MarcoPerazaFCC

30 ms·

1. 1.▲
   by MarcoPerazaFCC 3y ago

   Thanks for the thoughtful reply. I encourage you to file an official comment with your ideas.
2. 2.▲
   by MarcoPerazaFCC 3y ago

   Thank you for this detailed feedback. In the long-run, it's worth asking whether a business that doesn't make money once externalities have been internalized is a business worth having. But this is a voluntary program, and we&#x27
3. 3.▲
   by MarcoPerazaFCC 3y ago

   One my favorite IoT botnet scenarios is an attacker taking control of thousands of ovens/air conditions/other high-wattage devices and using them to cause power outages. https://www.usenix.org/system/files&#x2
4. 4.▲
   by MarcoPerazaFCC 3y ago

   Good question. There's some discussion in this thread https://news.ycombinator.com/item?id=37395218
5. 5.▲
   by MarcoPerazaFCC 3y ago

   I think you're right that it would be difficult for the FCC to precisely define exactly when security updates are required. This is a problem in law generally, one that is usually resolved by imposing a reasonableness standard. Maybe h
6. 6.▲
   by MarcoPerazaFCC 3y ago

   It's a voluntary label, so it's open to competition from other standard-setting organizations. When it comes to mandatory regulations generally, our office thinks that broad standards that are used to hold people accountable for n
7. 7.▲
   by MarcoPerazaFCC 3y ago

   I think you're right that it would be difficult for the FCC to precisely define exactly when security updates are required. This is a problem in law generally, one that is usually resolved by imposing a reasonableness standard. Maybe h
8. 8.▲
   by MarcoPerazaFCC 3y ago

   I think if the box says updates until the beginning of 2025, and they've stopped providing updates before then, you have a pretty good contract lawsuit against them. You'd have to show that their failure to issue a patch for four
9. 9.▲
   by MarcoPerazaFCC 3y ago

   These are all great points and maybe a good reason why a voluntary program like this is the way to start, so a higher-tier of secure products can begin to emerge. We would also love to see the emergence of platforms that allow small teams t
10. 10.▲
    by MarcoPerazaFCC 3y ago

    Thanks for this thoughtful feedback. I encourage you to file an official comment, especially regarding end-user control of update timing. Maybe my response here https://news.ycombinator.com/item?id=37394935 addresses some o
11. 11.▲
    by MarcoPerazaFCC 3y ago

    This will be a completely optional program. And the proposal is that even for participants of the program, they just have to disclose the update period, whatever it may be (could be zero-length).
12. 12.▲
    by MarcoPerazaFCC 3y ago

    This is something that has us worried too. The FCC took some action on this issue last year by outright banning equipment from certain companies (e.g. Huawei), but we haven't even scratched the surface of this pervasive problem. I real
13. 13.▲
    by MarcoPerazaFCC 3y ago

    I encourage you to file a comment suggesting this. It's actually not irrelevant. The FCC is free to decide that the label (which can include a QR code linking to more information) must include information about cameras and microphones
14. 14.▲
    by MarcoPerazaFCC 3y ago

    Hi, the short of it is that I decided to go to law school and then looked for jobs focusing on cybersecurity. If you're interested in jumping over to law, I'm happy to talk about it more. You can find my email in the FCC directory
15. 15.▲
    by MarcoPerazaFCC 3y ago

    This is being proposed as a completely voluntary program. No need to participate in it if you don't want an FCC cybersecurity label on your product.
16. 16.▲
    by MarcoPerazaFCC 3y ago

    If you think stronger action is needed, please share it through an official comment. Even if we don't do what you suggest, thoughtful comments really do influence the rulemaking process. As an aside, it's worth considering that th
17. 17.▲
    by MarcoPerazaFCC 3y ago

    > I've purchased equipment, new in the box, after the mfg had discontinued support. Exactly the kind of thing that sounds crazy but still happens. > 1. Final date the manufacturer will provide firmware updates & security upd
18. 18.▲
    by MarcoPerazaFCC 3y ago

    The general rule in tort is that you need physical injury or physical destruction of property to sustain a lawsuit. There's exceptions at the edges of that, but you basically can't sue a device manufacturer for crummy security tha
19. 19.▲
    by MarcoPerazaFCC 3y ago

    Good question. The Notice of Proposed Rulemaking has a Legal Authority section that discusses this issue https://www.fcc.gov/document/fcc-proposes-cybersecurity-labe... . I also touch on it here https://news.
20. 20.▲
    by MarcoPerazaFCC 3y ago

    Maybe the presence or absence of this capability could be something disclosed on the label? It's an idea worth thinking about. I encourage you to file a comment with your thoughts on the matter. You probably want to focus on how this i
21. 21.▲
    by MarcoPerazaFCC 3y ago

    Thank you for these thoughtful points. Some relevant responses from other threads: From https://news.ycombinator.com/item?id=37394188 : I think you're right that it would be difficult for the FCC to precisely define ex
22. 22.▲
    by MarcoPerazaFCC 3y ago

    > And since this is HN - there is a startup hidden in the midst of all of this: an enterprise-grade IoT OS that "does security right." Sell to the device manufacturers, allow them to market it as "enterprise-ready" or
23. 23.▲
    by MarcoPerazaFCC 3y ago

    These could be great suggestions for the criteria a product must meet to quality for a label. I encourage you to file an official comment with your thoughts.
24. 24.▲
    by MarcoPerazaFCC 3y ago

    In the 2010s, the FCC began enforcement proceedings against more than one hotel chain for using Wi-Fi deauthentication attacks against guests using their own Wi-Fi hotspots instead of the official hotel Wi-Fi networks. The claims were settl
25. 25.▲
    by MarcoPerazaFCC 3y ago

    I think you're right that it would be difficult for the FCC to precisely define exactly when security updates are required. This is a problem in law generally, one that is usually resolved by imposing a reasonableness standard. Maybe h
26. 26.▲
    by MarcoPerazaFCC 3y ago

    Re: the licensing issue, companies wanting to put a label on their product would probably want to extract similar guarantees up their supply chain. Especially with a voluntary program like the one the FCC is proposing, good practices won&#x
27. 27.▲
    by MarcoPerazaFCC 3y ago

    Thanks for this great observation. I encourage you to share it in an official comment. In a final rulemaking, perhaps we could make it clear that the purpose of the label is not only to protect the purchaser of the product but also anyone w
28. 28.▲
    by MarcoPerazaFCC 3y ago

    That's a great question. Devices that emit RF could be hijacked and turned into signal jammers. With smart jamming attacks, even low-power transmitters could potentially cause serious harmful interference to other devices. Botnets of c