Dallas T July 26 2020

News of ADT’s internal security breach tapped into people’s worst fears of being spied on in their own homes. But as more lawsuits are being filed against the security company by Dallas-area customers, ADT is fighting back with attempts to force them into arbitration.

At least five lawsuits have been filed in Dallas and in South Florida by North Texas ADT customers, and more are expected. Local law firms are seeking more victims in ads that offer free legal consultations.

ADT has even sued some of its customers in federal court in Dallas in an attempt to fend off lawsuits over the privacy invasion disclosed in April in which a technician who installed in-house security cameras gained access to the video and images from those cameras for years.

A former ADT technician suspected of accessing video of people in their homes remains under FBI investigation, court records show. No charges have been filed against the Oak Cliff man, but court records say a federal grand jury is examining evidence against him.

Lawsuit filings allege that Telesforo Aviles, 35, capitalized on a vulnerability in the ADT Pulse home security system to spy on customers using cameras he installed. Aviles gained access to as many as 220 accounts and spied on ADT customers using camera footage over the past seven years, court records show.

The Florida-based company is arguing that when its customers signed service contracts, they agreed to settle all disputes in arbitration rather than lawsuits. But it’s unclear whether that effort will be successful. At least one local lawyer, David Cole, says even the most conservative arbitration panel will likely award ADT customers large sums due to the “egregious” nature of the breach.

“It is just astounding to me that something so simple was not better protected,” said Cole, who currently does not represent anyone suing ADT. “How in the world can this happen?”

Tim Miller, a security expert, said he thinks ADT prefers arbitration so it can keep further details about the breach out of the public view. The case prompts many questions, he said, such as where the images ended up.

“Once it [images] hits the internet and the dark web, you’re not getting it back,” said Miller, a former Secret Service agent and 30-year law enforcement veteran who is president of Lionheart International Services Group in South Florida. “It’s sick and very scary.”

Miller said it’s surprising that ADT’s data was so easily compromised given that its business is security. And programs can easily be written into software to prevent it, he said. Data privacy, Miller said, is customers’ single greatest concern.

“That’s why we buy security systems,” he said. “To make sure it doesn’t happen.”

Miller said he never recommends indoor cameras except for ones near entrances to homes because hackers are getting more sophisticated.

“We’re not going to compromise your privacy to keep you safe,” he said.

Paul Wiseman, an ADT spokesman, said in a statement that the company “deeply regrets” the incident and has contacted all affected customers and “worked with many of them to resolve their concerns successfully.”

He said arbitration will help resolve the concerns of the remaining affected customers “more quickly” by working with an “independent, third-party arbiter.”

“We are supporting law enforcement’s investigation of the former employee and are committed to helping bring justice to those impacted by his improper actions,” Wiseman said.

Dallas is one of ADT’s larger markets, according to the company, which has 6 million customers nationwide.

The Pulse system allows customers to conveniently arm and disarm it remotely and view live video feeds. ADT discovered the breach in March after a DeSoto resident reported that an unauthorized email address belonging to Aviles had been added to the home’s account, with access to its security system.

ADT disclosed the breach to its customers in April. The company said in court filings that it was the first time an employee had ever abused “access privileges” in connection with its Pulse system, which has sold to more than 2 million customers over the past decade.

“That former employee used his personal email address to add himself as user to ADT customer accounts, then misused these credentials to gain unauthorized access,” the company said in legal filings.

Aviles could not be reached. His lawyer, Tom Pappas, said that “in every case in which Mr. Aviles has been pursued civilly, we have filed general denials to the civil accusations. There is an ongoing criminal investigation and we are cooperating fully. We look forward to being able to provide more information but can only do that through the litigation process.”

Darryl and Kamala Richmond sued ADT and Aviles on June 26 in Dallas County, alleging a “staggering invasion of privacy.”

The Tarrant County couple say in their lawsuit that an ADT representative called them in April to tell them Aviles had accessed their account 117 times over a 42-day period to “spy on them and their three minor sons in their most private moments at home.”

The ADT rep told the Richmonds that Aviles entered his personal email address into the control panel when he installed the system, the lawsuit said. That gave him access to live footage from the cameras inside their home “at any time of day on his personal smartphone or other device,” the lawsuit says.

ADT sued the Richmonds in federal court on July 21, saying they filed suit even though they had agreed to resolve their dispute in arbitration.

Taylor Madison, 31, a single woman who lives alone in the Kessler Park area of Dallas, signed a contract with ADT in February, according to an affidavit in her lawsuit.

“In recent years, serious crimes have been reported in my neighborhood,” her affidavit says. “Due to my situation, I decided to purchase a home security system.”

Her contract called for monthly payments of $57.99, court records show. The camera in her home was able to view her living room, kitchen, dining room and the hallway to her bedroom, the affidavit says.

ADT waited a month to inform her of the security breach, she said, after the company learned of “Mr. Aviles’ vile actions.”

Madison, a travel agent, says in her lawsuit, filed in late May against Aviles, that ADT has refused to turn over video recordings and still images taken of her inside her home without her knowledge. Her mother, Angie Dickson, has joined her lawsuit as a plaintiff because although she isn’t an account holder, she was harmed by Aviles’ alleged spying.

Dickson frequently visited her daughter’s home, the lawsuit said, and “had an expectation of privacy” when there.

Aviles accessed Madison’s home security cameras 139 times from Feb. 25 to March 25, her lawsuit says. Madison said ADT was so concerned for her safety that it hired a 24-hour security guard to sit outside her home for two weeks. In her lawsuit, she has sought evidence from ADT about the security breach.

“The things that they told me and actions they took over the next few days made me believe I was in grave danger,” Madison said in a statement to The Dallas Morning News. “I have spent the last three months living in fear and uncertainty. … I just wish I knew more so I could sleep at night!”

Her lawsuit says ADT recently gave the FBI with the same information she is seeking. “Plaintiffs have no idea what Aviles saw or if he recorded them when he was spying on them,” her suit says. “ADT investigators alluded to digital captures of plaintiff.”

But ADT said “even the most naive observer would be skeptical of” Madison’s contention that her subpoena for ADT information is to bring a class-action lawsuit against a “now-unemployed service technician who is subject to a criminal investigation.” The company called her subpoena a “tactical end-run around arbitration.”

Madison said in a recent filing that Dickson is not an ADT account holder and therefore “cannot be subject to the arbitration agreement ADT is seeking to enforce.”

Cole, the Dallas attorney, said arbitrators will likely be “horrified” by the facts of the case.

“You think about your home — it’s the one place where you should feel comfortable and safe,” he said.

Updates on the security breach are available at the following site adt.com/adt-privacy-notice.

The Dallas Morning News

Share this post: on Twitter on Facebook