Neither regulation nor market mechanisms can really address the problem of device security: There's virtually no overlap between the transactions of (1) purcha

Neither regulation nor market mechanisms can really address the problem of device security: There's virtually no overlap between the transactions of (1) purchasing the device for use, and (2) maintaining the device for security. All the transaction features differ: different parties, different interests, different type of transactions, different risks. That's a recipe for exporting costs that no market mechanism or regulatory scheme can fix. The best way to handle these is to have official succession plans: the manufacturer needs to delegate to a support organization for every product, and every product in use needs a way to indicate if it is up-to-date with support. The FCC maintains the database of support organizations for every FCC-certified device. Everything can flow from that, from current to future legal and market contexts. - Support organizations can take on devices. (Using open-source would be a particularly effective approach.) - Ordinary negligence can attach to users without support or support organizations who fail to address a risk they know of. - Support can be separately regulated - Because support organization (like insurance companies) are taking on the risk, they will discipline manufacturers, raising the cost of producing unsupportable devices. - Effective manufacturers might elect to internalize support (leveraging confidential information) or focus on manufacturing per design. - Support organizations may start contracting manufacturers by design, to reduce overall costs considering the entire lifecycle. Politically, I believe manufacturers seeking to avoid regulation would accept regulation if they have the alternative of offloading it to support organizations. Those organizations would welcome regulation as part of their moat. Large device users would welcome support organizations who can supply the service they need, and support can extend their expertise into consumer markets. Cost/price and the payer would track the value and cover the entire lifecycle.