LifeLock 2015 Annual Report Download - page 280

Case 3:15-cv-00258-HSG Document 49-1 Filed 11/04/15 Page 122 of 289
61. Peters further states that the findings of his assessment included discovery of multiple examples of LifeLock’s misleading, unfair, and/or
deceptive practices, including, among others, the following:
• LifeLock’s director of internal audits, Tony Valentine, had collected evidence from the information security team that existed prior to Peters’s
arrival related to access logging, audit logging, audit log reviews, network security controls, and data leakage controls that either (1) did not truly
exist because the technology was still in boxes; or (2) LifeLock lacked the staff to keep track of everything; or (3) such reviews were not actually
conducted.
• LifeLock employee Dave Bridgman reported that LifeLock’s current practice was to manipulate the customer alerts sent to its elderly customers.
LifeLock would turn off or reduce the services alerting elderly customers to reduce the call volume received by LifeLock’s customer support
center.
• LifeLock was in the process of finalizing a new product offering called PassLock. This system was designed to allow customers to include their
passwords for up to ten accounts. PassLock would then crawl through hundreds of internet sites to check the username and password supplied by
the customer and report back to the customer. The problem was that the database was not being protected with industry-grade encryption. The
database was predicted to contain millions of customer credentials that would be devastating to consumers if a breach occurred. Moreover, the
system was going to utilize third-party cloud hosting business without that third party’s knowledge or consent. Technically, the PassLock
crawling would be identified by most service providers as intrusive, illegal, illegitimate, and then blacklist the source address.
Id.
62. Accordingly, company insiders have confirmed that LifeLock intentionally misled its customers concerning the scope and effectiveness of its
services.
1279432.1 - 16 - AMENDED CLASS ACTION COMPLAINT
CASE NO. 3:15-CV-258