Richard J. Stanton

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF RICHARD J. STANTON CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5(A) OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4287; File No. 072 3165 Filed, April 5, 2010 C Decision, April 5, 2010 This consent order addresses Richard J. Stanton=s marketing and distribution of a variety of online seal certification marks (Awebsite seals@ or Aseals@) for companies to display on their websites. Mr. Stanton falsely represented to consumers that his company, Controlscan, had verified the privacy and security protections offered by a company displaying Controlscan=s Business Background Reviewed, Registered Member, Privacy Protected, and Privacy Reviewed seals, and falsely represented how frequently Controlscan reviewed a company=s fitness to display each of these seals, as well as an additional seal, the Verified Secure seal. The complaint describes, with specificity, the claims respondent made regarding its verification of a company displaying each of the challenged seals, as well as the verification that Controlscan in fact conducted in connection with each seal. The consent order prohibits respondent from misrepresenting: 1) the verification that is conducted concerning the protection that a company provides for the privacy and/or security of consumer information or the steps a company has taken to provide such protection; or 2) the frequency of such verification. Mr. Stanton was required to pay to the Commission $102,000 in equitable monetary relief. Participants For the Commission: Laura Berger, Katie Race Brin, and Kristin Krause Cohen.

For the Respondents: Steven D. Cooper, Stites & Harbison, PLLC.

COMPLAINT The Federal Trade Commission, having reason to believe that Richard Stanton, through his direction, control, and ownership of VOLUME 149 Complaint Controlscan, Inc. (AControlScan@ or Athe company@), has violated the provisions of the Federal Trade Commission Act (AFTC Act@), and it appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent Richard Stanton (Arespondent@) founded Controlscan, a privately-owned, Delaware corporation that, among other things, has offered a variety of online seal certification marks (Awebsite seals@ or Aseals@) for companies to display on their websites. Respondent controlled the design of the company=s product offerings and was its CEO from its founding until approximately September 2007 and its sole owner from its founding until approximately February 2007. He retains an ownership interest in the company. Individually, or in concert with others, he has formulated, directed, controlled, or participated in the policies, acts, or practices of Controlscan, including the acts or practices alleged in this complaint. 2. The acts and practices of respondent as alleged in this complaint are in or affecting commerce, as Acommerce@ is defined in Section 4 of the FTC Act.

CONTROLSCAN=S SEAL PRODUCTS 3. In approximately October 2005, respondent, through his control and ownership of Controlscan, began to offer a variety of privacy and data security seals for online companies to post on their websites including, but not limited to, the Business Background Reviewed, Verified Secure (initially offered as Hacker Defended and/or Trusted Secure), and Privacy Protected seals. In approximately July 2007, respondent, through his control and ownership of Controlscan, began to provide the Registered Member (initially Security Reviewed) and Privacy Reviewed seals for display, as substitute seals, by a company that failed to qualify for Controlscan=s Verified Secure and Privacy Protected seals, respectively (Exhibits 1-10). 4. Each Controlscan seal has included: RICHARD J. STANTON / CONTROLSCAN 1257 Complaint a. a graphic icon next to the seal=s trade name, including, but not limited to: for Business Background Reviewed, a check mark; for Verified Secure, a padlock; for Registered Member, a prize ribbon; and for Privacy Protected and Privacy Reviewed, a shield; and b. a stamp that displays the current date (a Adate stamp@), which (except with regard to the Registered Member seal) appears beside the word Averified,@ e.g., 5. During the relevant time period, respondent, in connection with his operation of Controlscan, also offered a Ajoint seal design@ that a company could elect to use in order to display the Verified Secure or Registered Member seal in combination with VOLUME 149 Complaint the Business Background Reviewed seal (see Exhibit 6). In addition to the date stamp and applicable graphic icons, this joint seal design displayed the words AInternet Security by Controlscan,@ e.g, 6. During the relevant time period, each seal also has included a window that Apops up@ onscreen when a consumer clicks on the seal and remains visible until the consumer clicks to close it (a Apop-up@). Each pop-up has contained the name of the website displaying the seal and has described Controlscan=s verification of that website=s privacy and/or security protections. 7. From Controlscan=s founding until approximately September 2007, respondent controlled the design, content, and format of Controlscan=s seals and pop-ups. REPRESENTATIONS REGARDING THE SEALS 8. Beginning in approximately October 2005, Controlscan, under respondent=s direction and control, made statements to consumers regarding Controlscan=s verification of the privacy and/or security protections that companies displaying its seals provide for consumer information. At various times, such statements have included, but not been limited to: RICHARD J. STANTON / CONTROLSCAN 1259 Complaint a. for the Business Background Reviewed seal, a statement in the pop-up that AYou can shop in confidence knowing your personal information is safe with [a website displaying the seal]@; and a pop-up heading that displayed the words AControlScan Verified Site@ beside a padlock icon (see Exhibit 2). b. for the Registered Member seal, a seal design that displayed a prize ribbon icon and the pop-up quoted below (see Exhibits 4-5):

