[Iotops] fcc and IoT devices

[Michael Richardson <[e-mail]>]

from https://news.ycombinator.com/item?id=37392676
(via Dave Taht)

Ask HN: I’m an FCC Commissioner proposing regulation of IoT security updates

Hi everyone, I’m FCC Commissioner Nathan Simington, and I’m here to discuss
security updates for IoT devices and how you can make a difference by filing
comments with the FCC.

As you know, serious vulnerabilities are common in IoT, and it often takes
too long for these to be patched on end-user devices—if the manufacturer even
bothers to release an update, and if the device was even designed to receive
them. Companies may cease supporting a device well before consumers have
stopped using it. The support period is often not communicated at the time of
sale. And sometimes the end of support is not even announced, leaving even
informed users unsure whether their devices are still safe.

I’ve advocated for the FCC to require device manufacturers to support their
devices with security updates for a reasonable amount of time [1]. I can't
bring such a proposal to a vote since I’m not the chairman of the agency. But
I was able to convince my colleagues to tentatively support something a
little more moderate addressing this problem.

The FCC recently issued a Notice of Proposed Rulemaking [2] for a
cybersecurity labeling program for connected devices. If they meet certain
criteria for the security of their product, manufacturers can put an FCC
cybersecurity label on it. I fought hard for one of these criteria to be the
disclosure of how long the product will receive security updates. I hope
that, besides arming consumers with better information, the commitments on
this label (including the support period) will be legally enforceable in
contract and tort lawsuits and under other laws. You can see my full
statement here [3].

But it’s too early to declare victory. Many manufacturers oppose making any
commitments about security updates, even voluntary ones. These manufacturers
are heavily engaged at the FCC and represented by sophisticated regulatory
lawyers. The FCC and White House are not likely to take a strong stand if
they only hear the device manufacturer's side of the story.

In short, they need to hear from you. You have experienced insecure
protocols, exposed private keys, and other atrocious security. You have seen
these problems persist despite ample warning. People ask, ‘why aren’t there
rules about these things?’ This is your chance to get on the record and tell
us what you think the rules should be. If infosec doesn’t make this an issue,
the general public will continue falsely assuming that everything is
fine. But if you get on the record and the government fails to act, the
evidence of this failure will be all over the Internet forever.

If you want to influence the process, you have until September 25th, 2023
(midnight ET) to file comments in the rulemaking proceeding.[4] Filing is
easy: go to https://www.fcc.gov/ecfs/search/docket-detail/23-239 and click to
file either an ‘express’ comment (type into a textbox) or a ‘standard’
comment (upload a PDF). Either way, the FCC is required to consider your
arguments. All options are on the table, so don’t hold back, but do make your
arguments as clear as possible, so even lawyers can understand them.

I’m here to listen and learn. AMA. Feel free to ask any questions about this
or related issues, and I’ll answer as many as I can. I just ask that we try
to stay on the topic of security. My legal advisor, Marco Peraza, a
security-focused software engineer turned cybersecurity lawyer, will be
answering questions too. I’m open to incorporating your ideas (and even being
convinced I’m wrong), and I hope that my colleagues at the FCC are as
well. Thank you!

[1] https://www.fcc.gov/document/simington-calls-mandatory-security-updates

[2] https://www.fcc.gov/document/fcc-proposes-cybersecurity-labeling-program-smart-devices

[3] https://www.fcc.gov/document/fcc-proposes-cybersecurity-labeling-program-smart-devices/simington-statement

[4] If your comments are purely in response to arguments made in other comments, you have an extra 15 days, until October 10, 2023.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide