State of New Jersey v. E-Sports Entertainment

Acting Attorney General John J. Hoffman, the Division of Law and the Division of Consumer Affairs announced today that on-line video gaming company E-Sports Entertainment, LLC, has entered into a $1 million settlement that resolves allegations it infected thousands of personal computers with malicious software code enabling E-Sports to monitor what programs subscribers were running and illegally mine for bitcoins.

In a formal complaint filed today along with two consent judgments outlining the settlement, the State alleges that E-Sports created and deployed malicious software code that infected the computers of thousands of customers who subscribed to its anti-cheat services for popular on-line video games.

According to the complaint, the malicious code enabled E-Sports to monitor users' computers even when they were not signed onto or using E-Sports services. E-Sports also created a botnet – a network of computers running malicious software -- using its customers' computers. The botnet used the computing resources of users' computers to mine for bitcoins, a virtual form of currency. It is estimated that, during a single two-week period, E-Sports took control of approximately 14,000 computers in New Jersey and across the nation, and generated approximately $3,500 by mining for bitcoins.

"This is an important settlement for New Jersey consumers,” said Acting Attorney General Hoffman. "These defendants illegally hijacked thousands of people's personal computers without their knowledge or consent, and in doing so gained the ability to monitor their activities, mine for virtual currency that had real dollar value, and otherwise invade and damage their computers.

"This case should serve as a message that we are committed to protecting New Jersey consumers, and that we will hold accountable anyone who seeks to exploit them through misleading claims, deceptive practices or the invasion of their computer privacy,” Hoffman said.

As part of its settlement with the State, E-Sports has agreed to refrain from deploying software code that downloads to consumers' computers without their knowledge and authorization. The company also must submit itself to a 10-year compliance program and create a dedicated page on its Web site that specifies what type of data it collects, the manner in which the data is collected, and how the information is used.

E-Sports must pay the State $325,000 of its $1 million settlement obligation. The remainder is suspended and will be vacated within 10 years, provided the company adheres to all settlement terms and avoids future violations of the law.

”Consumers who subscribed to E-Sports' video game anti-cheat services paid for protection from cheaters – not to be cheated by the very services they'd purchased,” said Division of Law Director Christopher S. Porrino. "Companies that collect consumer information and access users' computers have a duty to ensure that protocols and procedures are in place to protect the information they collect. Moreover, no company should obtain more access or information than is necessary to engage in the legitimate operation of its business.”

"Following our $1 million settlement with PulsePoint earlier this year, today's settlement serves as another victory for consumer privacy for New Jersey consumers and consumers across the country," said Division of Consumer Affairs Director Eric T. Kanefsky. "Whether through the circumvention of browser settings, unlawfully mining for bitcoins or by failing to adequately protect customers' personal data from breaches, our office will hold accountable those companies and individuals that violate consumers' expectations of privacy.”

E-Sports co-founder Eric Thunberg and E-Sports software engineer Sean Hunczak are each parties to the settlement being announced today.

E-Sports was established in 2006 and is based in Commack, NY. E-Sports charges subscribers $6.95 per month to play E-Sports-supported games against other E-Sports subscribers on the company's hosted, anti-cheat game servers. To play on E-Sports-hosted game servers, subscribers must download and install E-Sports software onto their computers. Once installed, the software enables E-Sports full administrative access to subscribers' computers.

The State's complaint alleges that, via its software, E-Sports downloaded malicious software code onto subscribers' computers that enabled E-Sports to monitor what programs were run by subscribers, even when those subscribers were not using E-Sports services and the E-Sports software was not turned on.

The complaint also alleges that Thunberg and Hunczak developed the malicious bitcoin-mining software code that enabled them to use the graphics processing units of subscribers' computers to mine for bitcoins undetected.

As part of the process, the complaint alleges that Hunczak turned E-Sports' subscribers' computers into a botnet for the purpose of mining bitcoins. The bitcoin-mining software code enabled Hunczak to mine for bitcoins only when users were away from their computers.

The State's complaint alleges that Hunczak created at least four bitcoin "wallet” addresses where he deposited bitcoins mined via the E-Sports botnet. Hunczak allegedly then sold the mined bitcoins, converting them into U.S. dollars and ultimately depositing them into a personal bank account. According to the State's complaint, Thunberg supervised Hunczak's activities, provided Hunczak with input, and authorized Hunczak to use company time to develop, create and test the E-Sports bitcoin mining code. E-Sports apparently terminated use of the bitcoin mining code in May 2013 after an E-Sports subscriber discovered it.

The complaint filed today charges E-Sports, Thunberg and Hunczak with violating New Jersey's Consumer Fraud Act and the State's Computer Related Offenses Act.

In addition to the $325,000 settlement payout and a general agreement to refrain from any unfair or deceptive acts, E-Sports has agreed under the settlement to a variety of changes in its practices. Among the changes is creation of a new consumer information page that, among other things, will include information on how consumers can restrict, limit, opt-out of, or otherwise control the data or consumer information collected by E-Sports about them or their computers.

