my name is Amy Stepanovitch I am US
policy manager and global policy counsel
at access now which is an international
organization working at the intersection
of human rights in tech my friend over
here will introduce himself I'm Harley
Geiger and I'm director of public policy
at rapid7 rapid7 is a cybersecurity firm
based in Boston we have offices all over
and we work on among other things
IOT security we also have a very active
research arm which is dedicated to
finding flaws in software IT and
otherwise and bringing them to light I
run our public policy and government
affairs activities so we're here today
to talk to you a bit about the Internet
of Things and the legal statutory
regulatory environment in that space
right now and talk to you about what's
happening in DC and at the state level
just a little bit the reason that DC
finally I think started paying attention
to the Internet of Things has a lot to
do with this statistic from Intel which
law makers have seen of a lot and that's
that there will be 200 billion Internet
of Things devices in the world by 2020
to give you a little bit of math that's
200 billion divided by the expected
population in 2020 is about twenty five
point six devices per person and it's
probably a lot higher than that given
that only about 50% of the world is
connected to the Internet so it's it
will be very connected according to
people in DC we'll be having a lot of
our activities tracked a lot of our
devices in our home are going to have
some sort of connectivity functionality
and so they weren't really sure what
they could expect people in Congress if
you if you haven't heard don't always
some of them do but don't always have a
ton of technical expertise and so they
were trying to figure out in this new
world what needs to be done
so there are a lot of unanswered
questions in the IOT space who owns the
device who owns the data who can collect
data about me for what reasons can we
protect it all these are questions that
I think people in DC are really starting
to figure out and delve into and the
answers are going to guide any
additional regulation or legislation
that we see however we want these
answers to turn out so to start the
actual educational portion of the talk
we wanted to take a step back and say
what is the Internet of Things we've
seen a progression of computing devices
over the last few decades moving from
very large computers through to
smartphones that we carry on our bodies
all the time essentially sleep next to
all the way down to our smartwatches
smart toasters toasters are a really big
thing that we talked about in DC every
time you talk about the Internet of
Things it's a toaster
we're gonna use that a lot I'm really
sorry uh-huh
so why do we think of Internet of Things
items differently than computers charlie
why we think of them as different than
computers I would say that we don't know
how to classify them very well yet there
is a great deal of inconsistency in
defining IOT and one of the problems is
if you try to define it it you end up
sweeping in a ton of devices that people
don't necessarily think of as IOT at
rapid7 we take a pretty broad view in
just define IIT the three general
characteristics it's a physical object
that has some sort of embedded
technology like CPU memory software it's
got Internet connectivity number two and
number three some sort of external
command and control application like a
mobile app or a human machine interface
and so forth and that actually covers a
giant range of devices everything from
small
fitbit's or something like that to a a
battleship and are actually our IOT
research director has come to hate the
term internet of things because it's not
specific enough but it's in his title so
it haunts him forever and for policy
makers this definitional problem this
definitional problem of IOT is a real
issue for them because in policy with
legislation or regulation everything
will end up getting litigated companies
want to know exactly what is required of
them and for a definition that ends up
encompassing everything from you know
your mobile phone to a you know a
connected car it is it is viewed as too
broad and it lends itself to a lack of
clarity we find this lack of clarity
among consumers and businesses as well I
mean if your printer is connected to
Wi-Fi well guess what it is
in fact IOT so the definitional issue is
a really difficult one and we have found
that one reason that people don't tend
to think of it as a traditional computer
is because he doesn't have a keyboard
and a screen it's just it's a different
form factor from what we are used to but
IOT it's a encompasses this giant range
of devices so one way that you will see
policy makers and we'll talk about this
a little bit more later start to look at
how IOT should be protected regulated or
voluntarily is pretty sector specific
you know so it'll be medical devices and
just IOT as it relates to medical
devices or just connected cars and so
forth and so from our perspective we
think and from our I mean access now not
our from access now is perspective we
think that ultimately some of these
differentiations inform may not be as
meaningful in the long run and when we
talk about protections looking at
necessary security protocols or
processes necessary protections for the
collection of data that should be tech
agnostic and not necessarily delve into
which of these devices is collecting the
information so what does all this mean
we talk about Internet of Things as
hardly said because it brings
a lot of new things but these are rules
when we really the the Internet of
Things in the conversations that they
that that is bringing up that that
