Modern field guide to security and privacy

Regulators look for role in the Internet of Things

At an Atlantic Council event, experts debated what part the US government could play in regulating the Internet of Things more effectively.

With more than 20 billion devices getting hooked up to the Internet by 2020, the US government could play a big role in creating rules to eliminate software vulnerabilities in those products.

But regulating the potentially $19 trillion so-called Internet of Things (IoT) industry won't be easy. Officials won't just need to develop rules for products that range from refrigerators to cars, but may also need to decide whether to guide that process or follow Silicon Valley's lead.

As the Department of Commerce seeks public comment for rules to regulate IoT ahead of a June deadline, experts grappled with questions regarding the collision between innovation and regulation on connected devices at an Atlantic Council event on Wednesday. 

“I don’t think we’ve figured out what our hygiene standards are for the Internet of Things,” said Joshua Corman, who leads the Atlantic Council’s Cyber Statecraft Initiative. “The size of the innovator is not necessarily the size of the harm.”

Aaron Alva, a technology policy fellow at the Federal Trade Commission; Duane Kobayashi, counsel at the tech firm Senseware; Nyla Beth Gawel, a principal at Booz Allen Hamilton; and John Miller, vice president of cybersecurity and privacy policy at the Information Technology Industry Council, joined Mr. Corman to discuss how regulators and businesses are dealing with the challenges of setting rules for the new industry. 

Here are a few key takeaways from the event:

1. Make security the default 

Before moving toward regulating IoT – which some worry could stifle innovation – experts said that companies can do more to integrate secure settings into connected products.

“What are a company’s practices, what are the processes that could reduce the risk of a failure happening?" said Mr. Alva, responding to possible questions that the agency might ask when dealing with those kinds of cases. "What could be done by having more security defaults, designing in security from the start.” 

Although FTC Commissioner Terrell McSweeney said in February that the FTC was not likely to develop regulations for the emerging space, the agency settled charges against the router company TRENDnet on the grounds that the company misrepresented the information security features on their SecurView cameras.

2. Make new regs, but keep the old

Just because the government is considering IoT regulations, existing regulations are still useful, too. In fact, experts say rules that already exist, such as the Underwriters’ Laboratories standards to safeguard the market for Internet-connected devices, could help companies make better choices around security.

“I wouldn’t think that we should tear up all existing regulatory frameworks and have a free for all,” said Mr. Miller of the Information Technology Industry Council. “It provides those who are using it with a toolbox. They can make more informed, risk management-based decisions.”

3. Move fast and break (some) things

Since the scope of IoT is huge, companies will have to move quickly to adapt. “Every company is becoming a software company,” said Atlantic Council’s Corman. “Toyota woke up one day and wasn’t just a computer on wheels, but a data center on wheels.”

But even though panelists agreed that regulators should move fast and innovate to keep up with Silicon Valley, they should not secure every Internet of Things device the same way – as many connected gadgets won't house sensitive data.

“There are a lot of industries that can handle failure,” said Nyla Beth Gawel, a principal at Booz Allen Hamilton. “I can handle if my Fitbit doesn’t accurately count my steps. I think there’s a monetization of risk that factors in.”


You've read  of  free articles. Subscribe to continue.

Dear Reader,

About a year ago, I happened upon this statement about the Monitor in the Harvard Business Review – under the charming heading of “do things that don’t interest you”:

“Many things that end up” being meaningful, writes social scientist Joseph Grenny, “have come from conference workshops, articles, or online videos that began as a chore and ended with an insight. My work in Kenya, for example, was heavily influenced by a Christian Science Monitor article I had forced myself to read 10 years earlier. Sometimes, we call things ‘boring’ simply because they lie outside the box we are currently in.”

If you were to come up with a punchline to a joke about the Monitor, that would probably be it. We’re seen as being global, fair, insightful, and perhaps a bit too earnest. We’re the bran muffin of journalism.

But you know what? We change lives. And I’m going to argue that we change lives precisely because we force open that too-small box that most human beings think they live in.

The Monitor is a peculiar little publication that’s hard for the world to figure out. We’re run by a church, but we’re not only for church members and we’re not about converting people. We’re known as being fair even as the world becomes as polarized as at any time since the newspaper’s founding in 1908.

We have a mission beyond circulation, we want to bridge divides. We’re about kicking down the door of thought everywhere and saying, “You are bigger and more capable than you realize. And we can prove it.”

If you’re looking for bran muffin journalism, you can subscribe to the Monitor for $15. You’ll get the Monitor Weekly magazine, the Monitor Daily email, and unlimited access to