5 ms·

> The FCC recently issued a Notice of Proposed Rulemaking [2] for a cybersecurity labeling program for connected devices. That appears to me to be the wrong wa

by hannob 3y ago

> The FCC recently issued a Notice of Proposed Rulemaking [2] for a cybersecurity labeling program for connected devices. That appears to me to be the wrong way to go about this, and it has specifically to do with how IoT security is a problem. The most severe case of IoT security problems we have seen were things like mass botnets, where plenty of devices of the same type were hacked and then used for things like DoS attacks. Notable cases include the DoS attacks against Brian Krebs for some of his reporting. The important thing to understand here is that the device owner is not the primary victim. That's a third party. This is not about consumer choice, because consumers by and large do not care, because they are not the people being affected by this. An optional security label tries to adress it as a consumer choice problem, which it isn't.

jtbayly 3y ago
That’s only one aspect of the problem. Lots of people have been bitten by suddenly unsupported devices. I think it could do some good.
- sanderjd 3y ago
  Sure, but the question here seemed to be about security, specifically. What you're talking about is definitely a problem, but it seems like a different one.
cosmojg 3y ago
Exactly. I don't see the situation improving until either the owner or, preferably, the manufacturer of a device that participates in a DoS attack is held partially accountable for said attack.
- marcosdumay 3y ago
  Well, you can't hold somebody accountable if there isn't even a label or information somewhere saying that what they are doing is dangerous.
  - otterley 3y ago
    Sure you can. For example, we have vehicle codes that hold people accountable for dangerous driving.
    - marcosdumay 3y ago
      We don't hold people accountable for buying the wrong model of car and using it.
      - otterley 3y ago
        We do -- in a sense. For example, in CA, you can't lawfully drive a car that has failed a mandatory emissions test. In some sense, cars are better examples for responsible ownership, because almost every state requires you possess insurance to drive it. The price of an insurance premium is (supposed to be) commensurate with the risk of driving it, and insurance premium rates do influence the market for vehicles.
eru 3y ago
Sounds like you are making an argument based on externalities. That's fine. But economic theory also gives you standard answers for externalities: Don't ban the behaviour you dislike. Either let people sort it out themselves (like the Coase Theorem https://en.wikipedia.org/wiki/Coase_theorem https://en.wikipedia.org/wiki/Coase_theorem describes), or at most tax the offending behaviour.
- sanderjd 3y ago
  I don't get what you're saying here. What "offending behavior" are you referring to in this case that might be taxed to disincentivize it?
  - eru 3y ago
    Suppliers can already make binding promises about their hardware. If you open your wallet wide enough, you can already buy enterprise grade hardware that comes with guaranteed long term support. OP says, amongst other things: > I’ve advocated for the FCC to require device manufacturers to support their devices with security updates for a reasonable amount of time [1]. So the offending behaviour in this case would be for a manufacturer not to provide security updates.
MarcoPerazaFCC 3y ago
Thanks for this great observation. I encourage you to share it in an official comment. In a final rulemaking, perhaps we could make it clear that the purpose of the label is not only to protect the purchaser of the product but also anyone who might be injured by way of a compromised device. In an FCC enforcement proceeding, we have broad discretion in assessing damages. In contract, the third-party beneficiary doctrine could allow victims of such attacks to enforce label commitments. And in tort, statutory duties apply to anyone who is within the class of people that the law seeks to protect. So the law is flexible here, but it depends on what exactly our final rules say.
otterley 3y ago
In order to make it a consumer problem, we'd have to make it a criminal violation to participate in a botnet. We could make it a punishable infraction I suppose, much like a speeding ticket for automobiles, but somehow I just don't see this happening in a coordinated fashion across the world.
- hutzlibu 3y ago
  I think it is already illegal to participate in DDOS. Even though enforcement is .. pretty much nonexistent? And how could you enforce it? It would create an outcry if done consequently. (But maybe a neccessary one) But it also will be a consumer problem, if they cannot access important services anymore, because their IP has been blacklisted, because their toaster participated in too many DDOS or spam attacks.
  - otterley 3y ago
    > I think it is already illegal to participate in DDOS. While it is unlawful to knowingly or intentionally participate in a DDoS, what I'm talking about is the potential of also "criminalizing" (in the sense of a speeding ticket, not jail time - an infraction, not a misdemeanor or felony) using a vulnerable device that is then hijacked by an attacker. Like you, I don't think it's a realistic outcome; I'm merely brainstorming how one could make this a consumer problem through economics.
f33d5173 3y ago
Even if consumers don't necessarily care about security, required labelling gives brands an opportunity to stand out from one another. If I'm looking at two products on the shelf, where one claims to have greater security, and the other makes no such claim, I'm likely to buy the more secure one, even if I don't necessarily care much about security. If getting the secure label is relatively cheap (which it should be, since most of the issues we see are the product of laziness rather than being especially hard to fix), than we could see the market dominated by products promoting high security, even without customers ever caring that much about insecure devices.
- dylan604 3y ago
  oh man, you sound like the type of person that would fall for the intentionally misleading labels that makes it sound like one thing but is in fact absolutely not that thing. just yesterday, there was a link to an article about the lies on food packaging. so, labeling requirements are one thing, but requiring that the information is straight forward and leaves no options for misleading would be great. I just don't think there's ever going to be a way from preventing someone from finding loopholes.
  - SimingtonFCC 3y ago
    There are a couple of NIST papers on specifics for labels: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.02042022-2.pdf https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.02042022-2.... https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/cybersecurity-labeling-consumers-0 https://www.nist.gov/itl/executive-order-14028-improving-nat... They're in FN 20 of the linked proposal for rulemaking (which is 48 dense pages and which I don't expect anyone here to have had a chance to read yet.) If you find yourself skeptical about the NIST proposals, please feel free to comment on the record!
  - hot_gril 3y ago
    "This milk contains no <insert illegal additive>!"
ChrisCinelli 3y ago
Making "x years of security updates" mandatory is likely to end up in a warning disclaimer every time you turn on the TV after x years: "This device does not receive any more security updates. You may be at risk." That will either make a large part of consumers paranoid or annoyed. So they will replace a TV that is in perfectly working conditions with a new TV. Samsung, LG and the consumerist economy would love that!
planb 3y ago
I think you are underestimating how a well known „secure“ label (or lack thereof) could influence customer behavior. It’s not that they don’t care - they (understandably) lack deeper knowledge and therefore don’t base their purchasing decisions on how long they will get updates. „If sticker X is not on the package I will get hacked“ is much easier to grasp.
- doctorpangloss 3y ago
  > „If sticker X is not on the package I will get hacked“ is much easier to grasp. Hmm. In the grocery store, where this idea comes from and has the most persuasive history in govt. regulation, where manufacturers own the front of the package and regulators own the back, what is the healthiest food? The produce and meat. Which has no nutritional label. There's no such thing as a secure IoT device. There's absolutely no such thing as a secure connected device that is also cheap. If you build your computer from commodity parts, it tends to be the longest lasting and most secure. It is usually the most expensive. Anyway, what would the label for a PlayStation 5 and an iPhone 15 look like? Miles long. Then, for the consumer buying the cheapest smart plugs off Amazon? Like one paragraph the vendor copied and pasted from the Internet, along with all the other legal shit they deal with. Whom should be regulated? I guess Amazon and Walmart, the retailers, they are the real gatekeepers. That's what the EU does! Which doesn't fly here. The Waltons live here, not in the EU.
tkinz27 3y ago
A big issue with botnets running on device owner equipment is the amount of bandwidth they "steal" from the device owner. Especially for device owners who are on constrained networks (such as a mobile/satellite network) this can be a really expensive issue for the device owner. So while the device owner may not be the primary victim, they can definitely still be heavily affected.

