity’s activities, and the
sensitivity of the personal information collected from or about consumers . . . .” In this same vein, the FTC Order required LifeLock to (1) make an initial
assessment and biennial assessments for twenty years on the effectiveness of its safeguards, and (2) distribute a copy of the FTC order to all principals,
officers, directors, managers, employees, agents, and representatives for a period of five years, or until February 23, 2015.
56. Despite the obligations imposed by the FTC Order, LifeLock continued to use ineffective administrative, technical, and physical safeguards,
failed to routinely assess and report the adequacy of the effectiveness of its safeguards, and failed to distribute the FTC Order to required personnel. All the
while, however, LifeLock falsely and/or misleadingly represented that it would “stop thieves before they do damage.”
57. The deficiencies in LifeLock’s systems and staffing have been documented by a Company insider. Indeed, on the heels of the Burke settlement,
insider Michael D. Peters (“Peters”), LifeLock’s Chief Information Security Officer from approximately May 24, 2013 through July 29, 2013, corroborated
Burke’s allegations of wide-scale problems and himself filed
1279432.1 - 14 - AMENDED CLASS ACTION COMPLAINT
CASE NO. 3:15-CV-258