The company also has agreed to put in place a privacy and data security program that contains comprehensive privacy controls and procedures, and is designed to ensure the confidentiality of consumer information. As part of the program, E-Sports has agreed to regular testing or monitoring of its security controls. It also has agreed to hire a third-party professional to conduct a Privacy and Security Audit Report covering the first 90 days after the settlement's effective date and, subsequently, every two years through 2023.


___________________________________________

JOHN J. HOFFMAN, Acting Attorney General of the State of New Jersey, and EzuC T. KANEFSKY, Director of the New Jersey Division of Consumer Affairs, Plaintiffs, v. E-SPORTS ENTERTAINMENT, LLC; EzuC THLINBERG and SEAN HLINCZAK; JANE and JOHN DOES 1-10, individually and as owners, officers, directors, shareholders, founders, managers, agents, employees, representatives and/or independent contractors of E-SPORTS ENTERTAINMENT, LLC; And XYZ CORPORATIONS 1-10, Defendants. SLIPEzuOR COURT OF NEW JERSEY CHANCERY DIVISION, ESSEX COUNTY DOCKET NO. RËÇHIVffiMIFItËD NCIV 1 g ?û,t3 - Supe#or Courl of New Jersey Generol Equfiy - Essex Vlclnoga Civil Action

COMPLAINT

Plaintiffs John J. Hoffrnan, Acting Attorney General of the State of New Jersey ("Attorney General"), with offices located at 124 Halsey Street, Fifth Floor, Newark, New Jersey, and Eric T. Kanefsky, Director of the New Jersey Division of Consumer Affairs ("Director"), with offices located at I24 Halsey Street, Seventh Floor, Newark, New Jersey, by way of Complaint state:

PRELIMINARY STATEMENT

1. In April 2073, Defendants E-Sports Entertainment, LLC ("ESEA" or the 'oCompany"), Eric Thunberg ("Thunberg") and Sean Hunczak ("Hunczak") (collectively "Defendants") created and developed malicious software code that infected the computers of thousands of ESEA customers ("end-users"). Using ESEA's videogame anti-cheat software program ("ESEA Software"), from April 12, 2013 through April 30, 2013, at least Defendant Hunczak, downloaded the malicious software code onto end-users' computers to create an unauthorized computer network for the purpose of mining for bitcoins ("ESEA Botnet").

2. Additionally, from at least April 3, 2013, at least defendant ESEA purposely or knowingly and without authonzation, or in excess of authorization, accessed and monitored the computer activities of end-users, at all times, even when those end-users were not using ESEA services or logged onto ESEA servers.

3. Defendants' conduct constitutes deceptive and unconscionable commercial practices pursuant to the New Jersey Consumer Fraud Act, N.J.S.A. 56:8-1 et seq. ("CFA") and unauthorized access pursuant to the New Jersey Computer Related Offenses Act, N.J.S.A. 2A:384-1 et !gq. ("CROA"). The Attorney General and Director (collectively, "Plaintifß") submit this Complaint seeking equitable relief, to prevent any more consumers from being victimized by Defendants' practices, as well as penalties, restitution, investigative costs, and attomeys'fees.

JURISDICTION AND PARTIES

4. The Attomey General is charged with the responsibility of enforcing the CFA and the CROA. The Director is charged with the responsibility of administering the CFA and the CROA on behalf of the Attorney General

5. By this action, Plaintifß seek injunctive and other relief for violations of the CFA and the CROA. Plaintifß bring this action pursuant to their authority under the CFA, specifically N.J.S.A. 56:8-8, 56:8-11, 56:8-13 and 56:8-19, and the CROA, specifically N.J.S.A. 2A:384-5. Venue is proper in Essex County, pursuant to R. 4:3-2, because it is a county in which Defendants have otherwise conducted business.

6. Defendant ESEA is a New York Limited Liabitity Company est¿blished on October I0,2006. Upon information and belief, at all relevant times, ESEA has maintained a business and mailing address of 62 Rensselaer Drive, Commack, New York 11725. ESEA's registered agent is Craig Levine, who maintains a mailing address of 62 Rensselaer Drive, Commack, New York 11725.

7. Defendant Thunberg is a member and co-founder of ESEA. Upon information and belief, at all relevant times Thunberg maintained a business address of 62 Rensselaer Drive, Commack, New York 11725.

8. At all relevant times, Defendant Hwrczakwas the software developer for ESEA. Upon information and belief, at all relevant times Hunczak mairrtained a business address of 62 Rensselaer Drive, Commack, New York 11725.

9. Upon information and belief, John and Jane Does 1 through 10 are fictitious individuals meant to represent the owners, officers, directors, shareholders, founders, managers, agents, employees, representatives and/or independent contractors of ESEA ,who have been involved in the conduct that gives rise to this Complaint, but are heretofore unknown to the Plaintiffs. As these defendants are identified, Plaintifß shall amend the Complaint to include them.

10. Upon information and belief XYZ Corporations 1 through 10 are fictitious corporations meant to represent any additional corporations that have been involved in the conduct that gives rise to this Complaint, but are heretofore unknown to the Plaintiffs. As these defendants are identified, Plaintiffs shall amend the Complaint to include them. FACTUAL BACKGROT]ND AND GENERAL ALLEGATIONS

11. ESEA is an online video game subscription company that sells anti-cheat services for popular video games such as Counter Strike, Counter Strike Global Offensive, Counter Strike Source, and Team Fortress 2 ("ESEA Supported Games"). The company purports to be the "largest competitive video gaming community in North America."