The [website] is currently working towards meeting the Payment Card Industry Data Security Standards. They are employing Controlscan=s PCI Compliance tool to help meet the PCI DSS guidelines. The Controlscan PCI Compliance scanning tool actively searches this website for thousands of known vulnerabilities.

The Controlscan approved PCI compliance scanning tool includes:

$ Comprehensive vulnerability assessment scans looking for thousands of vulnerabilities.

$ Network mapping that rapidly detects and identifies servers, desktops, routers, wireless access points and other network devices.

$ Automated daily updates to the Controlscan vulnerability Knowledge Base.

$ Both scheduled and automated network discovery and vulnerability scan tasks that can be executed on a daily, weekly or monthly basis.

The [website=s] Controlscan Member seal has been validated and is authentic.

For more information please visit Controlscan.com. >> Verify Seal using Controlscan verification database c. for both the Business Background Reviewed and VOLUME 149 Complaint Registered Member seals, the joint seal design, which displayed the words AInternet Security by Controlscan@ on the seal=s face (see Exhibit 6). d. for the Privacy Protected seal, a seal design that displayed the trade name APrivacy Protected@ with a shield icon on the seal=s face and the pop-up quoted below, which displayed the heading AControlScan Verified Site@ beside a padlock icon (see Exhibits 7-8): PRIVACY PROTECTED CERTIFICATION:

Controlscan certifies [website] as Privacy Protected. The privacy statement and practices of [website] have been reviewed by Controlscan for compliance with our strict program requirements.

You can shop in confidence knowing your personal information is safe with [website]. The [website] Controlscan certification seals have been validated and are authentic. Visit Controlscan.com for more details.

About Controlscan Controlscan is a market leader in e-commerce security, enabling businesses and consumers to have confidence in a connected world. Controlscan helps its customers protect their infrastructure, information, and interactions by delivering services that address risks to security compliance.

e. for the Privacy Reviewed seal, a seal design that displayed the trade name APrivacy Reviewed@ with a shield icon on the seal=s face and the pop-up quoted below, which displayed the heading AControlScan Security Reviewed@ beside a padlock icon (see Exhibits 9-10):

[Website] is enrolled in Controlscan=s Privacy Reviewed certification program. Companies that participate in this program have their privacy policy [sic] reviewed by Controlscan. [Website] is currently working towards meeting the strict Controlscan Privacy Protected program requirements. In addition to the privacy review [website] has completed a RICHARD J. STANTON / CONTROLSCAN 1261 Complaint detailed Business Background Verification which includes verifying [website] through business licenses and Secretary of State information.

About Controlscan.

Controlscan is a market leader in e-commerce security, enabling businesses and consumers to have confidence in a connected world. Controlscan helps its customers protect their infrastructure, information, and interactions by delivering services that address risks to security compliance.

f. for the Business Background Reviewed, Verified Secure, Registered Member, Privacy Protected, and Privacy Reviewed seals, as described in paragraphs 4.b. and 5, a date stamp that displayed the current date, which was updated on a daily basis (see Exhibits 1, 3, 4, 6, 7, 9).

VERIFICATION PROCEDURES 9. Contrary to the statements described in paragraph 8, in many instances, Controlscan, under respondent=s direction and control, conducted little or no verification of the privacy and/or security protections for consumer information provided by companies displaying Controlscan=s seals. Instead, in many instances, the company, under respondent=s direction and control: a. provided the Business Background Reviewed seal to a company after verifying certain information, unrelated to information security, regarding the company=s business address, ownership, and domain registration; b. provided the Registered Member seal to a company that failed to qualify for the Verified Secure seal because an electronic scan of its website (Awebsite scan@) identified an actual or potential severe vulnerability on the website, and permitted the company to display the seal indefinitely while taking no action to assess whether the company was working VOLUME 149 Complaint to resolve any vulnerability identified by the website scan;

