It seems to me that a law based on technical specifications is going to be hard to define and harder still to enforce. Perhaps, it may be easier to employ mark

It seems to me that a law based on technical specifications is going to be hard to define and harder still to enforce. Perhaps, it may be easier to employ market forces to incentivize the manufacturers to secure (and continue to secure) their devices. For instance, can there be a remediation fund that manufacturers pay into to compensate/support users for privacy or security breaches involving their devices. The amount they pay would be based on the number of the devices involved and the severity of the issue (PII, loss of amenity, network nuisance, etc). The rate paid could also be reviewed periodically to ensure the amount is not too low or too high. This way, companies can put a literal price on security and factor it into their product strategy and planning. The advantage of this approach is two-fold. It internalizes the cost of security so it is no longer an externality that is be foisted on consumers. It also allows companies to apply their innovation towards addressing the issue without hamstringing them into a regulation prescribed approach that may become outdated over time.