12. Sometime in April 2013, defendants Hunczak and Thunberg created and developed software code that Hunczak later executed on end-user computers via the ESEA Software. The software code created and developed by Hunczak and Thunberg enabled Defendants to use the graphics processing unit ("GPU") of end-users' computers to mine for bitcoins without any notice to those end-users ("ESEA Bitcoin Mining Code").

13. On or about April 3, 2013, ESEA, through its employees, further created code to monitor the programs that ESEA end-users ran on their computers, even when those end-users were not using ESEA services and the ESEA Software was not turned on ("ESEA Monitoring Code").

ESEA General Business Practices and the ESEA Software

14. ESEA end-users pay a$6.95 monthly subscription fee to play ESEA Supported Games on the Company's hosted anti-cheat game servers.

15. To play on ESEA hosted game servers, end-users must download and install ESEA Software onto their computers. Once installed, the ESEA Software enables ESEA full administrative access of end-users' computers.

16. At least defendants Hunczak and Thunberg had fuIl administrative access to all end-users' computers. The ESEA Software enabled Defendants to not only monitor end-user computer activity but also view and upload any and all end-users' computer files.

17. Among the many monitoring activities conducted by ESEA, the ESEA Software was programmed to automatically capture screen shots of computers, track computer mouse movements, and monitor end-users' computer activities even'when they were not logged onto ESEA servers.

18. ESEA did not place any restrictions on Hunczak and Thunberg's ability to access end-users' computers.

19. ESEA did not put policies and procedures in place to ensure its employees were not abusing their full administrative access privileges or inappropriately accessing end-users' computer files.

ESEA Computer Monitoring and File Copying

20. On or about April 3, 2013, using the full administrative access to end-users' computers, ESEA created the ESEA Monitoring Code to track the programs that ESEA endusers ran on their computers. The ESEA Monitoring Code monitored computer activity even when end-users were not using ESEA services and the ESEA Software was not turned on. ESEA concealed the ESEA Monitoring Code in the ESEA Software driver on end-users' computers. ESEA also programed the ESEA Software to reload the ESEA Monitoring Code even if endusers attempted to "unload" the driver.

21. Prior to implementation, Thunberg approved the ESEA Monitoring Code and allowed the ESEA Monitoring Code to be place on end-users' computers via the ESEA Software.

22. In at least several instances, ESEA employees used the ESEA Software to copy files from ESEA end-users' computers.

Background on Bitcoins

23. Bitcoins are a decentralized virtual form of crrrency that are purchased through online exchanges, transferred between individuals through electronic "wallets," or acquired through "mining."

24. Each bitcoin is generated through a process known as "mining." To mine for bitcoins, the central processing unit ("CPU") and GPU of computers are set to solve complex mathematical problems on a peer-to-peer network. To maintain a consistent level of bitcoin mining, the more processing power that users dedicate to the peer-to-peer mining network, the more difficult the mathematical problems become.

25. Multiple users can join mining "pools" and use their computers collaboratively toward mining for bitcoins.

26. Once a bitcoin is mined, a timestamped public record of that bitcoin is maintained on a "block chain." The public record of each timestamped bitcoin acts to prevent double spending. Once mined, a bitcoin can then be transfened between users or purchased and sold through online exchanges.

Background on Botnets

27. Generally, a botnet is a network of computers running malicious software ("malware"). A botnet is comprised of numerous computers, scattered across many locations, infected with malware. The individuals and organizations running a botnet via malware are able to command and control infected computers for a variety of purposes, typically without an user's knowledge that maiware is even running on their computer.

28. A computer may become infected and part of a botnet when, for example, a computer user interacts with a malicious website advertisement, views a malicious email attachment, or downloads a malicious piece of software.

29. In this action, Defendants Hunczak and Thunberg developed and created a botnet, via the ESEA Bitcoin Mining Code, for the purpose of mining for bitcoins using the GPU of endusers' computers.

ESEA Bitcoin Mining Botnet

30. Defendant Hunczak developed and created the ESEA Bitcoin Mining Code.

31. Defendant Thunberg supervised Hunczak's activities, provided Hunczak with input, and authorized,Hunczak to use ESEA company time to develop, create, and test the ESEA Bitcoin Mining Code.

32. Defendant Hunczak later executed the ESEA Bitcoin Mining Code on end-users' computers via the ESEA Software to create the ESEA Botnet.

33. From at least April 12,2073 through April 30, 2073, the ESEA Botnet used the GPU of end-users' computers to mine for bitcoins without notice to and authorization from, or in excess of authorization from, end-users.

34. Once executed and running on end-users' computers, the ESEA Bitcoin Mining Code was set to mine for bitcoins only when end-users' were away from their computer. Among other methods, the code detected whether end-users were active on their computers by monitoring end-users' mouse movements and/or mouse location.