c. provided the Privacy Protected seal to a company that posted a privacy policy on its website, with no review of the company=s underlying privacy or information security practices; and d. provided the Privacy Reviewed seal to a company that failed to qualify for the Privacy Protected seal because it failed to post a privacy policy on its website. 10. Contrary to the current date displayed in each seal=s date stamp, Controlscan, under respondent=s direction and control, failed to review a company=s practices on a daily basis. Instead, in many instances, the company, under respondent=s direction and control:

a. for a company displaying the Business Background Reviewed, Privacy Protected, and Privacy Reviewed seal, conducted no ongoing review of the company=s fitness to display the seal;

b. for a company displaying the Verified Secure seal, conducted only a weekly scan of the company=s website; and c. for a company displaying the Registered Member seal, conducted a weekly website scan but imposed no requirement that the company take steps to resolve any actual or potential severe vulnerability identified by the scan.

VIOLATIONS OF THE FTC ACT 11. As described in paragraph 8, respondent, through his control and ownership of Controlscan, has represented, expressly or by implication, that Controlscan has taken reasonable steps to RICHARD J. STANTON / CONTROLSCAN 1263 Complaint verify that a company displaying the Business Background Reviewed, Registered Member, Privacy Protected, or Privacy Reviewed seals provided appropriate protection for the privacy and/or security of consumer information. 12. In truth and in fact, as described in paragraph 9, in many instances, Controlscan has not taken reasonable steps to verify that a company displaying the Business Background Reviewed, Registered Member, Privacy Protected, or Privacy Reviewed seals has provided appropriate protection for the privacy and/or security of consumer information. Therefore, the representation set forth in paragraph 11 was, and is, false or misleading. 13. As described in paragraph 8.b., respondent, through his control and ownership of Controlscan, has represented, expressly or by implication, that Controlscan has taken reasonable steps to verify that a company that displays the Registered Member seal Ais currently working towards meeting the Payment Card Industry Data Security Standards.@ 14. In truth and in fact, as described in paragraph 9.b., in many instances Controlscan has not taken any steps to verify that a company that displays the Registered Member seal Ais currently working towards meeting the Payment Card Industry Data Security Standards.@ Therefore, the representation set forth in paragraph 13 was, and is, false or misleading. VOLUME 149 Complaint 15. As described in paragraph 8.f., respondent, through his control and ownership of Controlscan, has represented, expressly or by implication, that Controlscan has taken reasonable steps to review a company=s fitness to display the Business Background Reviewed, Verified Secure, Registered Member, Privacy Protected, or Privacy Reviewed seal on a daily basis. 16. In truth and in fact, as described in paragraph 10, in many instances Controlscan has not taken reasonable steps to review a company=s fitness to display the Business Background Reviewed, Verified Secure, Registered Member, Privacy Protected, or Privacy Reviewed seal on a daily basis. Therefore, the representation set forth in paragraph 15 was, and is, false or misleading.

17. The acts and practices of respondent as alleged in this complaint constitute deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this fifth day of April, 2010, has issued this complaint against respondent. By the Commission, Commissioner Ramirez not participating. RICHARD J. STANTON / CONTROLSCAN 1265 Complaint EXHIBIT 1 EXHIBIT 2 VOLUME 149 Complaint EXHIBIT 3 RICHARD J. STANTON / CONTROLSCAN 1267 Complaint EXHIBIT 4 VOLUME 149 Complaint EXHIBIT 5 RICHARD J. STANTON / CONTROLSCAN 1269 Complaint EXHIBIT 6 EXHIBIT 7 VERIFIED, 24-OCT a EL) VOLUME 149 Complaint EXHIBIT 8 RICHARD J. STANTON / CONTROLSCAN 1271 Complaint EXHIBIT 9 VEMIFIED. 244007 PRIVAC REVIEWED ee ee EXHIBIT 10 Pending Privacy Profected Pop-up The following is the seal Pop-up which is displayed when a customer Clicks on the Privacy Reviewed seal, ie. the pending Privacy Protected seal WEBSITE NAME: domainname.com domainname.com is enralied in ControlScan's Privacy Reviewed certification program. Companies that participate in this program have their privacy policy reviewed by ContralScan. domainname.com is currently working towards meeting the strict Controlscan Privacy Protected program requirements. In addition to the privacy review domainname.com has completed a detailed Business Background Verification which indudes verifying domainname.com through business licenses and Secretary of State information.

