D-Link agrees to implement a new security program to settle a 2017 FTC complaint that alleged D-Link left thousands open to well-known attacks
Dan Goodin / Ars Technica :
Context & Ripple Effects
The FTC's case against D-Link dates to [[a:915531|January 2017, when the agency sued the company over hard-coded logins in its routers and IP cameras and a private sign-in key left exposed online for six months]]. The settlement closes that case with a consent order rather than a court fight, following the template set by ASUS's 2016 settlement, which required two decades of independent security audits.
For D-Link, the deal lands on top of a consumer router market already under regulatory pressure — TP-Link's 2016 FCC settlement over Wi-Fi rules showed regulators willing to reach into router firmware practices, and the FTC has now done so twice for security specifically.
First-order effects
- D-Link must build and run the mandated security program across its router and IP camera lines, with compliance obligations replacing the litigation risk from the 2017 complaint.
Second-order effects
- Rival router makers ASUS and TP-Link are already operating under their own FTC and FCC consent decrees, so D-Link's settlement makes negotiated security programs the norm for the category rather than an outlier punishment — raising the compliance baseline every vendor must budget for.
Third-order effects
- If the FTC keeps resolving device-security cases through long-tail consent orders like ASUS's audit requirement, security-by-design stops being a differentiator and becomes a de facto regulatory floor for consumer networked hardware.
The trend: The FTC is converting consumer router security from a market differentiator into an enforceable baseline, using multi-year consent decrees against device makers one settlement at a time.