Ubiquiti sues Krebs on Security for defamation
(2022/03/30)
- Reference: 1648669584
- News link: https://www.theregister.co.uk/2022/03/30/ubiquiti_brian_krebs/
- Source link:
Network equipment maker Ubiquiti on Tuesday filed a lawsuit against infosec journalist Brian Krebs, alleging he defamed the company by falsely accusing the firm of covering up a cyber-attack.
On March 30, 2021, Krebs [1]reported that Ubiquiti [2]had disclosed a January breach involving a third-party cloud provider, later revealed to be AWS, and that an unnamed source within the firm had claimed the company was downplaying a catastrophic compromise.
On December 1, 2021, the US Department of Justice [3]charged former Ubiquiti software engineer Nickolas Sharp, accusing him of attempting to steal data from the company and to exhort $2m from the firm in Bitcoin ransom as part of an effort to reduce the price of Ubiquiti shares. The DoJ said that after Ubiquiti refused Sharp's payment demand, he tried to sink the company's shares by publishing stolen files and engaging in a media campaign to plant damaging stories about the firm.
[4]
The publication of these stories, on March 30 and 31, 2021, the DoJ said, coincided with a $4bn decline in Ubiquiti's market capitalization.
[5]
[6]
Ubiquiti, in its complaint
And the biz contends he published on his Krebs-on-Security website [8]a story on December 2, 2021 that repeated prior claims while misleadingly referring to his source as "a Ubiquiti employee" and to Sharp as "a Ubiquiti developer" if they were separate individuals and without acknowledging that the two references were to the same person.
[9]
"Despite these damming [sic] facts, Krebs published a story on his blog the next day doubling down on his false accusations against Ubiquiti and intentionally misleading his readers into believing that his earlier reporting was not sourced by Sharp, the hacker behind the attack," the complaint says.
[10]Wi-Fi slinger Ubiquiti hints at source code leak after claim of 'catastrophic' cloud intrusion emerges
[11]Exam-monitoring biz Proctorio tried to silence a critic using copyright law. Now EFF sues to put an end to this tactic
[12]Grsecurity maker finally coughs up $300k to foot open-source pioneer Bruce Perens' legal bill in row over GPL
[13]Biz forked out $115k to tout 'Time AI' crypto at Black Hat. Now it sues organizers because hackers heckled it
The networking biz contends that the article's assertions – about the scope of the incident being underplayed and about the company disclosure attempting to shift blame to its cloud service provider – are false. And the biz argues that Krebs participation in ad-based publishing motivated his alleged defamation: "Krebs intentionally misrepresented the truth because he was financially incentivized to do so. His entire business model is premised on publishing stories that conform to this narrative."
This is not the first time Krebs has reported on a Ubiquiti security incident that has had a material impact on the company's financials. In August, 2015, the firm [14]disclosed it had been defrauded of more than $46m by scammers sending spoofed email messages, and Krebs was among those [15]reporting on the affair .
The Register asked Krebs to comment, and he declined, citing the advice of counsel.
Via Twitter, [16]T. Greg Doucette , a criminal defense attorney and former computer scientist, opined that Ubiquiti's lawsuit would be considered an attempt to suppress lawful speech – a strategic lawsuit against public participation, or SLAPP – in states that have anti-SLAPP laws.
[17]
"It's a SLAPP: the coverage by Brian Krebs was substantially true and/or First-Amendment-protected opinion, and the lawsuit basically admits it in the text itself," Doucette [18]wrote . "But Ubiquiti intentionally filed in Virginia, because there's no anti-SLAPP statute there." ®
Editor's note: We're reminded of the time Keeper Security [19]sued Ars Technica and one of its reporters, Register-alumnus Dan Goodin, for an article he wrote in 2017. The libel suit was subsequently [20]dropped .
Get our [21]Tech Resources
[1] https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/
[2] https://www.theregister.com/2021/04/01/ubiquiti_data_breach/
[3] https://www.theregister.com/2021/12/02/nickolas_sharp_ubiquiti_hack_charged/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://storage.courtlistener.com/recap/gov.uscourts.vaed.521759/gov.uscourts.vaed.521759.1.0.pdf
[8] https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2021/04/01/ubiquiti_data_breach/
[11] https://www.theregister.com/2021/04/22/eff_proctorio_lawsuit/
[12] https://www.theregister.com/2020/03/27/grsecurity_bruce_perens_gpl_settlement/
[13] https://www.theregister.com/2019/08/26/black_hat_sued/
[14] https://www.theregister.com/2015/08/09/ubiquiti_stung_by_email_spoofing_fraud/
[15] https://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheist/
[16] https://www.tgdlaw.com/
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://twitter.com/greg_doucette/status/1509184336188350465?s=20
[19] https://talkingbiznews.com/they-talk-biz-news/software-company-sues-tech-site-ars-technica-journalist-goodin/
[20] https://twitter.com/keepersecurity/status/979810981504266240
[21] https://whitepapers.theregister.com/
On March 30, 2021, Krebs [1]reported that Ubiquiti [2]had disclosed a January breach involving a third-party cloud provider, later revealed to be AWS, and that an unnamed source within the firm had claimed the company was downplaying a catastrophic compromise.
On December 1, 2021, the US Department of Justice [3]charged former Ubiquiti software engineer Nickolas Sharp, accusing him of attempting to steal data from the company and to exhort $2m from the firm in Bitcoin ransom as part of an effort to reduce the price of Ubiquiti shares. The DoJ said that after Ubiquiti refused Sharp's payment demand, he tried to sink the company's shares by publishing stolen files and engaging in a media campaign to plant damaging stories about the firm.