by hannob 3y ago

jtbayly 3y ago

That’s only one aspect of the problem. Lots of people have been bitten by suddenly unsupported devices. I think it could do some good.

sanderjd 3y ago
Sure, but the question here seemed to be about security, specifically. What you're talking about is definitely a problem, but it seems like a different one.

cosmojg 3y ago

Exactly. I don't see the situation improving until either the owner or, preferably, the manufacturer of a device that participates in a DoS attack is held partially accountable for said attack.

marcosdumay 3y ago
Well, you can't hold somebody accountable if there isn't even a label or information somewhere saying that what they are doing is dangerous.
- otterley 3y ago
  Sure you can. For example, we have vehicle codes that hold people accountable for dangerous driving.
  - marcosdumay 3y ago
    We don't hold people accountable for buying the wrong model of car and using it.
    - otterley 3y ago
      We do -- in a sense. For example, in CA, you can't lawfully drive a car that has failed a mandatory emissions test. In some sense, cars are better examples for responsible ownership, because almost every state requires you possess insurance to drive it. The price of an insurance premium is (supposed to be) commensurate with the risk of driving it, and insurance premium rates do influence the market for vehicles.

eru 3y ago

Sounds like you are making an argument based on externalities. That's fine. But economic theory also gives you standard answers for externalities: Don't ban the behaviour you dislike. Either let people sort it out themselves (like the Coase Theorem https://en.wikipedia.org/wiki/Coase_theorem https://en.wikipedia.org/wiki/Coase_theorem describes), or at most tax the offending behaviour.

sanderjd 3y ago
I don't get what you're saying here. What "offending behavior" are you referring to in this case that might be taxed to disincentivize it?
- eru 3y ago
  Suppliers can already make binding promises about their hardware. If you open your wallet wide enough, you can already buy enterprise grade hardware that comes with guaranteed long term support. OP says, amongst other things: > I’ve advocated for the FCC to require device manufacturers to support their devices with security updates for a reasonable amount of time [1]. So the offending behaviour in this case would be for a manufacturer not to provide security updates.