increase in the Internet of Things
products is bringing out those
conversations should have been had a
really really long time ago and the
reason that we didn't is because they
thought that they could people in DC
thought that they could just ignore the
problem and it would go away they
treated it like they treat a lot of
other things where it will all be sorted
out and there won't be serious problems
with security or privacy and there
hasn't been a major catastrophic
security incident necessarily and so
that means that we're doing okay so
we've let it go and let it go and now as
things have gotten more and more
connected we're reaching this kind of
critical turning point where if we don't
do something we could see massive
repercussions and I think we already
have and we'll talk about that a little
bit later when we talk about harm so
we're going to talk today about common
vulnerabilities federal law and
legislation state data security and
breach notification laws and federal
agency action and this is a warning that
there's gonna be a lot of text on the
slides ahead I know people have really
really cute images and I love slides
that are really good we want to make
sure you have the information available
on different citations to laws that you
might want to take so we're gonna put
that on the slides and we apologize
three major areas in the internet things
field privacy security and connectivity
and these are three issues we're not
going to touch upon all of them actually
we're only going to look at the security
aspects here today but we wanted to flag
that those two other areas bring a whole
new realm of issues with them we're also
not covering issues about liability
criminal law law enforcement access to
data or data protection which are
separate gigantic issues as well
when we talk about security data that is
or can be collected control of the
device itself there are two different
things that you want to secure you want
to secure the data you want to secure
the device sure sorry so we think of
security as a unauthorized system
actions right as opposed to sometimes
privacy what we're talking about there
are authorized system actions and you we
can we look at IOT harms the harms that
can result from lack of security on a
spectrum so so from greatest to to least
mass injury or loss of life individual
injury or loss of life damage to
critical infrastructure damage to
property in breach of sensitive
information that spectrum is sort of
where we what we view is at stake with
Internet of Things security depending on
the situation and the device ends next
please keep going we're going to common
vulnerabilities right
so here are some of the common
vulnerabilities that our team finds with
Internet of Things devices so one
insufficient update practices so IOT
devices unlike a lot of traditional
computers will often lack an update or
upgrade path once the device leaves the
manufacturers warehouse and without a
patching capability it then becomes
difficult to correct the devices known
vulnerabilities especially at a large
scale and so we are facing this wave
right now of devices especially smaller
devices that are unpatch about but also
unsecure and although we have some
confidence that IOT devices will build
in an update capability more commonly in
the future we still will have this wave
of legacy devices installed that we will
have to deal with second lack of
transport security so in our experience
a IOT devices will often fail to use
modern cryptographic standards for data
in transit and that risks expose
user data as it goes through the public
internet or local area networks third
unencrypted storage so IOT devices and
related services will often store data
in unencrypted formats and so that is
that is if both if it is both stored on
the device but also in the cloud and
third mobile application access a fourth
it's not on there sorry about that but
mobile application access so mobile
applications are often used to control
consumer IOT devices and what we have
found is that those mobile applications
will frequently give greater access and
control greater access to the to the
mobile device than is necessary to
control the IOT device and then UART
access UART as universal asynchronous
receiver transmitter interfaces these
will often enable a physically close
attacker these lights are really bright
in case you guys can't tell it will
enable a physically close attacker using
a serial cable connection to access the
device and in ways that will bypass
normal user authentication and one of
the things about UART access is that it
typically enables root-level permission
which far exceeds what a normal user
would need backdoor accounts some
manufacturers will occasionally include
a service or default account which is
difficult or impossible to remove under
normal usage especially for your average
consumer and these accounts will
frequently use a default password or an
easily guessable password not just for
one device but for a whole class of the
manufacturers devices and then lastly
lack of segmentation and so this is when
different components of the of a device
share the same memory or circuitry and
so that a flaw and one component will
affect another component so a great
example our cars if you are able to get
into the infotainment system of a car
you should not be able to get into the
mechanical functions of that car it's
it's break and speed but unfortunately
lack of segmentation does make that
possible in many circumstances so that
is a short list of
common vulnerabilities that we see in
IOT so what exists now to deal with
those at the federal level there are a
