California passes nation’s first IoT security bill – too little too late?
diginomica.com
diginomica.com
Vague lingo is currently accepted, among white-collar crime academics, as absolutely the best path forward for reining in corporate behavior.
When you have very specific lingo, it’s extremely easy to circumvent the law. You want to keep the law vague and open so you have lots of maneuver room to prosecute. This assumes you trust the government, which when compared with companies I 97% do. Bruce Schneier’s latest book, “Click Here to Kill”, makes the same point [1].
[1] https://www.amazon.com/Click-Here-Kill-Everybody-Hyper-conne...
Vague language is the best way to enable selective enforcement. Large companies who can afford the best lawyers will be able to find interpretations that are in their favor. Smaller companies would be unable to do this and thus more likely to lose.
And this only gets worse if large companies spend more effort on lobbying — they can get vague wording that makes the public feel good (like something is happening!) but which requires no effort on the company to comply.
Companies don't have a monopoly on force that the government does. This greatly changes how you calculate who the law should favor. I much prefer specific laws instead of laws that are selectively applied to whomever the government decides to target, because there is a long history of showing a very evil nature in how they pick targets.
Core question: what does "reasonable" mean? Do I get to define it, or some information security peer? Is it going to be defined as a matter of convenience by some functionary looking to make quota?
It's my professional responsibility to provide informative and actionable risk assessments and guidance. Crap like this makes that impossible.
Laws like GDPR are there to protect people from companies. Not make things easier for them. It's perhaps possible that people might be better protected by laws that are clear than by laws that gesture vaguely in the direction of security. Similarly, people are well-protected by clear automotive safety standards, and poorly protected by the regulation around dietary supplements.
Might that be worth considering?
Yet there are places that will only purchase things that can run antivirus (because there are rules or regulations that require them to run antivirus).
Get rid of/make void the fact that software and hardware companies disclaim any and all liability. If they make bad things, they should be liable for them.
I would provide an exception to this, and that's if they are open sourced, able to upload firmwares, and able to revert to a safe baseband.
Define 'bad'.
What one person sees as "insecure and bad" another person will view as "configurable and open".
Ultimately the consumer shares a good percentage of blame.
Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to.
Except, for a year and a half, those TVs were vulnerable to a whole range of bad things. They were used as local spying platforms. They were used as jumping off points for local networks. And they were used in attacks on other networks.
We can quantify the damages that this malfeasant software/hardware did. They certainly weren't "intended features", nor can customers just roll their own signed firmware.
> What one person sees as "insecure and bad" another person will view as "configurable and open".
Depends. Does the default behavior leave you open to a range of unintended effects? Are there known and unpatched errors/bugs?
Yes, configurations can be made that open you to vulnerabilities. Making an open relay over SMTP is one such. But the default Postfix is sane and secure.
> Ultimately the consumer shares a good percentage of blame.
That's what I'm arguing. When the customer is not much more than in a rental agreement faked as a purchase, 100% of the blame needs to fall on the renter operator.
The problem with most companies that put some intelligence in dumb devices is that they:
1. Rely on their own cloud platform
2. Use lockin to their specific plan
3. Fail to quickly respond to security incidences
4. Abandon when their next incremental version comes out
And most of these types of devices are the ones that end up being a member in a botnet or other bad networks.
The best defense is to make "dumb" devices. No, our microwave, refrigerator, oven, dish washer, and others do NOT need network connectivity. Hard to hack a machine with no connectivity.
mind you, I'm NOT Advocating for insecure devices, I'm just saying be prepared for monthly service fees or short product lifecycles if this is what is expected. All of which will drive up costs and potentially reduce utility.
Or, the public being price sensitive, will with appropriate legislation, either start killing 'smart' devices, or use secured and local standards.
That's the point I'm trying to make.
Support your shit properly, or keep the devices dumb.
I prefer dumb, so I can add my own smarts without being tied to some shitty proprietary IoT.
In your proposed universe, you won't have a "smart tv" because you will choose not to pay the $3500 price tag to cover the security audits and increased litigation insurance that will accompany the manufacture of such devices.
Most linux distros will also be sued out of existence. Such laws are a dream for authoritarian regimes. Ultimately there will be a only a small handful of monopoly powers who have enough resources to navigate the regulatory landscape.
I'm proposing excising these "smart" features out of devices that don't need it. A TV/Monitor is and will be useful for the foreseeable future. A TV/MOnitor with bit-rotted 'smart features' will turn the device into a disposable device when the maintainer/owner finally wants to get rid of it.
Then just buy a TV / Monitor?
Without liability, there is no disincentivizing including smart features for manufacturers.
I agree that "Use a user-patchable / open source / replaceable stack -> shielded from some liability" or "Lock everything down -> take on legal liability for your own security" is a sane system to put in place.
There's no reason 50%+ of IoT devices (especially Chinese clones) aren't built top-to-bottom open source, aside from manufacturer ignorance / laziness.
There is already a kind of hardware and software where companies are liable: in medical equipment. Now look at what that does to the prices.
Open source and consumer serviceable makes sense, but that's already being fought for with the "right to repair" movement.
If three brands of GPS mapping device dominate the consumer market, but only one of them bothers to certify for aircraft, the exact same hardware in an aircraft dash-mount will cost many times the amount for a consumer handheld. Costs only determine prices for commodity suppliers. Everyone else charges what the market will bear.
The same would happen with any other kind of software/hardware where liabilities are regulated. Suddenly companies would have to tighten their development processes, triple check for IP, formally verify every component, get certified and insured, and prices to the consumer would skyrocket.
I think consumers will want regulation when they see what it fixes.
It already is void or at least significantly limited by law in most jurisdictions. It might be better if we waived statutes of limitations and enhanced damages (e.g., 3× multiple) for damages where the basis of liability would be reasonably viewed as within the scope of a disclaimer which purported to disclaim liability that could not legally be disclaimed, so that there was a significant disincentive for the currently-routine overly-broad disclaimers.