LifeLock 2015 Annual Report Download - page 279

Case 3:15-cv-00258-HSG Document 49-1 Filed 11/04/15 Page 121 of 289
a complaint against LifeLock for wrongful termination and violation of whistleblower protection laws, a suit that remains ongoing.
58. In his complaint against LifeLock, Peters alleges that upon commencing work at LifeLock, he immediately began an initial risk assessment of
the Company. Peters states that prior to his risk assessment, the Company had never conducted a bona fide risk assessment. Ex. 3: Peters Compl. ¶ 17.
59. Peters further alleges that the risk assessment uncovered that LifeLock’s technology and security were ineffective to deliver the protections
LifeLock promised. Specifically, Peters determined that
• LifeLock’s internal capacity for governance implemented (policies, audit plan, change controls, architecture review, etc.) was at 47% of the
minimum to protect LifeLock’s customers and their sensitive information.” (Id. at ¶ 18);
• “LifeLock’s technological security readiness (intrusion prevention, data leakage, data encryption, access controls, physical security, etc.) was
only at 27% of the minimum to protect LifeLock’s customers and their sensitive information.” (Id. at ¶ 19); and
• “LifeLock’s security vigilance (vulnerability testing, auditing, monitoring, awareness education, event logging, incident management, etc.)
was at 0% of the minimum to protect LifeLock’s customers and their sensitive information.” (Id. at ¶ 20).
60. According to Peters, these deficiencies were due, in large part, to deficient staffing. LifeLock only had two people responsible for security. One
individual lacked technical skill and only had minimal security experience. While the other had technical skills, he was newly out of college and lacked
experience. Peters determined that millions of consumers were at risk, which led Peters to advise LifeLock Chief Financial Officer, Chris Power, and LifeLock
Chief Information Officer, Rich Stebbins, that LifeLock should immediately hire 12 information security professionals. Peters reports that in response,
LifeLock fired Peters, resulting in Peters filing suit. (Id. at ¶¶ 20-25.)
1279432.1 - 15 - AMENDED CLASS ACTION COMPLAINT
CASE NO. 3:15-CV-258