Incident: ADT Security Services Breach: Unauthorized Access to Customer Cameras.

Published Date: 2020-05-18

Postmortem Analysis
Timeline 1. The software failure incident involving ADT Security Services allowing an employee to view footage from indoor security cameras in hundreds of homes over several years happened in April 2020 [99728].
System 1. ADT Pulse accounts security system [99728]
Responsible Organization 1. ADT Security Services [99728]
Impacted Organization 1. ADT clients, including lead plaintiffs Alexia Preddy and Shan Doty, who had their indoor security cameras accessed without authorization [99728].
Software Causes 1. Lack of basic security procedures by ADT, leading to a privacy breach allowing unauthorized access to security cameras [99728] 2. Failure to implement safeguards to notify customers when their accounts have been accessed by third parties [99728]
Non-software Causes 1. Lack of basic security procedures followed by ADT Security Services [99728] 2. Unauthorized access granted by a technician to security cameras in customers' homes [99728] 3. Failure to implement safeguards to notify customers when their accounts have been accessed by third parties [99728]
Impacts 1. The software failure incident led to a breach that allowed an ADT employee to allegedly view footage from indoor security cameras installed in hundreds of homes over several years [99728]. 2. Customers impacted by the security lapse were notified by ADT and were offered monetary payments in exchange for their silence [99728]. 3. The incident resulted in a lawsuit seeking $5 million in damages for each affected customer, along with interest [99728]. 4. ADT was accused of failing to implement safeguards to notify customers when their accounts have been accessed by third parties, leading to a lack of privacy protection [99728].
Preventions 1. Implementing robust access control mechanisms to ensure that only authorized personnel can access sensitive data or systems [99728]. 2. Regularly auditing and monitoring access logs to detect any unauthorized activities or suspicious behavior [99728]. 3. Enhancing security protocols and procedures to include multi-factor authentication for accessing sensitive systems or accounts [99728]. 4. Implementing notification systems to alert customers when their accounts are accessed by third parties [99728]. 5. Providing comprehensive training to employees on data privacy and security best practices to prevent insider threats [99728].
Fixes 1. Implementing robust access control measures to ensure that only authorized personnel can access sensitive data or systems [99728]. 2. Enhancing monitoring and auditing capabilities to detect unauthorized access or suspicious activities promptly [99728]. 3. Strengthening notification mechanisms to alert customers when their accounts are accessed by third parties [99728]. 4. Conducting regular security audits and assessments to identify and address potential vulnerabilities in the system [99728].
References 1. Fears Nachawati Law Firm 2. ADT Security Services 3. Fox News 4. U.S. District Court in Fort Lauderdale, Fla. [99728]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The article mentions that ADT has been accused of failing to protect customers' privacy in the past. In 2017, the company agreed to pay $16 million to settle class-action lawsuits in Illinois, Arizona, Florida, and California after it was alleged it covered up hacking vulnerabilities in its security systems. This indicates that similar incidents related to privacy breaches or security vulnerabilities have happened before within the same organization, ADT Security Services [99728]. (b) The article does not provide specific information about similar incidents happening at other organizations or with their products and services.
Phase (Design/Operation) design (a) The software failure incident in the article can be attributed to the design phase. The breach that allowed an ADT employee to view footage from indoor security cameras in hundreds of homes was due to a privacy breach caused by ADT not following basic security procedures [99728]. This indicates that the failure was a result of contributing factors introduced during system development or procedures to operate or maintain the system.
Boundary (Internal/External) within_system (a) within_system: The software failure incident reported in the article is primarily within the system. The breach that allowed an ADT employee to view footage from indoor security cameras in hundreds of homes was due to the employee's unauthorized access to more than 200 ADT Pulse accounts over a seven-year period [99728]. The failure originated from within the system as a result of inadequate security procedures and lack of safeguards to prevent unauthorized access.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was primarily due to non-human actions, specifically a breach that allowed an employee to view footage from indoor security cameras installed in hundreds of homes over several years. The breach was a result of a loophole in the security system that was discovered when a customer found an unauthorized email among the addresses given permission to access their security system [99728]. (b) However, human actions also played a significant role in this software failure incident. The employee, identified as Telesforo Aviles, allegedly had access to more than 200 ADT Pulse accounts over a seven-year period. The lawsuits mention that ADT tried to mitigate and hide its actions by contacting affected account holders and offering monetary payments in exchange for their silence. Additionally, the technician granted himself remote access to security cameras of specific customers, such as Alexia Preddy and Shan Doty, to spy on them [99728].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles is primarily related to a breach in security that allowed an ADT employee to access indoor security cameras installed in hundreds of homes over several years. This breach was due to a loophole in ADT's security procedures, allowing the employee unauthorized access to more than 200 ADT Pulse accounts over a seven-year period. The incident was not directly linked to hardware failure but rather to a failure in security protocols and access controls [99728]. (b) The software failure incident can be attributed to a failure in the software system's security measures and access controls. The breach allowed the employee to view footage from indoor security cameras, indicating a flaw in the software's authorization mechanisms. The incident highlights a failure in implementing safeguards to prevent unauthorized access to customer accounts and a lack of notifications to customers when their accounts are accessed by third parties. This points to a software-related failure in ensuring the security and privacy of the system [99728].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in Article 99728 is malicious in nature. The incident involved a breach at ADT Security Services where an employee allegedly accessed footage from indoor security cameras installed in hundreds of homes over several years with the intent to spy on individuals. The employee, identified as Telesforo Aviles, had unauthorized access to more than 200 ADT Pulse accounts over a seven-year period. This breach was not accidental but a deliberate act by the employee to view private footage from customers' security cameras [99728].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident reported in Article 99728 was primarily due to poor decisions made by ADT Security Services. The breach that allowed an employee to view footage from indoor security cameras in hundreds of homes over several years was attributed to ADT not following basic security procedures, as mentioned in a news release from the Fears Nachawati Law Firm. Additionally, ADT attempted to mitigate and hide their actions by offering affected customers monetary payments in exchange for their silence, as stated in the lawsuits filed against the company. These actions indicate poor decisions made by ADT in handling the security breach [99728].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident in the article can be attributed to development incompetence. The breach that allowed an ADT employee to view footage from indoor security cameras in hundreds of homes over several years was a result of ADT not following basic security procedures, as stated by the Fears Nachawati Law Firm in the news release [99728]. Additionally, the lawsuits mentioned that ADT failed to implement safeguards to notify customers when their accounts were accessed by third parties, indicating a lack of proper security measures in place [99728]. (b) The software failure incident was not accidental but rather a result of the security loophole that was discovered when a customer found an unauthorized email among the addresses given permission to access their security system [99728]. The breach was not accidental but a deliberate act by an employee who allegedly had access to more than 200 ADT Pulse accounts over a seven-year period [99728].
Duration permanent (a) The software failure incident in this case can be considered permanent as it involved a breach that allowed an employee to allegedly view footage from indoor security cameras installed in hundreds of homes over several years [99728]. The employee, identified as Telesforo Aviles, had access to more than 200 ADT Pulse accounts over a seven-year period. This indicates a long-standing issue that persisted over an extended duration, making it a permanent failure.
Behaviour crash, omission, value (a) crash: The software failure incident in the article can be categorized as a crash. The breach allowed an employee to allegedly view footage from indoor security cameras installed in hundreds of homes over several years, indicating a failure of the system to maintain its intended state and not perform its functions as expected [99728]. (b) omission: The incident can also be categorized as an omission. The system omitted to perform its intended functions by failing to implement safeguards to notify customers when their accounts have been accessed by third parties, leading to unauthorized access to security cameras [99728]. (d) value: Additionally, the incident can be categorized as a value failure. The system performed its intended functions incorrectly by allowing a technician to grant himself remote access to security cameras and spy on individuals inside their homes, violating their privacy [99728].