About ControtScan_ ControfScan Is a market teader in e-commerce security, coabling Gurivestes and comumers lo have confidence in a connected world. Controlscan helps its customers protect their tnfrastructune, information, and interactions by deltvering services that address risks bo tecurity and compllance. VOLUME 149 Decision and Order DECISION AND ORDER The Federal Trade Commission, having initiated an investigation of certain acts and practices of the respondent named in the caption hereof, and the respondent having been furnished thereafter with a copy of a draft complaint which the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued, would charge the respondent with violation of the Federal Trade Commission Act, 15 U.S.C. ' 45 et seq.;

The respondent and counsel for the Commission having thereafter executed an agreement containing a consent order (AConsent Agreement@), an admission by the respondent of all the jurisdictional facts set forth in the aforesaid draft complaint, a statement that the signing of the agreement is for settlement purposes only and does not constitute an admission by the respondent that the law has been violated as alleged in such complaint, or that any of the facts as alleged in such complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission=s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the respondent has violated the Federal Trade Commission Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, now in further conformity with the procedure prescribed in Section 2.34 of its Rules, 16 C.F.R. ' 2.34, the Commission hereby issues its complaint, makes the following jurisdictional findings, and enters the following order: 1. Respondent Richard J. Stanton founded Controlscan, designed its product offerings, and was its chief executive officer from its founding until approximately September 2007 and its sole owner from its founding RICHARD J. STANTON / CONTROLSCAN 1273 Decision and Order until approximately February 2007. He retains an ownership interest in the company. Individually, or in concert with others, he has formulated, directed, controlled, or participated in the policies, acts, or practices of Controlscan, including the acts or practices alleged in the complaint.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the respondent, and the proceeding is in the public interest. ORDER DEFINITIONS For purposes of this order, the following definitions shall apply:

1. ASeal@ shall mean any trustmark, logo, seal of approval, emblem, shield, or other insignia offered for placement on a company=s website.

2. Unless otherwise specified, Arespondent@ shall mean Stanton.

3. ACommerce@ shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. ' 44. I.

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, website, or other device, in connection with the advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall not materially misrepresent, in any manner, expressly or by implication:

VOLUME 149 Decision and Order A. the verification that is conducted concerning the protection that a company provides for the privacy and/or security of consumer information or the steps a company has taken to provide such protection; or B. the frequency of such verification. II.

IT IS FURTHER ORDERED that respondent shall pay $102,000 to the Federal Trade Commission, as follows: A. Prior to or concurrently with the execution of this order, respondent shall transfer the amount specified in this Section to his undersigned counsel, who shall hold the sum in escrow for no purpose other than payment to the Commission.

B. Within five (5) days of entry of this order, counsel for respondent shall transfer the sum to the Commission by electronic funds transfer in accordance with instructions previously provided by a representative of the Commission.

C. In the event of any default in payment, interest shall accrue, computed pursuant to 28 U.S.C. ' 1961, from the date of default to the date of payment. D. All funds paid to or received by the Commission pursuant to this Section shall be deposited into a fund administered by the Commission or its agent. In the event that direct restitution to consumers is wholly or partially impracticable or funds remain after restitution is completed, the Commission may apply any remaining funds for such other equitable relief (including consumer information remedies), as it determines to be reasonably related to respondent=s practices as alleged in the complaint. Any funds not RICHARD J. STANTON / CONTROLSCAN 1275 Decision and Order used for such equitable relief will be deposited with the United States Treasury as disgorgement. Respondent shall have no right to challenge the Commission=s choice of remedies under this Section. Respondent shall have no right to contest the manner of distribution chosen by the Commission. E. Respondent relinquishes all dominion, control, and title to the funds paid to the fullest extent permitted by law. Respondent shall make no claim to or demand return of the funds, directly or indirectly, through counsel or otherwise.

F. This order for equitable monetary relief is solely remedial in nature and is not a fine, penalty, punitive assessment, or forfeiture.

III.

