1. Escalation 5 (cont.): Broadcast Media Coverage
Airplane Incident Reported
Escalation 5 (cont.): Broadcast Media Coverage
Internal Update + CEO Guidance
Investigation Findings Released
The Euro News Network clip spurs intense online speculation that cybercriminals can use the toy’s camera to spy on customers or to set homes on fire.
SCE has received hundreds of calls from current customers and resellers, inquiring about the security of the product.
Potential Security Issue
Product Update, Broadcast Coverage & AG Investigation
FOR SIMULATION PURPOSES ONLY

2. FOR SIMULATION PURPOSES ONLY
Airplane Incident Reported
Question 5:
Internal Update + CEO Guidance
What should the company do?
Work with the product development team to create a software update to mitigate the problem.
Create a website where the consumer can identify if they are impacted by the recall and download the software update directly to their unit.
Keep relevant regulators and elected officials updated.
Address media coverage by providing a written statement.
All of the above.
Gurpreet to All
How does the inclusion of a physical risk change our response strategy?
How long can we wait for our product development team to patch the issue before contacting/involving the CPSC or the appropriate EU group?
Outside Counsel Advice based on task force input- one person could discuss to consolidate a bit. Keep applicable US, EU and UK agencies updated
Establish international compliance/reporting strategy if applicable
Can a software fix be pushed to devices?
Stop use until corrected
Refund if no software or replacement remedy: class action! May even need to do merch credit/gift card
Communications
How do you address speculation, exaggeration or misinformation in media/social media?
What owned and paid media channels can we utilize to take back control of the narrative?
What are our key messages at this point?
Engineering
How close is ‘close proximity’ that is required to gain control of the toy?
What is the reasonableness of this scenario and what is the added risk associated with this as compared with that of a criminal/hacker with similar intentions in and around the house?
This specifically focuses on the new IoT concept of “hazardization” that relates to an initially ‘safe’ product that becomes hazardous when connected to a network, as a result of changes to the ‘operational code’, malicious or otherwise.
Real Life 2018 Example- Cloud Pets Stop Sale (
Reverse Logistics
Need to look at supporting call center activity with concerns?  Alternative remedy for consumers that are still not comfortable?
How will product at retailers be handled. Do you risk having all inventory pulled from shelves? (potential for field team to do software updates)
FOR SIMULATION PURPOSES ONLY

3. Escalation 6: Product Update
Airplane Incident Reported
Escalation 6: Product Update
Internal Update + CEO Guidance
Investigation Findings Released
From: Product Development Team
To: SCE Crisis Team
Subject: NEW Update RE Bluetooth Exploit
All,
We have a software update ready for deployment that will remedy the security vulnerability in the Mr. Robot 3000.
Our investigation also found that our full breadth of IoT products in the Educational Products division could be exploited by the same issue.
At this stage, knowing the potential scale here, we would recommend communicating with all customers of IoT products to request them to update their software via our website. We might also consider reporting this finding to the CPSC, but will let your team make that call.
Martin Esposito
Vice President, Product Development
Second City Electronics
Potential Security Issue
Product Update, Broadcast Coverage & AG Investigation
Software Update
FOR SIMULATION PURPOSES ONLY

4. FOR SIMULATION PURPOSES ONLY
Airplane Incident Reported
Question 6:
Internal Update + CEO Guidance
How should the company communicate the patch?
Communicate directly with known customers and direct consumers
Issue press release
Conduct press conference
1&2
None of the above
Gurpreet to All
Do we disclose that there’s a vulnerability to all products? If yes, which stakeholders? If no, why not and what are the risks associated with not disclosing?
What do each of you recommend as next steps for the company?
Legal Counsel Advice- Belinda
Yes! This is the chance to finally get in front of the problem
Properly and non-emotionally frame the issue & solution
Carol and Pinuccia will cover discussion re going-forward design changes, civil penalty exposure and forward looking regulatory assurances
U.S. Government Response- Carol
Discuss updates to agencies including CPSC requirement on status of recall monitoring- Publish MPR?
EU Response- Pinnucia
What does the EU expect from this company now and in the future?
Communications
What can we do to protect our reputation and convince consumers that our products are safe and secure?
How can we urge all IoT customers to get the software update without disclosing the potential vulnerability to all IoT products?
Engineering
Have you had the proposed fix validated/independently confirmed by an outside/independent third party to avoid any bias/error and having to potentially do a second recall down the line?
Reverse Logistics
[CHRIS – please add in key questions to address/general talking points]
FOR SIMULATION PURPOSES ONLY

5. Thank You!