few different laws that are called data
security laws and you'll hear people
talk about them things like
gramm-leach-bliley the Fair Credit
Reporting Act the FTC Act these don't
actually say much about security other
than requiring some sort of reasonable
security for sensitive information which
has been interpreted in different ways
particularly in the FTC Act which we'll
talk about a little bit later there are
some state laws on security the primary
pieces of security that are security
regulation that we see in state laws
data breach notification which we'll
also talk about in a little bit the
Federal Trade Commission trying to
respond to what the Federal Trade
Commission can and cannot do and there
are pieces of the I'm really bad at
these slides advancing things guys I'm
really sorry it has two things here and
I'm a oneclick above where you guys are
so the Federal Trade Commission's
authority or lack thereof and then the
regulations on the ground at the state
level so where they can provide some
guidance to state regulatory agencies in
order to have things done not at the
statutory level but down at the agency
level so I'm gonna talk a second about
data state data security and data breach
notification law so as of now all 50
states actually have a data breach
notification law the last being Alabama
most recently Alabama and South this
year that's right this year so we have
reached patchwork supreme all 50 states
and the District of Columbia and some of
the territories so Puerto Rico has a
data breach notification law also and
these laws I think part of the part of
the the calculus is that breach
notification is more politically
expedient than directly regulating data
security and I think that the idea
originally was in part not just
transparency for consumers but also
that I the the cost and hassle of
notifying consumers in the event of a
breach would then inspire holders of
personal data to build in security at
the front end so that the breach doesn't
happen and that calculus is not really
working right the the steady drumbeat of
breaches is is showing that it's too
complicated and so states are actually
now starting to move in the direction of
directly regulating personal data
security there are 17 states as of my
last count that have data security
regulations in place usually they share
some definitions with breach
notifications so the definition of
personal information is usually the same
and there are differences among the
states there's no consistent standard
and so consumers will receive uneven
levels of protection based on where the
data is being held you know or where the
consumer is geographically and this
uneven level of protection also makes it
difficult for businesses of all sizes to
comply with and so that in our view
hampers good security
now those differences aside the laws do
follow some consistent patterns also so
for speaking just for data security laws
usually the requirement is a reasonable
level of security and that's the word
that these reasonable level of security
depending on the size and scope of the
business and the sensitivity of the data
we think that that is a good thing
actually that we think you know a
gigantic corporation should be held to a
different standard than a small pizza
shop it enables companies and other
holders of data to act based on the
risks you know based on the sensitivity
of the information and so forth but
where it starts to fall down and where
it becomes a bit less useful for
consumers and for IOT will often be in
the definition of personal information
so personal information for most of
these laws is stuff like your government
ID numbers so social security numbers
account credentials your address
sometimes biometrics sometimes health
information that's not already covered
by HIPAA
but also this anachronistic name
requirements many of the states require
that your name your actual name your
first and last name or your first
initial and last name be attached to the
data otherwise it does not actually
qualify as personal data so what that
means is a company could have your
social security number your account
credentials you know possibly even your
biometrics but unless unless your name
is also in there then it's it doesn't
meet the definition of personal
information and it's exempt from the
regulation that requires reasonable
security a second thing about this that
is anachronistic is when I talk about
account credentials many but not all
states are limiting that account
credential requirement to accounts for
financial transactions so here we're
talking about your bank login right or
you know your PayPal logged in so it's
accounts necessary to complete a
financial transaction that is different
from your personal media accounts it's
different from your online dating
profile it's different from the account
that may be embedded inside your IOT
device and so so you can see how this
starts to become far and far far further
and further removed from consumers
expectations for security with their
devices and with their personal
information I think that this is an
example of the law sort of fighting the
battles of the last century really
they're fighting against identity theft
when companies and consumers are now
facing a lot more greater diversity of
risks and harms based on cyber security
I will call out four states briefly as
being exceptional in avoiding both of
these problems and that is California
Florida Maryland and Minnesota they do
not have the real name requirement and
they do not limit the account
credentials merely to financial accounts
and I just want to quickly provide a way
to think about what Harleys saying about
personal data and definitions of