35. Defendant Hunczak created at least four bitcoin wallet addresSes where he deposited bitcoiàs mined from the ESEA Botnet.

36. Defendant Hunczak then sold the bitcoins from the ESEA Botnet, converting the bitcoins into U.S. dollars. The proceeds were then deposited into Hunczak's personal bank account. COI.INT I

VIOLATION OF'THE CFA BY DEFENDANTS

(UNCONSCIONABLE COMMERCIAL PRACTICES)

37. Plaintiffs repeat and reallege the allegations contained in Paragraphs 1 through 36 above as if more fully set forth herein.

The CFA, N.J. S.A. 56.8-2, prohibits:

The act, use or employment by any person of any unconscionable commercial practice, deception, fraud, false pretense, false promise, misrepresentation, or the knowing i ] concealment, suppression, or omission of any material fact with intent that others rely upon such concealment, suppression or omission, in connection with the sale or advertisement of any merchandise....

38. In the sale of their services, Defendants have engaged in unconscionable commercial practices and deceptions, including, but not limited to, the following:

a. Obtaining full computer access to .end-users' computers without placing adequate secwity measures, policies, protocols, or restrictions on ESEA employees' use of such access;

b. Failing to supervise, monitor, review, or maintain records of the ESEA Software updates dornloaded onto end-users' computers by ESEA employees;

c. Failing to supervise, monitor, or review the information collected from end-users' computers by ESEA employees;

d. Creating and downloading the ESEA Monitoring Code onto end-users' computers;

e. Monitoring the computer activities of end-users through the ESEA Monitoring Code, even when end-users' computers were not using ESEA services and the ESEA Software was not turned on;

f. Authorizing, directing, developing, and/or creating malware for the purposes of infecting end-users' computers to mine for bitcoins; and

g. Using the ESEA Software to download and deploy malware onto end-users' computers, thereby creating a botnet to mine for bitcoins;

39. Defendants' unconscionable commercial practices constitute multiple violations ofN.J.S.A. 56:8-2.

COUNT II

VIOLATION OF THE CFA BY DEF'ENDANTS

(MISREPRESENTATIONS AND OMISSIONS OF MATERIAL FACT)

40. Plaintiffs repeat and reallege the allegations contained in Paragraphs i through 39 above as if more fully set forth herein.

41. In the operation of ESEA, Defendants have made false promises, misrepresentations and/or knowing omissions of material fact, including, but not limited to:

a. Misrepresenting to end-users that the ESEA Software is used for anti-cheat services when it was used for other purposes by ESEA employees; and

b. Failing to disclose that the ESEA Software monitored the computer activities of end-users even when they were not using ESEA services or logged onto the ESEA Software.

42. Defendants' misrepresentations, false promises, and/or omissions of material fact constitute multiple violations of N.J.S.A. 56.8-2.

COUNT III

VIOLATION OF THE CROA BY DEFENDANTS

43. Plaintiffs repeat and reallege the alleiations contained in Paragraphs I t:rough 42 above as if more fully set forth herein.

44. The Computer Related Offenses Act prohibits:

The purposeful or knowing, and unauthoized accessing or attempt to access any computer, computer system or computer network; [N.J. S.A. 2A:3 8A-3 (c)]

45. ESEA end-users' computers were damaged as a result of Defendants' ESEA Bitcoin Mining Code, ESEA Monitoring Code, and other related business activities.

46. Defendants violated the CROA through the following acts:

a. Purposefully or knowingly accessing or attempting to access, without authorization, end-users' computers through the ESEA Software;

b. Purposefully or knowingly accessing or attempting to access, without authorization, end-users' computers through the use of the ESEA Monitoring Code; and

c. Purposefully or knowingly accessing or attempting to access, without authorization, end-users' computers through their use of the ESEA Bitcoin Mining Code.

47. Defendants' conduct constitutes multiple violations of the CROA.

PRAYER FOR RELIEF WHEREFORE, based upon the foregoing allegations, Plaintiffs respectfully request that the Court enter judgment against Defendants:

(a)

(b)

(c)

(e)

(Ð


Newark, New Jersey

(d)

Finding that the acts and omissions of Defendants constitute multiple instances of unlawful practices in violation of the CFA and CROA;

Permanently enjoining Defendants and their owners, officers, directors, shareholders, founders, managers, agents, employees, representatives, independent contractors and all other persons or entities directly under their control, from engaging in, continuing to engage in, or doing any acts or practices in violation of the CFA and CROA, including, but not limited to, the acts and practices alleged in this Complaint;

Permanently enjoining Defendants Eric Thunberg and Sean Hunczak and their agents, employees, representatives, independent contractors and all other persons or entities directly under their control, from operating, managing or otherwise controlling any business activity within the State of New Jersey or directed to New Jersey consumers;

Directing the assessment of restitution amounts against Defendants, jointly and severally, to restore to any affected person, whether or not named in this Complaint, any money or real or personal properly acquired by means of any alleged practice herein to be unlawful and found to be unlawful, as authorizedby N.J.S.A. 56:8-8, N.J.S.A. 2A:384-3, and N.J.S.A. 2C:41-l;

Assessing the maximum statutory civil penalties against Defendants, jointly and severally, for each violation of the CFA, in accordance with N.J.S.A. 56:8-13; Directing the assessment of costs and fees, including Plaintiffs' investigation costs and attorneys' fees against Defendants, jointly and severally, for the use of the State of New Jersey, as authorized by the CFA and CROA; and Granting such other relief as the interests ofjustice may require.

