Cisco has agreed to pay $8.6 million to settle a legal case that began when the company was accused of selling surveillance software that contained vulnerabilities. According to the charges, Cisco had been selling vulnerable software to government agencies U.S. for years.
Cisco had ignored the report that informed it about the vulnerabilities
In the lawsuit, filed in May 2011, James Glenn, who worked in Denmark for Cisco, claimed to have discovered vulnerabilities in Video Surveillance Manager (VSM) , a multi-application software package used to control surveillance cameras, store recorded video, and manipulate the video.
According to Glenn, a hacker could exploit these vulnerabilities and gain unauthorized access to data stored on VSM installations. In addition, they could gain administrator-level access to a customer's entire network.
Glenn said he informed Cisco of the existence of the security issues in October 2008. However, the company did not patch the vulnerabilities and continued to sell the VSM package to customers around the world, as well as to U.S. government agencies
This surveillance software is used by airports, police departments, and schools. Its goal is to provide security. So the existence of vulnerabilities is very worrying, since the software is not only not secure but also dangerous.
When Glenn saw that Cisco was ignoring his comments, he took legal action. Later, 18 other US states supported him: California, Delaware, Florida, Hawaii, Illinois, Indiana, Massachusetts, Minnesota, Montana, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, Rhode Island, Tennessee, Virginia and Columbia.
Cisco began fixing some bugs Glenn reported in 2013 and stopped selling the VSM package in 2014.
A Cisco spokesperson said: “We are pleased to resolve a dispute that began in 2011 and concerns the architecture of a security product. There was no allegation or evidence that any unauthorized access was made to customer systems .”
According to Mark Chandler, Cisco's Vice President, the $8.6 million represents a "partial refund to the US government and 16 states for products purchased between 2008 and 2013."
Of the $8.6 million, about $1.6 million will go to Glenn and his attorneys.