sensitive data
I assume that everybody I cannot see you
if you raise your hand so I'm not going
to ask you to raise your hand because I
can't see any of you but how I assume
that most of you have a credit card or
some sort of bank account number
if that number got lost or breached and
revealed to the public think about just
for a second if you would know how to
respond if you kind of have in your mind
a thought about how to cancel your
credit card number it cancel any you
know recurring payments to that card get
a new credit card and you know how to
mitigate the harm coming off of that now
if you think about the types of
information that Internet of Things
devices are going to collect about you
things like the number of commands that
you give to an Alexa your physical
activity your location and where you are
at any given time I would imagine that
the same number of you who know how to
mitigate the loss of a credit card
number don't necessarily know how to
mitigate the loss of other more
sensitive information that could be
revealed into a database and we haven't
done a lot of research into how to
mitigate that type of sensitive personal
information which means that if we were
to create a system that somehow
incentivize companies to do some of that
research because they were going to have
to notify people on the backend we might
be able to walk down a path where we
were looking into that type those type
of harm's those type of non-financial
harms and mitigating those for people in
a way that we can't even imagine that
they can be mitigated today so I want to
talk a bit about the Federal Trade
Commission the FTC DC really really
loves acronyms this is one of them that
we use all the time nobody says Federal
Trade Commission out loud there's a lot
of syllables there the FTC has the
authority to go after companies who
engage in two different types of trade
practices trade practices that are
deceptive that's pretty clear on its
face if you say something and you do
something else you have engaged in a
deceptive trade practice and easily the
bulk of the FTC's actions in the privacy
and security space were based on this
deceptive prong of their jurisdiction
but they have a second prong and that's
fairness unfairness it means that it's
likely to cause substantial injury to
consumers
that's not reasonably invited and not
outweighed by countervailing benefits
additionally there was a case that was
decided in the Eleventh Circuit this
year that adds a form of requirement but
kind of reinter causing injury the Act
has to offend public policy as set out
in some sort of statute or judicial
decision or the Constitution this is a
additional element that people don't
necessarily know how they're going to
grapple with just yet because when you
look back at reasonable security
practices there's not a clear statute to
set out what that means and there's not
a clear judicial decision that says what
is a reasonable security practice and so
there's a little bit of uncertainty
right now about how elevating that prong
and do a necessary prerequisite for the
FTC to go after companies is going to
play out in the long run and I'm going
to talk about that case and why some of
that it's uncertainty exists but there
are four main cases in the in the
unfairness world so the FTC has kind of
started feeling out its ability to go
after companies for bad security
practices under it's unfair jurisdiction
starting in 2005 BJ's Wholesale Club has
anybody ever shopped at BJ's Wholesale
Club do you know it no yeah like I've
heard it yet thank you for verbally
affirming what I'm saying
so the FTC here they began to argue that
unreasonable data security measures are
unfair regardless of any public
representation about a company's
security practices so they were they
were leaving behind their deceptive
jurisdiction they were saying you don't
have to say what you have done and then
lied if you do something that offends
basic data security we're going to call
that an unfair trade practice and we're
going to be able to
I started an investigation and and
potentially lead to a consent decree
skipping ahead 2014 you know during that
time they they continued to feel out
their ability to use this in the
TRENDnet case this is a case that
involved in secure home security cameras
and baby monitors the company
transmitted user login credentials in
clear-text on users mobile devices and
they failed to test so the FTC found
that they failed to test consumers
privacy settings to ensure that the
video feeds marked as private would
actually be private because these
credentials were out in the open the
company and the FTC ended up consenting
to that the company had to implement a
comprehensive data security program for
at least 20 years this is a requirement
that the FTC puts upon companies
frequently in the privacy space you see
it often you have to enter in a
comprehensive privacy program for 20
years Facebook is under a consent decree
like that Google is under a consent
decree like that so you see them
starting in the concert in the security
space to say ok what happened in the
privacy space we're going to transfer
over to security and require these
comprehensive data security programs for
20 years the company can figure out what
that means but they're going to have to
enter into one and this has been a key
reason why some of the FTC's
jurisdiction is called into question
2015 we saw the resolution of the
Wyndham case Wyndham the hotel chain had
three intrusions into its networks
between 2008 and 2010 the FTC said this
was also that their failure to protect
their networks meant that they were
engaging in an unfair trade practice in