JOHN J. ACTING Attomey HOFFMAN ATTORNEY GENERAL OF NEW JERSEY for Plaintiffs Deputy Attomey General Glerur Graham Edward Mullins Deputy Attomeys General Kevin Jespersen Brian McDonough Assistant Attorneys General (e)

I certify, to the best of my information and belief, that the matter in controversy in this action involving the aforementioned violations of the New Jersey Consumer Fraud Act, N.J.S.A. 56:8-1 et seq., is not the subject of any other action pending in any other court of this State. I am aware that private contract and other actions have been brought against the Defendants, but have no direct information that any such actions involve consumer fraud allegations. I further certify that the matter in controversy in this action is not the subject of a pending arbitration proceeding in this State, nor is any other action or arbitration proceeding contemplated. I certify that there is no other party who should be joined in this action at this time.

JOHN J. HOFFMAN

ACTING ATTORNEY GENERAL OF NEW JERSEY Attorney for Plaintiffs Deputy Attorney General Glenn Graham Edward Mullins Deputy Attorneys General Kevin Jespersen Brian McDonough Assistant Attomeys General Dated: l.tmgr.l^,r lÇ ,2013 Newark, New Jersey DESIGNATION OF TRIAL COT]NSEL

Pursuant to R. 4:25-4, Deputy Attorneys General Jah-Juin Ho, Edward Mullins, and Glenn Graham and Assistant Attorneys General Kevin Jespersen and Brian McDonough are hereby designated as trial counsel on behalf of Plaintiffs in this action. JOHN J. HOFFMAN ACTING ATTORNEY GENERAL OF NEW JERSEY Attorney for Plaintiffs Deputy Attorney General Glenn Graham Edward Mullins Deputy Attomeys General Kevin Jespersen Brian McDonough Assistant Attomeys General Dated: l,lct¡edbor l1 ,2013 Newark, New Jersey JOHN J. HOFFMAN ACTING ATTORNEY GENERAL OF NEV/ JERSEY Division of Law I24Ralsey Street - 5ú Floor P.O. Box 45029 Newark, New Jersey07l 01 Attorney for Plaintiffs By: Jah-Juin Ho- #033032007 Glenn Graham- #013222009 Edward Mullins- #027 892006 Deputy Attomeys General 973-648-2500


JOHN J. HOFFMAN, Acting Attorney General of the State ofNew Jersey, and ERIC T. KANEFSKY, Director of the New Jersey Division of Consumer Affairs, Plaintiffs, v. E-SPORTS ENTERTAINMENT, LLC; ERIC THUNBERG and SEAN HI-INCZAK; JANE and JOHN DOES 1-10, individually and as owners, officers, directors, shareholders, founders, managers, agents, employees, representatives and/or independent contractors of E-SPORTS ENTERTAINMENT, LLC; ANd XYZ CORPORATIONS 1-10, Defendants. Kevin Jespersen Brian McDonough - #026121980 Assistant Attomeys General SUPERIOR COURT OF NEW JERSEY CHANCERY DIVISION, ESSEX COUNTY DOCKET NO. Civil Action CONSENT JUDGMENT OF DEFENDANTS E.SPORTS ENTERTAINMENT, LLC AND ERIC THTTNBERG

1. The Attorney General of the State of New Jersey ("Attorney General") is charged with the responsibilrty of enforcing the New Jersey Consumer Fraud Act, N.J.S.A. 56:8-1 et seq. ("CFA") and the Director of the New Jersey Division of Consumer Affairs ("Director") is charged with the responsibility of administering the CFA on behalf of the Attomey General.

2. This matter was opened to the Court by the filing of a Complaint on behalf of the Attorney General and Director (collectively, "Plaintiffs") pursuant to the provisions of the CFA and the New Jersey Computer Related Offenses Act, N.J.S.A. 2A:384-1 etseq. ("CROA") against defendants E-sports Entertainment, LLC ("ESEA"), Eric Thunberg ("Thunberg") (collectively, "settling Defendants") and Sean Hunczak ("Hunczak") (collectively with Settling Defendants, "Defendants") alleging that Defendants have engaged in conduct in violation ofthe CFA and CROA.

3. Plaintiffs and Settling Dçfendants entered into this Consent Judgment for settlement purposes only. Settling Defendants deny the allegations and claims as set forth in the Complaint. Neither the fact of, nor any provision contained in this Consent Judgment shall be construed as an admission by Settling Defendants that any of their acts or practices described in the Complaint or prohibited by this Consent Judgment violate the CFA and CROA.

