Regulation of the Internet of Things

The Internet of things (IoT) refers to the system of interrelated computing devices, machines, and objects that have unique identifiers and the ability to transfer data over a network. Included in this definition is everything from smart cars, to smart homes, to fitness watches, to baby monitors. The growth in the number of these devices connected to the Internet has grown significantly in recent years to 25 billion devices, and the FTC estimates that this number will double to 50 billion devices by 2020.

Two of the major concerns with the IoT are the lack of security and the privacy implications of all the data collected. First, because of the ubiquity of the IoT, some argue that all the vulnerabilities of the digital world have been introduced into our real world. Examples of IoT devices getting hacked abound, with Sony’s PlayStation, baby monitors, cars, and “Hello Barbie” reportedly succumbing to attacks. Another recent example, although attributed to an iOS glitch rather than a hack, is a British smart thermostat system that had some customer’s thermostats stuck at 32 C (about 90F).

These security vulnerabilities also affect privacy issues. In the hack of TrendNet’s live-camera feeds (used to monitor babies, patients in hospitals, offices, banks, etc.), the hacker was able to post links on the Internet of over 700 IP cameras. This exposed private areas and activities including surveillance on babies in their cribs, children playing, and daily household activities. But beyond the privacy implications of hacks, there is also the issue of what data is being collected, how it is being used, and the protective measures in place.

One approach to minimizing privacy issues is to only collect data related to the published goal of the device collecting the data. For example, if a person were wearing a device to track their steps/miles walked, this approach would say that there is no reason for the location data to be collected. Similarly, some argue that in the area of smart cars, or “vehicle-to-vehicle communication,” it is only necessary to know that a car is swerving towards you, not whose car it is. Limiting the collection of this information would reduce the chances that the car manufacturer knows exactly where you are at any point in time.

As to the question of whether or not Congress should regulate the IoT, I agree with the FTC report recommending that  broad Congressional legislation is not appropriate at this time. The rationale cited for this by the FTC is that it would stifle innovation, to that reason I would add that given the range of devices in the IoT, Congressional legislation would be inappropriate. I would instead argue that the security be left to each industry, with the exception of the auto industry, as discussed below.

One industry where I would argue legislation is appropriate would be the auto industry. There are significant safety and privacy implications involved with a lack of security in “smart cars.” The distinction I see with the auto industry is that there is the potential for greater harm with automobiles. While both watches and cars may track locational data, if a car is hacked in the middle of a major freeway during rush hour there are likely to be many more tangible injuries. The importance of securing vulnerabilities in the auto industry has been recognized by Senators Markey and Blumenthal, who introduced the Security and Privacy in Your Car Act of 2015. This bill would require that all vehicles manufactured for sale in the US be equipped with “reasonable measures to protect against hacking attacks.” Separate from this legislative response, the auto industry has been working on solutions to vulnerabilities in their cars. The USA Today reports that carmakers representing  98% of  automobiles on the market have joined a consortium that will enable the sharing of information on cyber security measures without violating anti-trust laws. I would argue that there needs to be a baseline standard for cyber security in cars, and that this baseline will likely come from federal regulation (similar to how emissions and  safety standards/ratings are set by the federal government).  

With this exception of the auto industry, I think this problem should be left in the hands of the industries. As more attention continues to fall on the security of IoT devices, the incentive for companies to pay attention to security and privacy has been increasing. Technology Research company Gartner lists “IoT Security” at the top of their list of “Top 10 IoT Technologies of 2017 and 2018.” Private companies such as Symantec and Cisco are already marketing “IoT security products.” Companies such as Fitbit are publically addressing privacy concerns by disseminating information detailing to users what data is being collected, how it is being used, how long the data is saved, and how users may opt out of certain features. Fitbit is just one example, but it is an encouraging recognition of the privacy interests in the data being collected. The counter argument to this Fitbit example is that no one actually goes to the webpage and that the government should require Fitbit to put that privacy information on the package or device.

That is not to say that in the absence of regulating the entire IoT there is no role for the FTC . The FTC has also already filed complaints  against TrendNet and “tech giant” ASUSTeK Computer, Inc. for advertising their products as being “secure” when that is not the case. Both cases settled. In the ASUS case the FTC focused on the fact that ASUS did not address security flaws in a timely manner and did not notify customers of security vulnerabilities. The FTC has also provided some tips for  companies in the area of IoT security.  They emphasize starting with security, designing the product through customer’s eyes,  making it easier for people to select the safer option from the start, heeding security warnings,  thinking through how you will let consumers know about fixes, and learning lessons from other FTC cases.