regard to security and Wyndham challenge
that Wyndham said they did not have the
authority to go after the company for
these sorts of lack security measures
and the FTC won so Wyndham lost that
case the FTC's authority to use its
secure or use its unfair thora t to go
after bad security was preserved
until this year and now we have some
interesting questions so the lab MD case
lab MD does not exist as a company
anymore it was a company that screened
people for cancer and at some point he
faxed the case a company employee at lab
MD downloaded LimeWire onto their
computer
the LimeWire the files that LimeWire was
able to access included a file that had
sensitive personal information for lab
MDS consumer base and so it uploaded it
into this peer-to-peer serving and
allowed it to be downloaded by anybody
who was linking over to that users
computer the FTC lab MD notified people
when they found out a security
researcher luckily found the file and
sent it back and said fYI your user
information is all on the internet they
notified the FTC and the FTC said this
is an unfair trade practice and entered
into one of these are put forth one of
these consent decrees with them and now
I've MD talyn's dit em lab MD continued
to challenge it after the company no
longer existed they found the ability of
the FTC to go after the company very
offensive and so they kept on
challenging on the FTC's authority here
and they challenged it straight up to
the Eleventh Circuit and the Eleventh
Circuit just released its a penny in
this case two months ago I want to say a
month and a half ago and what the
Eleventh Circuit said is really
interesting here they said that yes lab
MD engaged in an unfair trade practice
and they kind of said this without
really deciding and so this goes back to
the need to tie it to a public policy or
statutory requirement rather than really
delving in and saying that that
statutory or that policy requirement
existed they just assumed it did and
this was the court saying we don't need
to make this determination right now
now because you're gonna fail on the
next part of this test that we throw at
you and they thought that they were
really holding on a very narrow ground
but the ground that they held on was
that requiring a information security
program was too ambiguous of a
requirement it didn't provide an exact
thing that lab MD had to do and so it
wasn't acceptable it couldn't stand as a
remedy because it didn't necessarily
specifically remedy the problem at fault
which the court said could have been
something like don't allow people to
download white line wire on their
computers anymore so what inadvertently
the curt was Court did in trying to have
a narrow holding is really push the FTC
into this world where now when they
enter in these consent decrees rather
than having a requirement that could be
evaluated determined based on the
secured the sensitivity of the data that
the company could really figure out now
the FCC has to be super prescriptive and
has to make very specific requirements
for companies that may be too arduous in
some cases that may be too bureaucratic
that might not actually solve any of the
problems but it's going to require the
FTC to have a lot more detail in any
future consent decrees with companies
who engage in bad trade practices so
this is a really a live issue right now
I imagine that that is going to they're
still deciding if they're going to
challenge it up or if they're going to
try to seek further review of this case
but it's actively changing area where
the FTC is allowed to act
oh so we're gonna talk a little bit
about why why do we even care about all
of this why does it matter
bad security in the IOT world can can
wreak havoc all over the world and in
fact it it has the Mirai botnet which
used to kick the most visited websites
offline around the u.s. and encourage
super high costs for a lot of people was
made up of a botnet of infected IOT
devices the impact can be heavily felt
in areas like children's toys this is
the Kayla doll that Germany banned
because it was collecting it said too
much sensitive information about
children to sex toys access now actually
filed an FTC complaint against the sex
toy manufacturer last year because it
was collecting information and
transmitting it in securely the
manufacturer of the sex toy you see on
your screen was fined four million
dollars for collecting way too much data
and they said that they were collecting
more data than they needed to and the
possibility for these type of devices to
be hacked and controlled remotely
outside you know we said arms are
threats to the data threats to the
device hacked and controlled remotely
implicates an entirely different problem
with security we're already seeing IOT
devices hacked cars guns planes as
things get device connected they're
having real world impact with their
insecurities and essentially this is a
market failure this is with that you
would you say that Harley market failure
I think that there is a wide recognition
that market incentives are not aligned
to actually promote IOT security
especially in low low-grade products
that have a very small profit margin
security is difficult to build in and
maintain over time it's not something
that you can just do once and then
ignore and and it
it is increasingly apparent to
regulators as well as folks that are
watching this space that the amount of
devices that are coming through that are
not secured are not commensurate with
the market forces that are pushing them
to be secured I'm not sure that we're at
the point where we know exactly what to
do about yet about that yet that is part