THEREFORE IT IS on this AND ADJUDGED as follows:

2013 ORDERED EFFECTIVE DATE

4. This Consent Judgment is effective on the date that it is entered by the Court ("Effective Date").

DEFTNITIONS

As used in this Consent Judgment, the following words or terms shall have the following meanings, which meanings shall apply wherever the words and terms appear in this Consent Judgment:

5. "Attomey General" shall referto the Attomey General ofthe State ofNewJersey and the Offrce of the Attorney General of the State ofNew Jersey. day of

6. "Clearly and Conspicuously" shall mean a statement that, regardless ofthe medium in which it is made, is presented in such type, size, color, contrast, duration, location and audibility, compared to the other information with which it is presented, that it is readily apparent and understandable and in language and terms used in accordance with their cornmon or ordinary usage and meaning. If such statement modifies, explains or clarifies other information with which it is presented, it must be presented in proximity to the information it modifies, explains or clarifies and in a manner that is readily apparent and understandable.

7 . "Consumer Information" shall mean information Defendant collects from or about a person, including but not limited to: (a) first and last name; (b) home or other physical address, including street name and city; (c) email address or other online contact information, such as auser identifier or screen name; (d) persistent identifier (e.g. IP address or LIDID); (e) telephone number; (f) contact lists or address books; (g) geographic/physical location; (h) demographic information (e.g. race, gender, age, etc.); or (h) any other information about a person that is combined with subsections (a) through (g) above.

8. "Person[s]," "Consumer," or "EndlJser" shall mean "Person" as defined inN.J.S.A. s6:8-1(d).

g. "Represent" shall mean to state or imply through claims, statements, questions, conduct, graphics, symbols, lettering, formats, devices, language, documents, messages or any other manner or means by which meaning might be conveyed. This definition applies to other forms of the word "Represent" including, without limitation, "Representation" and "Misrepresent."

10. "State" shall refer to the State of New Jersey. BUSINESS PRACTICES

11. Settling Defendants shall not engage in any unfair or deceptive acts or practices in the conduct of their businesses in the State and shall comply with all applicable State and./or Federal laws, rules and regulations as now constituted or as may hereafter be amended including, but not limited to, the CFA and CROA.

12. Settling Defendants shall not download or otherwise deploy any computer code, program, or software onto aperson's computer without explicit authonzation and without clear and conspicuous notification prior to such deployment.

13. Settling Defendants shall not upload, copy, store, or otherwise access the files stored on a consumers' computers without explicit authorization and without clear and conspicuous notification prior to such access.

14. Settling Defendants shall not monitor the computer activities of any person without explicit authorization and without clear and conspicuous notification prior to such monitoring.

15. Settling Defendants shall not misrepresent or omit a material fact conceming: (1) the purposes for which they collect and use data or Consumer Information about a person or their computer; or (2) the extent to which Settling Defendants exercise control over the collection and use of data or Consumer Information about an person or their computer.

16. No later than thirty (30) days from the Ef[ective Date, Settling Defendants shall post a page or pages on the ESEA website to provide consumers with information about the types of data and information ESEA collects and the manner such information and types of data are used ("Consumer Information Page"). A link to the Consumer Information Page shall be clearly and conspicuously posted on the ESEA homepage. The contents of the Consumer Information Page shall include:

a detailed list of the types of data and Consumer Information ESEA collects or ts capable of collecting about consumers and their computers;

b. a detailed description of how the types of data and Consumer Information listed in subsection (a) is maintained and used and whether such data or Consumer Information is transferred to third parties; and

c. information about how consumers can restrict, limit, opt-out or otherwise contol the data or Consumer Information collected by ESEA about them or their computers.

17. Withinthirty (30) days of the Effective Date, Settling Defendants shall implement a privacy and data security prog¿rm ("Privacy and Data Security Program"), that contains comprehensive privacy controls and procedures and that is designed to protect the privacy, security, and confidentiality of consumer dataand Consumer Information.

18. The Privacy and Data Security Program shall include:

a. the designation of an employee or employees responsible for such program;

b. an independent privacy and data security audit report ("Privacy and Security Audit Report");

c. the designation and implementation of reasonable privacy and security controls and procedures to address the risks and issues identified in the Privacy and Security Audit Report; and

d. Regular testing or monitoring of the effectiveness of privacy and data security controls and procedures.

e. The Privacy and Security Audit Report shall be prepared by an independent thirdparfy professional who uses procedures and standards generally accepted in the profession. A person qualified to prepare the Privacy and Security Audit Report shall have a minimum of five (5) years of experience in the fields ofprivacy and data protection. All persons preparing a Privacy and Security Audit Report shall be approved by the New Jersey Offrce ofthe Attorney General, Division of Law at its sole discretion. The reporting period shall cover: (1) the first 90 days afterthe Effective Dafe; and (2) every two year period thereafter for ten years after the Effective Date. Settling Defendants shall submit a copy of the Privacy and Security Audit Report to the Division no later than l0 business days after each reporting period.