[4]
The publication of these stories, on March 30 and 31, 2021, the DoJ said, coincided with a $4bn decline in Ubiquiti's market capitalization.
[5]
[6]
Ubiquiti, in its complaint
[7]PDF
, alleges that Krebs, after seeing the DoJ announcement, knew that the unidentified source he cited in his March articles – Sharp – had been indicted for involvement in the attack on Ubiquiti.And the biz contends he published on his Krebs-on-Security website [8]a story on December 2, 2021 that repeated prior claims while misleadingly referring to his source as "a Ubiquiti employee" and to Sharp as "a Ubiquiti developer" if they were separate individuals and without acknowledging that the two references were to the same person.
[9]
"Despite these damming [sic] facts, Krebs published a story on his blog the next day doubling down on his false accusations against Ubiquiti and intentionally misleading his readers into believing that his earlier reporting was not sourced by Sharp, the hacker behind the attack," the complaint says.
[10]Wi-Fi slinger Ubiquiti hints at source code leak after claim of 'catastrophic' cloud intrusion emerges
[11]Exam-monitoring biz Proctorio tried to silence a critic using copyright law. Now EFF sues to put an end to this tactic
[12]Grsecurity maker finally coughs up $300k to foot open-source pioneer Bruce Perens' legal bill in row over GPL
[13]Biz forked out $115k to tout 'Time AI' crypto at Black Hat. Now it sues organizers because hackers heckled it
The networking biz contends that the article's assertions – about the scope of the incident being underplayed and about the company disclosure attempting to shift blame to its cloud service provider – are false. And the biz argues that Krebs participation in ad-based publishing motivated his alleged defamation: "Krebs intentionally misrepresented the truth because he was financially incentivized to do so. His entire business model is premised on publishing stories that conform to this narrative."
This is not the first time Krebs has reported on a Ubiquiti security incident that has had a material impact on the company's financials. In August, 2015, the firm [14]disclosed it had been defrauded of more than $46m by scammers sending spoofed email messages, and Krebs was among those [15]reporting on the affair .
The Register asked Krebs to comment, and he declined, citing the advice of counsel.
Via Twitter, [16]T. Greg Doucette , a criminal defense attorney and former computer scientist, opined that Ubiquiti's lawsuit would be considered an attempt to suppress lawful speech – a strategic lawsuit against public participation, or SLAPP – in states that have anti-SLAPP laws.
[17]
"It's a SLAPP: the coverage by Brian Krebs was substantially true and/or First-Amendment-protected opinion, and the lawsuit basically admits it in the text itself," Doucette [18]wrote . "But Ubiquiti intentionally filed in Virginia, because there's no anti-SLAPP statute there." ®
Editor's note: We're reminded of the time Keeper Security [19]sued Ars Technica and one of its reporters, Register-alumnus Dan Goodin, for an article he wrote in 2017. The libel suit was subsequently [20]dropped .
Get our [21]Tech Resources
[1] https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/
[2] https://www.theregister.com/2021/04/01/ubiquiti_data_breach/
[3] https://www.theregister.com/2021/12/02/nickolas_sharp_ubiquiti_hack_charged/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://storage.courtlistener.com/recap/gov.uscourts.vaed.521759/gov.uscourts.vaed.521759.1.0.pdf
[8] https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2021/04/01/ubiquiti_data_breach/
[11] https://www.theregister.com/2021/04/22/eff_proctorio_lawsuit/
[12] https://www.theregister.com/2020/03/27/grsecurity_bruce_perens_gpl_settlement/
[13] https://www.theregister.com/2019/08/26/black_hat_sued/
[14] https://www.theregister.com/2015/08/09/ubiquiti_stung_by_email_spoofing_fraud/
[15] https://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheist/
[16] https://www.tgdlaw.com/
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YkTTExlxkic7WVgUmyjkiQAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://twitter.com/greg_doucette/status/1509184336188350465?s=20
[19] https://talkingbiznews.com/they-talk-biz-news/software-company-sues-tech-site-ars-technica-journalist-goodin/
[20] https://twitter.com/keepersecurity/status/979810981504266240
[21] https://whitepapers.theregister.com/
It's not rocket surgery...
veti
Simple rule: Companies should not be able to sue for defamation. Ever.
If there's evidence of actual wrongdoing, such as insider trading, then by all means let them prosecute it. But if all they've got is "he made money from ads on this story we don't like", they don't have even a toe to stand on.
Re: It's not rocket surgery...
Doctor Syntax
What if a journalist were to claim "X is selling refurbished returns as new." and it wasn't true. Shouldn't X be able to sue for defamation? If not not recourse do they have?
itb
Is Will Smith fully aware of these "anti-SLAAP" laws you speak of?
Yay for the link to the article.
Androgynous Cupboard
The paragraph after the problematic one states "(he was) ... charged with stealing data and trying to extort his employer while pretending to be a whistleblower ." (emphasis mine). It could possibly have been phrased a bit clearer that it was the same person, but it's not a deliberate attempt to mislead by any stretch.
That's the first rookie error - second is not suing for defamation in the UK. That's where the big bucks are, and our lawyers will take anyone's money as they've been keen to demonstrate over the previous decades.
Having never heard of Ubiquiti (so obviously there not ubiquitous. Sorry I couldnt resist that. ;) ), they have now entered my personal lexicon of firms I wont be doing any business with in the future.
Excellent use of the Streisand Effect, right there. Well done Ubiquiti...