of the discussion that we're talking
about here this it's a very live and
ongoing conversation but there I think
we're reaching a point where folks are
questioning whether the voluntary nature
of many efforts to try to get I o T
secure whether or not that is actually
working and whether consumers are not
too exposed
so in Congress there are we'll talk
about two different laws just briefly um
one is the Internet of Things cyber
security Improvement Act this is a
requirement for certification on some
level of security and update ability for
devices contracted for by the US
government
so devices that the US government
procures or rents in some way have to
meet some basic level of security and
update ability it also has provisions to
protect security researchers who act in
quote-unquote in good faith that would
do a lot in the security researcher
space in relation to IOT but we think
probably not enough it's definitely not
a perfect proposal but it goes a lot
further than what we have today some of
the vague definitions though I think it
fails we're hardly talked about earlier
where it applies to everything
everything from like the teeny tiniest
connected device all the way through
your gigantic desktop computer that sits
on your on your desk at home we we think
that this is actually the the concept
behind this bill is a very good one I'm
focusing on federal procurement focusing
on the government's own purchasing
dollars is one way to sort of
short-circuit the traditional opposition
that
comes when government tries to directly
directly regulate the private sector we
hear very often that it's well
government should clean its own house
before telling the private sector what
to do and that's what this bill would be
aimed at doing but as Amy said it did
run into a media trouble with the
definition of IOT because the definition
that they used which is actually an
accurate definition but it's you know
it's a physical object with Internet
connectivity but that encompasses every
phone every laptop every battleship you
know ever every every tank now and and
it became too unwieldy and so the
conversation became how do they scale
back that that that broadness so that it
actually becomes practicable but that's
that's sort of where the bill is now a
second proposal is the cyber shield Act
this has been in part proposed by
representative Liu and it creates a new
body in the government that will
implement or decide on minimum security
standards and if companies IOT companies
meet those minimum security standards
they'll get some sort of seal that they
can put on their packaging or on their
product or whatever they box they're you
know connected car comes in and say that
they have met the requirements on
security and so that is another proposal
in Congress right now neither of them
have gotten very far is that safe to say
it is the the cyber shields sort of
envisions like an energy star style
scheme for for security and although
there are other certifications and
standards that are that are out there
there's actually a ton of standards that
are out there for for security this
would be the first one that that is run
or at least facilitated by the federal
government and the way that they had set
it up it's not the federal government
sort of deciding the standards it'd be
an open process with in collaboration
with experts and the private industry
and on balance we think that it's
actually it's a good idea it's
worthwhile having the Energy Star
program is a big success but that too as
Jamie said has has run into into
opposition so Amy covered
the Federal Trade Commission and sort of
what's happening there in courts right
so litigation we talked about some of
the state laws and they me just covered
Congress so a federal legislation but
there is this other giant part of
governments which is executive agencies
and so it's a is is worth looking at
what these executive agencies are doing
about IOT security and so behold this is
this is the Great Wheel a federal agency
action the great we love acronyms and so
NIST the National Institute for
Standards and technology's right in the
Department of Commerce so this is
possibly the most important though least
exciting of agencies when it comes to
this issue NIST has is actually very
focused on IOT security they have an IT
security program they have 30-plus work
streams that have some relation to IOT
security many of these work streams are
standards of various kinds technical
standards which is sort of their bread
and butter but they're very in-depth
comprehensive very technical but they
are also pursuing additional initiatives
and I'll just talk about two of those
but remember there are you know some
some thirty of them one of them which
was just recently announced just in the
past couple months is an initiative on
lightweight cryptography the idea is to
have a decently strong cryptography that
can be used in devices that don't
necessarily have a great deal of
processing power so that initiative is
kicking off shortly there's also a an
initiative on managing IOT privacy and
security risks which is very fresh they
actually just recently had a workshop on
it this is this is last week and it is
right now directed towards federal
agencies so it'd be how federal agencies
managed IOT security and privacy but in
our experience in the past many of these
many of these types of documents that
are aimed at federal agencies can easily
be applied to the private sector as well
and sometimes they become popular enough
with the private sector that they
effectively even though it's supposed to
be for federal agencies it ends up being
for both federal and private sector
