FTC to IoT Developers: Get Serious (or at Least Reasonable) About Security
By Matt Gibson
Just last week, the Federal Trade Commission (FTC) released a
In the IoT Report, the FTC staff devotes a significant amount of space for a discussion of the security implications stemming from the sharp rise in the number of IoT devices. The Report’s authors note that there was “widespread agreement” during the FTC’s
security by design;
internal security procedures;
monitoring of service providers;
implementation of access control measures; and
continued monitoring for security vulnerabilities.
Of course, the devil is in the details. Take, for example, the FTC staff’s suggestion that IoT developers monitor for security vulnerabilities throughout an IoT device’s life cycle. The FTC appropriately recognizes that context should drive both consumer expectations about security support and IoT developers’ obligations. Yet, parts of the FTC’s discussion of IoT security– particularly relating to a developer’s decision to end its support for legacy devices – leave something to be desired.
At a high level, it is difficult to criticize the FTC staff’s view that IoT developers should notify customers when it plans to end its support of a product. For many IoT developers, the key will be when they must do so, and on that front, the FTC has provided scant guidance. The FTC does not overtly state that developers must predict a product’s end-of-life at the outset. This is a good thing, as setting an end-of-life date when a product is first marketed is a particularly fraught exercise. Setting a distant date could expose the developer to an FTC enforcement action if the developer is unable to provide support as promised. At the same time, however, setting a close date may have repercussions in the market if consumers misperceive that the developer is engaging in planned obsolescence in order to drive future sales. But, if a developer decides to defer setting a device’s end-of-life until later in the product’s life cycle, it is unclear how much advance notice consumers should reasonably expect to receive.
In the absence of more specific guidance, IoT developers should expect the FTC to develop and then solidify its views in future enforcement actions. And so, for the moment, IoT developers should tread lightly, carefully, and (above all else) reasonably.
Caveat Vendor is Paul Hastings’ Consumer Issues blog. We welcome your feedback. Please contact our blog editor with any thoughts or suggestions.