IoT System Layer

Layer Option Rationale
Perception network_communication (a) sensor: The software failure incident reported in the article is not directly related to a sensor error. The incident involved a breach at ADT Security Services that allowed an employee to view footage from indoor security cameras installed in hundreds of homes, indicating a breach in the security system rather than a sensor error [Article 99728]. (b) actuator: The failure reported in the article is not attributed to an actuator error. The incident involved unauthorized access to security cameras by an ADT employee, which does not involve an actuator malfunction [Article 99728]. (c) processing_unit: The software failure incident does not directly involve a processing unit error. The breach at ADT Security Services was due to a lack of basic security procedures that allowed an employee to access customer accounts and view security camera footage, indicating a failure in security protocols rather than a processing unit error [Article 99728]. (d) network_communication: The software failure incident at ADT Security Services does involve a network communication error. The breach allowed an employee to access over 200 ADT Pulse accounts, indicating a failure in network security and communication protocols that should have prevented unauthorized access [Article 99728]. (e) embedded_software: The failure reported in the article is not specifically related to an embedded software error. The incident involved a breach at ADT Security Services that allowed an employee to view footage from indoor security cameras, highlighting a failure in overall security measures rather than a specific embedded software issue [Article 99728].
Communication unknown The software failure incident reported in the article does not directly relate to a failure at the communication layer of the cyber-physical system. The incident described in the article pertains to a breach of security procedures by ADT Security Services, leading to unauthorized access to indoor security cameras installed in customers' homes. The failure was primarily attributed to ADT's lack of basic security measures and the actions of a former employee who gained unauthorized access to customer accounts, rather than a failure at the communication layer of the cyber-physical system.
Application TRUE The software failure incident reported in Article 99728 was related to a breach at ADT Security Services that allowed an employee to allegedly view footage from indoor security cameras installed in hundreds of homes over several years. This breach was due to a failure in the application layer of the cyber physical system, specifically related to security procedures not being followed by ADT, allowing unauthorized access to customer accounts and security cameras [99728].

Other Details

Category Option Rationale
Consequence harm, property (b) harm: People were physically harmed due to the software failure The software failure incident involving ADT Security Services led to physical harm as the article mentions that a technician granted himself remote access to security cameras in customers' homes, allowing him to spy on individuals inside the homes. This unauthorized access resulted in the technician potentially viewing and monitoring individuals, including minors, inside the homes, causing harm and invasion of privacy [99728].
Domain information (a) The failed system in this incident was related to the information industry as it involved a breach that allowed an employee to view footage from indoor security cameras installed in hundreds of homes over several years [Article 99728].

Sources

Back to List