FEDERAL COMMUNICATIONS COMMISSION WASHINGTON, DC 20554 Office of Commissioner Geoffrey Starks March 8, 2024 Doug McMillon President and Chief Executive Officer Walmart 702 SW 8th Street Bentonville, Arkansas 72716 Dear Mr. McMillon: On February 29, 2024, Consumer Reports and the Washington Post published articles describing the availability of insecure connected video doorbells on Walmart.com, including models that lack a visible Federal Communications Commission (FCC) ID.1 The FCC has recognized that IoT devices can enhance consumer safety, convenience, comfort, and efficiency.2 Connected doorbells in particular can help consumers secure their home, screen visitors, answer their front door remotely, and track package deliveries. Unfortunately, without adequate cybersecurity, these same devices also provide bad actors with an entry point into our networks, daily routines, and even our homes.3 As a case in point, the Consumer Reports and Washington Post articles report that with alarming ease, unauthorized persons—be they an amateur hacker, sophisticated cybercriminal, or an abusive partner—can commandeer video doorbells sold on Walmart to control the camera and access camera footage without permission due to the failure of these devices to take even basic security precautions. According to the reporting, thousands of these video doorbells are sold each month on Walmart and other online marketplaces.4 Equally concerning, the article describes how a number of these devices, sold by the Chinese manufacturer the Eken Group under brand names Eken, Tuck, Fishbot, Rakeblue, Andoe, Gemee, and Luckwolf, remain for sale on your platform as of the date of publication. 1 Stacey Higginbotham, Daniel Wroclawski, These Video Doorbells Have Terrible Security. Amazon Sells Them Anyway, Consumer Reports (Feb. 29, 2024), https://www.consumerreports.org/home-garden/home-security- cameras/video-doorbells-sold-by-major-retailers-have-security-flaws-a2579288796/; Tatum Hunter, These camera doorbells from Amazon, Walmart aren’t safe, The Washington Post (Feb. 29, 2024), https://www.washingtonpost.com/technology/2024/02/29/doorbell-cameras-aiwit-privacy-amazon-walmart-temu/. 2 See Cybersecurity Labeling for Internet of Things, PS Docket No. 23-239, Notice of Proposed Rulemaking, ¶ 1 (rel. Aug. 10, 2023), https://docs.fcc.gov/public/attachments/FCC-23-65A1.pdf. 3 Id. ¶ 3. 4 See Higginbotham & Wroclawski, supra note 1. Though not mentioned in the article, wireless devices that lack or do not conform with an FCC equipment authorization pose a separate threat to the security of our networks by potentially causing harmful interference into nearby wireless operations.5 To mitigate these risks, Section 302(b) of the Communications Act provides that “[n]o person shall manufacture, import, sell, offer for sale, or ship devices or home electronic equipment and systems, or use devices, which fail to comply with regulations promulgated pursuant to this section.”6 In turn, Section 2.803(b)(1) of the Commission’s rules provides that no person may market a radio frequency device that is subject to certification unless the device has been authorized and is properly identified and labeled in accordance with our regulations.7 The equipment authorization process is also instrumental to preventing the entry of devices determined to pose an unacceptable risk to the national security of the United States or the security and safety of United States persons into the communications supply chain.8 Earlier this year, President Biden announced a new cybersecurity labeling program to help consumers identify the cybersecurity level of protection of IoT devices. With the Commission poised to vote on establishing the Biden Administration’s Cyber Trust Mark program next week, this is an especially important time to learn more about the processes Walmart employs to ensure the products it offers for sale comply with all applicable FCC regulations. To that end, please respond to the following questions by Friday, March 22, 2024. 1. Please describe in detail the steps that Walmart takes to ensure that the products it sells or makes available for sale on Walmart.com comply with the FCC’s equipment authorization rules, including identification and labeling requirements. 