IT IS FURTHER ORDERED that respondent shall maintain and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of, for a period of five (5) years from the date of preparation or dissemination, whichever is later, all documents, whether in written or electronic form, that relate to compliance with this order, including but not limited to:

A. all advertisements and promotional materials containing any representations covered by this order, with all materials relied upon in disseminating the representation;

B. consumer complaints (whether received directly, indirectly, or through any third party) that relate to respondent=s activities as alleged in the draft complaint and respondent=s compliance with the provisions of this order, and any responses to such complaints; VOLUME 149 Decision and Order C. copies of all subpoenas and other communications with law enforcement entities or personnel, if such documents bear in any respect on respondent=s activities as alleged in the draft complaint and respondent=s compliance with the provisions of this order; and D. any documents, whether prepared by or on behalf of respondent, that call into question respondent=s compliance with this order.

IV.

IT IS FURTHER ORDERED that respondent, for all companies he controls that relate to the subject matter of the order, shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities relating to the subject matter of this order. Respondent shall deliver this order to such current personnel within thirty (30) days after service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities.

V.

IT IS FURTHER ORDERED that respondent, for a period of ten (10) years after the date of issuance of the order, shall notify the Commission of any changes to his employment or affiliation, or any new employment or affiliation, with any business that involves offering or providing seals or related products or services. The notice shall include any new business address and telephone number and a description of the nature of the business or employment, including the respondent=s duties or responsibilities. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, RICHARD J. STANTON / CONTROLSCAN 1277 Decision and Order Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VI.

IT IS FURTHER ORDERED that respondent shall, within sixty (60) days after the date of service of this order, file with the Commission a true and accurate report, in writing, setting forth in detail the manner and form in which respondent has complied with this order. Within ten (10) days of receipt of written notice from a representative of the Commission, respondent shall submit additional true and accurate written reports. VII.

This order will terminate on April 5, 2030, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. any Part in this order that terminates in fewer than twenty (20) years;

B. this order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order as to such respondent will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

VOLUME 149 Decision and Order By the Commission, Commissioner Ramirez not participating. RICHARD J. STANTON / CONTROLSCAN 1279 Analysis to Aid Public Comment ANALYSIS OF PROPOSED CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission (AFTC@ or ACommission@) has accepted, subject to final approval, an agreement containing a consent order from Richard J. Stanton (Arespondent@), the founder and former Chief Executive Officer of Controlscan, Inc. (AControlScan@). The Commission has entered into a separate settlement with Controlscan to be filed in federal district court in the Northern District of Georgia.

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission again will review the agreement and the comments received and will decide whether it should withdraw from the agreement or make final the agreement=s proposed order.

This matter involves respondent=s marketing and distribution of a variety of online seal certification marks (Awebsite seals@ or Aseals@) for companies to display on their websites. The FTC complaint alleges that respondent violated Section 5(a) of the FTC Act by falsely representing to consumers that Controlscan had verified the privacy and data security practices of companies displaying its website seals, when in fact it had not. Specifically, the complaint alleges that respondent falsely represented to consumers that Controlscan had verified the privacy and security protections offered by a company displaying Controlscan=s Business Background Reviewed, Registered Member, Privacy Protected, and Privacy Reviewed seals, and falsely represented how frequently Controlscan reviewed such companies= fitness to display each of these seals. In addition, the complaint alleges that respondent falsely represented to consumers how frequently Controlscan reviewed companies= fitness to display the Verified Secure seal. The FTC complaint describes, with specificity, the claims respondent made regarding Controlscan=s verification of a VOLUME 149 Analysis to Aid Public Comment company displaying each of the challenged seals, as well as the verification that Controlscan in fact conducted in connection with each seal.

The proposed consent order contains provisions designed to prevent respondent from engaging in similar acts and practices in the future. Part I of the proposed order prohibits respondent from misrepresenting: 1) the verification that is conducted concerning the protection that a company provides for the privacy and/or security of consumer information or the steps a company has taken to provide such protection; or 2) the frequency of such verification. Part II requires respondent to pay to the Commission $102,000 in equitable monetary relief. Parts III through VI of the proposed order are reporting and compliance provisions. Part III requires respondent to keep copies of documents relevant to compliance with the order for a five-year period. Part IV requires respondent to provide copies of the order to certain personnel of companies he controls, and Part V requires him to notify the Commission of changes in his employment or affiliation with any business that involves offering or providing seals or related products or services. Part VI mandates that respondent file an initial compliance report with the Commission and respond to other requests from FTC staff. Part VII is a provision Asunsetting@ the order after twenty (20) years, with certain exceptions. The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the agreement and proposed order or to modify in any way its terms.

TRANSITIONS OPTICAL, INC. 1281 Complaint