Attorney General Peter F. Kilmartin today announced that Rhode Island has joined with 31 other states in a $3.5 million-dollar settlement with technology company Lenovo (United States) Inc. to resolve allegations that the company violated state consumer protection laws by pre-installing software on laptop computers sold to consumers that made consumers' personal information vulnerable to hackers. Rhode Island will receive approximately $53,000 from the settlement funds.
In August 2014, North Carolina-based Lenovo began selling certain laptop computers that contained pre-installed ad software called VisualDiscovery, which was created by the company Superfish, Inc. VisualDiscovery purportedly operated as a shopping assistant by delivering pop-up ads to consumers of similar looking products sold by Superfish retail partners whenever a customer's mouse hovered over the image of a product on a shopping Web site. The states claim that VisualDiscovery displayed a one-time pop-up window the first time consumers visited a shopping website. Unless consumers affirmatively opted out, VisualDiscovery would be enabled on their computers.
The states alleged that VisualDiscovery operated by acting as a local proxy, or "man in the middle," that stood between the consumer's browser and all Internet Web sites that the user visited, including encrypted sites. This technique allowed the software to see all of a user's sensitive personal information that was transmitted on the Internet. Consumer information, including sensitive communications with encrypted Web sites, would be collected and transmitted to Superfish, the states allege.
The states alleged that Visual Discovery created a security vulnerability that made consumers' information susceptible to hackers in certain situations. The states allege that Lenovo's failure to disclose the presence of VisualDiscovery on its computers, its failure to warn consumers that the software created a security vulnerability and its inadequate opt-out procedure violated state consumer protection laws.
"We try to educate consumers on how to protect their identity online, and here is a company that was secretly hiding enabling software on laptops that put people at risk for being hacked," said Attorney General Peter Kilmartin. "All companies, but especially technology companies, must be forthcoming and upfront with their customers, and if they engage in deceptive practices, as was done in this case, we stand ready to hold those companies accountable."
Lenovo stopped shipping laptops with VisualDiscovery preinstalled in February 2015, though the states allege that some laptops with the software were still being sold by various retail outlets as late as June 2015.
In addition to the monetary payment, the settlement requires Lenovo to change its consumer disclosures about pre-installed advertising software, to require a consumer's affirmative consent to using the software on their device and to provide a reasonable and effective means for consumers to opt-out, disable or remove the software.
Lenovo is also required to implement and maintain a software security compliance program and must obtain initial and biennial assessments for the next 20 years from a qualified, independent, third-party professional that certifies the effectiveness and compliance with the security compliance program.
The settlement will not be final until it is approved by the Superior Court.