2. Walmart has a policy on “Electronics and Radio Frequency Devices” that requires sellers to adhere to other “Prohibited Products Policies” or Walmart claims it will automatically unpublish the item. a. Does Walmart verify that the products that it sells or makes available for sale on Walmart.com have a valid FCC authorization? How so? b. Are you aware of the FCC’s equipment authorization search function, which allows the public to search via product code, applicant name, grantee code, and more, to determine if an RF emitting device has received equipment authorization? 3. Walmart allows suppliers and marketplace sellers to pay for sponsored listings on Walmart.com. 5 See, e.g., Enforcement Advisory No. 2012-07, TDWR and U-NII Devices, https://docs.fcc.gov/public/attachments/DA-12-459A1.pdf; Enforcement Advisory No. 2016-05, WARNING: FCC Authorized Equipment Must be Used in Compliance with All Laws and Rules, https://docs.fcc.gov/public/attachments/DA-16-588A1.pdf. 6 47 U.S.C. § 302(b). 7 47 C.F.R. § 2.803(b). 8 Prohibition on Authorization of “Covered” Equipment, Federal Communications Commission, https://www.fcc.gov/laboratory-division/equipment-authorization-approval-guide/equipment-authorization-system. 2 a. Does Walmart vet the products sold under sponsored listings? If so, please describe any verifications that relate to FCC equipment authorization or requirements. b. Does Walmart ever terminate sponsored listings in response to concerns about products marketed using a sponsored listing? If so, what concerns have prompted termination and what is the process for a consumer to request termination? c. Have any video doorbells sold under the brand names Eken, Tuck, Fishbot, Rakeblue, Andoe, Gemee, or Luckwolf appeared on Walmart under a sponsored listing? If so, how much revenue did Walmart receive in exchange for the sponsorship? 4. The FCC’s Enforcement Bureau sent Citations to Walmart in 20059 and 200910 for marketing non-compliant radio frequency devices in violations of Section 302(b) and the Commission’s rules. a. Please describe the steps taken in response to these citations in order to ensure that non-compliant RF devices were no longer marketed. b. Please describe how video doorbells sold under the brand names Eken, Tuck, Fishbot, Rakeblue, Andoe, Gemee, or Luckwolf appeared on Walmart after Walmart had previously been cited twice for violation of the same Commission rules for marketing non-compliant RF devices. 5. Walmart provides sellers on Walmart.com with fulfillment, warehousing, shipping, distribution, and payment services. a. Does Walmart vet the products sold by merchants to whom it provides these services? If so, please describe any verifications that relate to FCC equipment authorization requirements. b. Does Walmart ever terminate the provision of these services in response to concerns about products sold using these services? If so, what concerns have prompted termination and what is the process for a consumer to request termination? c. Has Walmart provided these services to merchants who, at the time Walmart provided such services, listed video doorbells under the brand names Eken, Tuck, Fishbot, Rakeblue, Andoe, Gemee, or Luckwolf on Walmart.com? 6. Please describe how Walmart plans to incorporate the Cyber Trust Mark, once it is active, into its marketplace to help consumers identify IoT devices that meet the Mark’s level of security. If Walmart does not currently have plans to incorporate the Cyber Trust Mark, please describe why. 9 Letter to Houda Nounou, Assistant General Counsel, Wal-Mart Stories, Inc. from Kathryn Berthot, Deputy Chief, Spectrum Enforcement Division, EB, FCC, DA 05-1029, Apr. 8, 2005, https://docs.fcc.gov/public/attachments/DA- 05-1029A1.pdf. 10 Letter to Leslie Dach, Executive Vice President, Corporate Affairs and Government Relations, Wal-Mart Stories, Inc. from Kathryn Berthot, Chief, Spectrum Enforcement Division, EB, FCC, DA 09-1824, Aug. 18, 2009, https://docs.fcc.gov/public/attachments/DA-09-1824A1.pdf. 3 Please send your responses via email to Geoffrey.Starks@fcc.gov. Sincerely, Geoffrey Starks 4