MarcoPerazaFCC 3y ago

Thanks for this great observation. I encourage you to share it in an official comment. In a final rulemaking, perhaps we could make it clear that the purpose of the label is not only to protect the purchaser of the product but also anyone who might be injured by way of a compromised device. In an FCC enforcement proceeding, we have broad discretion in assessing damages. In contract, the third-party beneficiary doctrine could allow victims of such attacks to enforce label commitments. And in tort, statutory duties apply to anyone who is within the class of people that the law seeks to protect. So the law is flexible here, but it depends on what exactly our final rules say.

otterley 3y ago

In order to make it a consumer problem, we'd have to make it a criminal violation to participate in a botnet. We could make it a punishable infraction I suppose, much like a speeding ticket for automobiles, but somehow I just don't see this happening in a coordinated fashion across the world.

hutzlibu 3y ago
I think it is already illegal to participate in DDOS. Even though enforcement is .. pretty much nonexistent? And how could you enforce it? It would create an outcry if done consequently. (But maybe a neccessary one) But it also will be a consumer problem, if they cannot access important services anymore, because their IP has been blacklisted, because their toaster participated in too many DDOS or spam attacks.
- otterley 3y ago
  > I think it is already illegal to participate in DDOS. While it is unlawful to knowingly or intentionally participate in a DDoS, what I'm talking about is the potential of also "criminalizing" (in the sense of a speeding ticket, not jail time - an infraction, not a misdemeanor or felony) using a vulnerable device that is then hijacked by an attacker. Like you, I don't think it's a realistic outcome; I'm merely brainstorming how one could make this a consumer problem through economics.

f33d5173 3y ago

Even if consumers don't necessarily care about security, required labelling gives brands an opportunity to stand out from one another. If I'm looking at two products on the shelf, where one claims to have greater security, and the other makes no such claim, I'm likely to buy the more secure one, even if I don't necessarily care much about security. If getting the secure label is relatively cheap (which it should be, since most of the issues we see are the product of laziness rather than being especially hard to fix), than we could see the market dominated by products promoting high security, even without customers ever caring that much about insecure devices.

dylan604 3y ago
oh man, you sound like the type of person that would fall for the intentionally misleading labels that makes it sound like one thing but is in fact absolutely not that thing. just yesterday, there was a link to an article about the lies on food packaging. so, labeling requirements are one thing, but requiring that the information is straight forward and leaves no options for misleading would be great. I just don't think there's ever going to be a way from preventing someone from finding loopholes.
- SimingtonFCC 3y ago
  There are a couple of NIST papers on specifics for labels: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.02042022-2.pdf https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.02042022-2.... https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/cybersecurity-labeling-consumers-0 https://www.nist.gov/itl/executive-order-14028-improving-nat... They're in FN 20 of the linked proposal for rulemaking (which is 48 dense pages and which I don't expect anyone here to have had a chance to read yet.) If you find yourself skeptical about the NIST proposals, please feel free to comment on the record!
- hot_gril 3y ago
  "This milk contains no <insert illegal additive>!"

ChrisCinelli 3y ago

Making "x years of security updates" mandatory is likely to end up in a warning disclaimer every time you turn on the TV after x years: "This device does not receive any more security updates. You may be at risk." That will either make a large part of consumers paranoid or annoyed. So they will replace a TV that is in perfectly working conditions with a new TV. Samsung, LG and the consumerist economy would love that!

planb 3y ago

I think you are underestimating how a well known „secure“ label (or lack thereof) could influence customer behavior. It’s not that they don’t care - they (understandably) lack deeper knowledge and therefore don’t base their purchasing decisions on how long they will get updates. „If sticker X is not on the package I will get hacked“ is much easier to grasp.

doctorpangloss 3y ago
> „If sticker X is not on the package I will get hacked“ is much easier to grasp. Hmm. In the grocery store, where this idea comes from and has the most persuasive history in govt. regulation, where manufacturers own the front of the package and regulators own the back, what is the healthiest food? The produce and meat. Which has no nutritional label. There's no such thing as a secure IoT device. There's absolutely no such thing as a secure connected device that is also cheap. If you build your computer from commodity parts, it tends to be the longest lasting and most secure. It is usually the most expensive. Anyway, what would the label for a PlayStation 5 and an iPhone 15 look like? Miles long. Then, for the consumer buying the cheapest smart plugs off Amazon? Like one paragraph the vendor copied and pasted from the Internet, along with all the other legal shit they deal with. Whom should be regulated? I guess Amazon and Walmart, the retailers, they are the real gatekeepers. That's what the EU does! Which doesn't fly here. The Waltons live here, not in the EU.

tkinz27 3y ago

A big issue with botnets running on device owner equipment is the amount of bandwidth they "steal" from the device owner. Especially for device owners who are on constrained networks (such as a mobile/satellite network) this can be a really expensive issue for the device owner. So while the device owner may not be the primary victim, they can definitely still be heavily affected.