Tick, Tick, Tick Boom You're Dead: Tech & the FTC

### The FTC's Mandate and Section 5 Enforcement At 00:00, FTC Commissioner Terrell McSweeny and FTC attorney Whitney Merrill introduce the Federal Trade Commission's consumer protection mandate under Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices. They demystify how a civil regulatory agency investigates technology companies, polices misleading marketing claims, and enforces baseline data security practices across commercial enterprises.

### Thirty Years of Tech Fraud: From Dialers to Scareware At 06:12, the speakers chronicle the evolution of tech-focused FTC enforcement dating back to DEF CON's inception in 1993. They revisit 1990s dialer scams and modem hijacking fraud, where malicious websites surreptitiously disconnected 56k dial-up modems and placed unauthorized 900-number long-distance calls. They also discuss aggressive FUD (fear, uncertainty, and doubt) marketing campaigns, such as rogue antivirus "scareware" that warned users "Tick, tick, tick boom, you're dead" to manipulate them into purchasing worthless security software.

### Children's Privacy and Connected Toys At 22:45, the discussion focuses on the Children's Online Privacy Protection Act (COPPA) and the alarming security failures in connected children's toys and educational devices. Highlighting actions against companies like VTech and Genesis Toys, the presenters explain how unencrypted audio recordings, chat logs, and facial photos of minors were stored on exposed cloud servers without parental consent, violating statutory requirements and endangering youth.

### Smart Devices and Pervasive Surveillance At 31:18, Merrill and McSweeny detail regulatory actions targeting smart TVs and IoT hardware manufacturers, such as the VIZIO enforcement action for secretly tracking second-by-second viewing habits and selling consumer telemetry without affirmative user consent. They analyze enforcement actions against router and webcam vendors (including ASUS and TRENDnet) that shipped products with hardcoded default passwords and trivial bypass flaws.

### Regulatory Settlements, Class Actions, and Security Researchers Concluding between 38:50 and 43:55, the speakers clarify the mechanics of FTC consent decrees, which impose mandatory independent security auditing and steep penalties for up to twenty years. They contrast regulatory enforcement with private class-action litigation and urge the security research community to coordinate vulnerability disclosures, participate in FTC public workshops, and help guide evidence-based technology policy.

(AI summary — Gemini 3.8 Flash)