but the this this document in managing
IOT privacy and security risks includes
a lot of the stuff that you would want
to see it's talked about supply chain
updates device identification
organizational and device mitigations so
it is it is relatively comprehensive and
it's in draft form so it's ongoing right
now and there's an opportunity to
participate in that is so you if you
should so choose next acronym please so
the Food and Drug Administration FDA
have actually been somewhat pioneers in
this in this space they some time ago
had said that they wanted to see their
medical devices safe that's that's their
original mandate and that safety
includes cybersecurity and as so that
that part is mandatory the devices must
be secure but they've also released
post-market guidance for medical device
cybersecurity which is not mandatory
it's quasi mandatory but it says to
reach that mandatory goal of security
cybersecurity here is what we recommend
here is what we would do and as with the
the NIST documents I referenced it's
relatively comprehensive and one of the
things that it says for example is it
has a a graph of risks that are severe
and likely likelihood of exploitation
and if you reach a certain points in
that in that matrix then you must issue
a recall or issue an update it also has
refreshingly a coordinated vulnerability
process requirements so that if if
researchers come to a company with a
vulnerability the company's supposed to
act on it and so forth so that is that
is already out there next please
so this is the National Highway Traffic
Safety Administration's it's my favorite
acronym in DC is it and it's a I my
personal favorite is probably still
Patriot probably still Patriot because I
just thought that was wow what a took
some creativity there's there are some
very skilled acronym makers in DC so
Nitsa so this is part of the Department
of Transportation and unsurprisingly
they run traffic safety and they have
made clear that their existing
authorities in terms of the safety of
vehicles also encompasses Cypress
and they have exercised that authority
so for example they were behind a recall
of 1.5 million Jeep and chrysler
vehicles after the infamous Charlie
Miller Chris valasek hack of a Jeep so
they didn't need new authority to do
that and and they were recalled over a
cybersecurity safety issue in addition
to them exploring what their existing
authorities enable them to do they have
also issued voluntary guidance for car
manufacturers that goes into some depth
about car security as a defense in depth
you know a risk assessment pentest
segmentation core Native ulnar ability
disclosure etc this as with FDA and
you'll find this as a pretty common
theme is focused really just on safety
on physical safety next please
so the Consumer Product Safety
Commission they recently held a hearing
exploring how their existing authority
covers consumer IOT that too limited
just to safety and they actually stated
in submitting comments and as part of
their hearing you know please just focus
on on the hazards physical hazards that
these devices can pose and Amy actually
you had submitted comments to that
hearing we did we will ask them to focus
on the criminal aspects on criminal law
specifically at the state level but also
at the federal level does not
necessarily anticipate in a lot of cases
crimes that happen because of technology
and so we know arson is a thing and if
you set something on fire it's arson if
you caused a toaster toasters to turn on
and overheat and you set a house on fire
criminal laws don't necessarily
anticipate that as being arson and what
we don't want to happen is for laws that
are already over broadly interpreted and
used to target computer researchers like
the Computer Fraud and Abuse Act to be
expanded unnecessarily in order to take
care of crimes that should be dealt with
by traditional criminal law and so we've
asked them to do a survey of criminal
laws across the country and to see how
criminal law needs to be adapt
for crimes that can happen through IOT
devices I think that is an excellent
point or just note though that the okay
all right that the the Consumer Product
Safety Commission is looking also at the
the straight regulation of the design
and manufacture of these devices as they
relate to hazards next so the National
Telecommunications and Information
Administration they came out with an IOT
green paper it does cover IOT security
and privacy although not in tremendous
depth but it talks about the same
familiar things risk management security
by design etc next please the Department
of Energy FERC actually the Federal
Energy Regulatory Commission is taking a
more active look at how cyber security
relates to electrical equipment this is
IOT in a broad sense so you know
large-scale electrical equipments that
you would normally find in things like
power plants next the Department of
Homeland Security they release strategic
principles for securing the Internet of
Things there they talked about you know
basic security steps that have been
covered in the in the other reports but
also a call to action for policy makers
and legislators to use their existing
authority to look at tort liability and
to look at the possibility of new
regulation and then lastly the White
House working with NIST and the
Department of Homeland Security on
automated attacks and botnets now this
is from an executive order interestingly
the executive order focused on automated
attacks and botnets but a great deal of
the resulting report and work are
actually focused on IOT no doubt this is
inspired by the Mirai botnet and there
it talks also about calling on agencies
to enforce their existing Authority and