20. The Privacy and Security Audit Report shall:

a. set forth, in detail, the types of data and Consumer Information collected by Settling Defendants and the purpose for collecting each type of data and Consumer Information;

b. explain why the collection of each type of dataand Consumer Information identified in subsection (a) is reasonably necessa.ry to Settling Defendants' business activities;

c. set forth the privacy and data security controls and procedures that Settling Defendants have implemented and maintained during each reporting period;

d. explain how such privacy and data security controls and procedures are appropriate to adequately protect the data and Consumer Information collected by Settling Defendants;

e. measure the impact of Settling Defendants' data collection practices on consumer privacy and data security;

f. identiff and assess the validity of all consumer complaints concerning privacy and data security dwing each reporting period;

g. identifu reasonably foreseeable material risk, both internal and external, that could result in Settling Defendants' unauthorized collection, use, or disclosure of data or Consumer Information; and

h. certifu that the privacy and data security controls and procedures are operating with suffrcient effectiveness to protect the privacy and data security of consumers and that the controls have so operated throughout the reporting period.

21. Withinthirty (30) days of the Effective Date, Settling Defendants shall:

a. deliver this Consent Judgment to ESEA's executive management;

b. deliver this Consent Judgment to employees of ESEA having supervisory responsibilities for implementation of the Privacy and Data Security Program;

c. deliver this Consent Judgment to employees of Settling Defendants having access to Consumer Information; and

d. deliver this Consent Judgment to Settling Defendants' attomeys whose responsibilities include providiíg advice about the privacy and data security.

22. Settling Defendants shall cooperate with any further requests made by the Office of the Attorney General and the Director, with respect to any practices, documents, or information relating to itself, Defendant Hunczak, and any third party. Settling Defendants shall produce all such documents or information within 15 days of receiving such request.

SETTLEMENT PAYMENT

23. Plaintiffs and the Settling Defendants (collectively, the "Parties") have agreed to a settlement ofPlaintifß' Complaint inthe amount of One Million and 00/100 Dollars ($1,000,000.00) ("settlement Payment"). ESEA shall be solely liable for the entire Settlement Payment. In the event ESEA fails to meet the Settlement Payment obligations under this Section, Thunberg shall be liable for no more than One Hundred Fiffy Thousand and 00/100 ($150,000.00) of the Settlement Payment.

24. From the Settlement Payment, Six Hundred Seventy-Five Thousand and 00/100 Dollars ($675,000.00) shall be suspended an automatically vacated within ten (10) years of the Effective Date ("Suspended Penalty"), provided:

a. Settling Defendants comply with the restraints and conditions set forth in this Consent Judgment; and

b. Settling Defendants do not engage in any acts or practices in violation of the CFA and CROA.

25. In the event Settling Defendants fail to comply with the restraints and conditions of this Consent Judgment, the entire Suspended Penaþ shall be immediately due and payable to Plaintiffs.

26. The Settlement Payment, excluding Suspended Penalty, shall consist of a civil penalty of Two Hundred Five Thousand Seven Hundred Ten and 4gll00 Dollars (5205,710.49) pursuant to N.J.S.A. 56:8-13 and N.J.S.A.2A:65B'-3, Fifteen Thousand Two Hundred Three and 671100 Dollars ($15,203.67), as reimbursement of the Division's attorneys' fees, Four Thousand Eighty-Five and 84/100 Dollars ($4,085.84) as reimbursement of the Division's investigative costs, pursuant to N.J.S.A. 56:8-11 and N.J.S.A. 56:8-19, and One Hundred Thousand Dollars ($100,000.00) to be used at the sole discretion of the Attorney General for the promotion of consumer privacy programs, including the purchase of investigative tools and the retention of technologies, consultants, and experts.

27 . Settling Defendant shall make the Settlement Payment, excluding Suspended Penalty, of Three Hundred Twenty-Five Thousand ($325,000.00) in installments as follows:

a. One Hundred Twenty-Five Thousand and 00/100 Dollars ($125,000.00) shall be paid on or before the Effective Date; and

b. The remaining Two Hundred Thousand and 00/100 Dollars ($200,000.00) shall be paid in equal quarterly installments of Fiffy Thousand and 00/100 Dollars ($50,000.00) with each installment due on the first day of each quarter. For purposes of this subsection, each quarter shall startonJanuaryl, April 1, July 1, and October 1 of every year.

28. The Settlement Payment shall be made by bank check, attomey trust account check, or other guaranteed firnds made payable to the "Ne\il Jersey Division of Consumer Affairs" and forwarded to the undersigned:

Jah-Juin Ho, Deputy Attomey General

Offrce of the Attorney General

Division of Law

l24Halsey Street, 5th Floor

Newark, New Jersey 07101

Upon making the Settlement Payment, Settling Defendants shall immediately be fully divested of any interest in, or ownership of the monies paid. All interest in the monies, and any subsequent interest or income derived therefrom, shall inure entirely to the benefit of the Division pursuant to the terms herein.

FORBEARANCE ON EXECUTION AND DEFAULT

29. In the event that Settling Defendants fail to make any of the payments referenced in paragraph 28 \¡rithin 15 days of their due date, all unpaid amounts due and payable under this Consent Judgment shall immediately be accelerated and due and payable, with interest calculated in accordance with R. 4:42-11 from the date of default, and with the Plaintiffs' cost of collection. In addition to the relief provided for in this Section, a default shall entitle Plaintifß to make an application to the Court for an order directing compliance and any other relief in aid of litigant's rights, including an award of attorneys' fees.

