Thoughts About DiSH Network Lawsuits

Image by Darwin Laganzon from Pixabay

Yes, it has been a long, long hiatus. Had not planned on going this long without new content. Got a bit burned out end of last year trying to push out content multiple times a day. With that said, I do plan on putting out more content in the future, but not on a any type of schedule. If there is relevant and interest tech news I’ll post it. Such as the case with the recent lawsuits against DiSH Network as a result of their Cyber Security Incident earlier this year. Before I get into that, I do want to make the site’s readers aware towards the middle/end of this month I will be moving the site to a new hosting provider (good grief doesn’t seem like it has been three years already). The contract with the current provider expires May 1st and their renewal offer was well rather unattractive.

For a bit of background, I’ve been a DiSH Customer for at least 15-years. I had been living at an apartment and my neighbor end up getting DiSH. Our units shared a common landing so the 3rd -party installer knocked on my door and ‘pitched’ DiSH service to me. At that time I had Internet and ‘Digital Cable’ through our local (and only) cable company.  He quoted me a price it was so much less then I was paying for a cable at the time and gave me so much more. The apartment complex  had no issues with us having satellite dishes as long as they were mounted on a pallet in the roof bay by the HVAC units. They even had a roof access ladder on the side of each building. I agreed and never looked back. DiSH customer service and techs have always been great.

Had an incident a few months after I had moved into a new unit in the same complex. Came home one evening and was getting a signal error. Called support and they sent out a tech the next day. The tech disappeared up on to the roof for almost an hour and then came back down and told me I was all set. Then explained my DiSH had somehow gone MIA, all he saw up there were DirecTV dishes. There was no charge for him to come out and replace the DiSH. Even my folks signed up for DiSH shortly after I had where they were living during that time. Even it had DISH installed at the new house we had built in 2016. In late 2018 their equipment had a catastrophic failure and even though it was close to midnight eastern time when they called customer support, DiSH sent them out all new equipment via UPS Next Day Air at no charge.

To this day I still have DiSH even though our contract had ended back in December. I looked at steaming services and may be I could save $10-$20 a month (less now with both Hulu and YouTube TV having raised their rates recently), but didn’t seem worth it for such small savings. Plus for a while our Internet had not been the most reliable, at one point we had an outage that last well over 15-hours which was caused by vehicle taking out a utility pole up the road from us. So during that time of no Internet (which include my phone since I dropped mobile data earlier that year) I was still able to watch TV, something I would not have been able to do if I only had streaming. Our development’s CC&R’s do not allow for outdoor aerial TV antennas (which when I lived in California for 18-years is all we ever had…though we did have ON TV until they went defunct and a local cable service for a little while. This was during the 80’s with those C-Band Satellite dishes the size of a Volkswagen. I had tried indoor antennas out here, which for the most part seemed to work okay, but our local NBC affiliate was never easy to get a strong signal.

Bleeping Computer on Saturday (April 1st) posted: DISH slapped with multiple lawsuits after ransomware cyber attack

Dish Network has been slapped with multiple class action lawsuits after it suffered a ransomware incident that was behind the company’s multi-day “network outage.”

These class action lawsuits, filed across different states, allege that DISH “overstated” its operational efficiency while having a deficient cybersecurity and IT infrastructure. The legal actions aim to recover losses faced by DISH investors who were adversely affected by what has been dubbed a “securities fraud.”

These lawsuits claim “DISH “overstated” its operational efficiency”. Perhaps for their website, customer support and secondary services (Dish Anywhere and Boost Mobile). However, those of us who subscribed and used just the core “Dish” service for TV we never lost service (and didn’t even know there was an issue until it came out in the news). Now, we don’t use the Dish Anywhere App or a were subscribers to Boost Mobile or HBO Max or even tried to use DiSH service to validate for another streaming service. My understanding customer support was unreachable via website or even phone (goes to show the major downside of VoIP). Never tried to reach them as never lost signal. I did go to their website during that time, but was unable to access my account (not that I needed to).

So, what exactly is “deficient” cybersecurity? Is there a standard? In the past couple years it seems many companies, organization, our family doctor’s practice (which they downplayed as ‘we detected unauthorized access’ not ‘we lost most of  your medical records since you’ve been with our practice’)  and even the US Government (FBI) have had cyber security incidents on their networks. Cyber Security Incidents just don’t have the ‘stigma’ that they used to as people are so use to them occurring they’ve gone numb and don’t really pay attention to them anymore. If anything people think now when a cyber security incident affects them it just mean ‘another free-year of credit /ID monitoring!’ services (which they likely never really use).

As far as “deficient IT infrastructure’ claims I guess that has to do with customer support being inaccessible via phone. While that can legitimately be ‘deficient IT infrastructure’, it is a deficiency that any corporation, company, organization, etc. has by using a network based Voice (telephone) system. This is no different to losing access to streaming services with your ISP has an outage. This is the downside to ‘putting all your eggs in one basket’.  Those are not so tech savvy don’t understand this and think it is a problem with their streaming provider. Reminds of an incident when I was working for a large web hosting provider some 15-years ago. Sites were hosted on servers at one the data center were inaccessible to the ‘outside’ world for almost 24-hours. On our Internal network we could see their sites. The issue had nothing to with the hosting provider (though customers didn’t’ understand this), it was the FiOS provider (Verizon or AT&T) had equipment failure on their end which provided ‘internet access’ to the data center.

The US doesn’t have the “tough’ laws such as the EU’s ‘This Site Uses Cookies Law’ I mean GDPR. Not living in EU, not sure how effective GDPR has been in getting companies to do everything in their power to thwart Cyber Security Incidents and/or ensuring they make it public even before they know the full details as to what occurred.  It has though made everyone in the world annoyed with and numbs to the  ‘cookies banners’ on nearly any site (including this one) they visit.

As far as ‘securities fraud’ bit goes, really can’t speak on that as not an area I am all that familiar with. However, it seems a bit far fetched…my understanding is the fraud was not the Cybersecurity incident itself, but rather how DiSH reacted to said incident. Even then, I don’t think there was intentional malice or deception on DiSH’s part. Rather, they were trying to assess the extent of happened, what/who were affected and what they could do fix and restore their network. DiSH’s response seems to be inline with any other company experiencing a cybersecurity incident: acknowledge their was an issue, but ‘cover their ass’ about what happened until they know more as to not to panic their customers and (sadly) more importantly their shareholders.  In the case of our (now former as they reorganized and merged with a new partnership then dropped acceptance of our insurance)  family doctor’s practice, they were never fully forthcoming as to what happened. Their ‘disclosure letter’ only mentioned unauthorized access, not that their internal network had to be shut down for almost a month and they lost a good chunk of their records as a result of this ‘unauthorized access’ (how they did not have redundant off-site back-ups is beyond me…of course the Target Data Breach incident in 2013 should have never happened). Oh and yes, we were eligible for a ‘free year’ of credit and ID monitoring services.