calls in the community to disrupt
attacks and it calls on manufacturers to
make IOT easier for consumers to use
more securely and calls on manufacturers
to adopt all these voluntary standards
that are out there
next please so
there's a big question in place about
whether IOT manufacturers and operators
will actually abide by will actually
adopt all of these standards and all of
these voluntary documents that are out
there there are many many of them as I
hope that run through just demonstrated
so if and if they don't then what
happens are we looking at the
possibility of new regulation which
itself is an arduous process but will
will buyers require adherence to these
standards and will users demand these
are things that we should be really
vigilant about so we should be watching
these voluntary programs and and be very
skeptical of calls for new voluntary
programs or new voluntary standards and
at the moment that you hear somebody say
well there should be an IOT security
standard out there there are there
there's there's at least a dozen you
know thirty of them or so in addition
there are ways that we as consumers and
we as tech-savvy people or we as
security researchers are able to help
many of these standards are developed
through an open process where anybody
can show up and contribute even some of
the some of the reports that are not
necessarily standards you can contribute
to them and offer your input there are
also ways you can vote with your wallet
ul and Consumer Reports are at various
stages of maturity and developing
certifications for IOT to give consumers
better information about the security
level of the of a given device the
Consumer Reports one actually is also
open so that people from the community
can come and contribute and give their
feedback and then lastly if you have the
the skills to do it
there are legal ways perfectly legal
ways to actually examine the security of
IOT the that last logo there is the
Copyright Office the Copyright Office
has actually issued some pretty
forward-looking regulations scaling back
the section 1201 of the DMCA prohibition
on on circumventing technological
protection measures this is this is
actually one major way that security
researchers found themselves in legal
trouble and they there are there they've
actually put forth a means for
researchers to conduct that kind of
research while avoiding that liability
as long as you're not
making other laws and as long as you're
doing it responsibly and solely for
security as opposed to money then you
you are able to look at the security of
IOT devices and bring it to the
manufacturer with the goal hopefully of
a positive resolution like a patch and
greater public transparency and that is
all that we've got in terms of time I
think we thought that we had an extra 12
minutes but apparently we don't - if
anybody has a burning question or we can
answer them please remember that we
cannot see your hands if you raise it
I understand that there's a microphone
and that's what we should be listening
to Mike I understand this is not exactly
your problem but I just wanted to ask
this because of the title of the talk
and so on so you have a large large
networks like this with nodes that
operate with varying rules and so on
emergent behavior that can emerge in any
kind of system like that
at what point what number of Internet of
divided Internet of Things devices does
it take before you start seeing
nonlinear non mechanistic behavior
consciousness you know self-awareness
and do those kind of phenomenon that
could start rippling around could that
be an issue as well I will meditate upon
that on my plane ride home I don't know
the answer I'm sorry but I think it I
think it probably depends a great deal
on on the type of devices right I mean
if they're all if they're all the same
device that consciousness is extremely
limited if you have devices that focus
on a bunch of different aspects of
reality then you start to approach the
singularity maybe you know in a you know
by a small degree next question so I was
thinking about the statement of how do
we get people to care about the security
of all these IOT devices and you
mentioned consumer reports and like
their rating system and I wondered how
could we get people to care about that
like the IHS did in the 90s with car
safety because I feel like that wasn't
as much in the public eye they really
made a big deal of it and then now it I
thought it seemed through manufacturers
responded that oh we have to do good on
this test a little bit of this I think
is and this will be the last question is
going to be protecting vulnerable
populations when you had car safety
regulations put into place things like
seatbelts they were to make sure that
even like the cheapest vehicles that
were out there we're providing a level
of security that was necessary in the
IOT space a lot of times when you talk
about regulation you hear innovation
you're gonna kill innovation with
regulation what we really want to do is
make sure that even the products that
are being purchased by the lower
socioeconomic classes
are providing a baseline minimum of
security that other people are going to
be able to afford by virtue of being
able to afford things and that is that
one of the big things to get to and I
would just very quickly point out I
think we had automobiles for 750 years
before we had seatbelts and we are still
at the very very much at the knee of the
curve of what IOT is is going to do and
but we had horrible car accidents for a
very very long time before safety
standards were really put into place and
save so many lives thank you ever thank
you everybody
[Applause]