GENERAL PROVTSIONS

30. This Consent Judgment is entered into by the Settling Defendants and Plaintiffs (collectively, "Parties") as their own free and voluntary act and with full knowledge and understanding of the obligations and duties imposed by this Consent Judgment.

31. This Consent Judgment shall be governed by, and construed and enforced in accordance with, the laws of the State.

32. The Parties have negotiated, jointly drafted and fully reviewed the terms of this Consent Judgment and the rule that uncertainty or ambiguity is to be construed against the dra"fter shall not apply to the construction or interpretation of this Consent Judgment.

33. This Consent Judgment contains the entire agreement among the Parties. Except as otherwise provided herein, this Consent Judgment shall be modified only by a written instrument signed by or on behalf of the Parties.

34. Except as otherwise explicitly provided in this Consent Judgment, nothing herein shall be construed to limit the authority ofthe Attomey General to protect the interests ofthe State or the people of the State.

35. If any portion ofthis ConsentJudgment is held invalid or unenforceable by operation of law, the remaining terms of this Consent Judgment shall not be affected.

36. This Consent Judgment shall be binding upon Settling Defendants as well as their owners, officers, directors, managers, agents, employees, representatives, subsidiaries, successors and assigns, and any Person through which it may now or hereafter act, aswell as any Persons who have authority to control or who, in fact, control and direct its business.

37. This Consent Judgment shall be binding upon the Parties and their successors in interest. In no event shall assignment of any right, power or authority under this Consent Judgment avoid compliance with this Consent Judgment.

38. This Consent Judgment is entered into by the Parties for settlement purposes only. Neither the fact of nor any provision contained in this Consent Judgment shall be construed as: (a) an approval, sanction or authorizationby the Division or any other govemmental unit ofthe State of arty actor practice of Defendants; or (b) an admission by Settling Defendants that any oftheir acts or practices described in the Complaint or prohibited by this Consent Judgment violate the CFA or the CROA. Neither the existence of, nor the terms of this Consent Judgment shall be deemed to constitute evidence or precedent of any kind except in: (a) an action or proceeding by one of the Parties to enforce, rescind or otherwise implement any or all of the terms herein; or (b) an action or proceeding involving a Released Claim to support a defense of res judicata, collateral estoppel, release or other theory of claim preclusion, issue preclusion or similar defense.

39. Unless otherwise prohibited by law, any signatures by the Parties required for filing of this Consent Judgment may be executed in counterparts, each of which shall be deemed an original, but all of which shall together be one and the same Consent Judgment.

40. The Parties Represent and warrant that their signatories to this Consent Judgment have authority to act for and bind the respective Parties. RELEASE

41. In consideration of the payments, undertakings, mutual promises and obligations provided for in this Consent Judgment and conditioned on Settling Defendants making the Settlement Payment, the Plaintiffs hereby agree to release Settling Defendants, only, from any and all civil claims or Consumer related adminisftative claims, to the extent permitted by State law, which Plaintiffs could have brought prior to the Effective Date against Settling Defendants for violations of the CFA and CROA arising out of the Complaint ("Released Claims").

42. Notwithstanding any term of this Consent Judgment, the following do not comprise Released Claims: (a) Plaintiffs' action against Defendant Hunczak; (a) private rights of action; (b) actions to enforce this Consent Judgment; and (c) any claims against Defendants by any other agency, subdivision of the State, including the New Jersey Office of the Attomey General- Division of Criminal Justice.

PENALTIES FOR FAILURE TO COMPLY

43. The Attorney General (or designated representative) shall have authority to enforce the injunctive provisions of this Consent Judgment or to seek sanctions for violations hereof or both.

44. The Parties agree that any future violations of the injunctive provisions of this Consent Judgment and the CFA shall constitute a second or succeeding violation under N.J.S.A. 56:8-13 andthatDefendant may be liable for enhanced civil penalties, as provided therein. COMPLIANCE WITH ALL LA\ilS

45. Except as provided in this Consent Judgment, no provision herein shall be construed Relieving Settling Defendants of their obligation to comply with all State and Federal laws, regulations or rules, as no\il constituted or as may hereafter be amended, or as granting permission to engage in any acts or practices prohibited by any such laws, regulations or rules; or AS:

b. Limiting or expanding any right the Attorney General or the Director may otnrlise haveto obtaininformation, documents ortestimony fromDefendantspursuantto any State or Federal law, regulation or rule, as now constituted or as may hereafter be amended, or limiting or expanding any right Defendants may otherwise have pursuant to any State or Federal law, regulation or rule, to oppose any process employed by the Attorney General or the Director to obtain such information, documents or testimony.

NOTICES TINDER THIS CONSENT JUDGMENT

46. Except as otherwise provided herein, any notices or other documents required to be sent to the Plaintiffs or the Settling Defendants pursuant to this Consent Judgment shall be sent by United States mail, Certified Mail Return Receipt Requested, or other nationally recognized courier service that provides for tracking services and identification ofthe Person signing for the documents. The notices andlor documents shall be sent to the following addresses: