States Take the Lead on Securing IoT

The California IoT Law does not provide for a private right of action rather the law will be enforced by the California Attorney General and city and district attorneys. Furthermore, the law does not specify what types of penalties can be sought, what the maximum penalties are or whether the enforcement authorities must prove actual harm to consumers prior to seeking penalties. Despite these limited enforcement provisions, Californians may have other options to prove injury or harm through IoT devices. Californians who suffer from an IoT data breach could bring a lawsuit under California's unfair and deceptive practices statute. The California Consumer Privacy Act (CCPA), which went into effect Jan. 1, 2020, allows for a private right of action for breaches of unencrypted or un-redacted data caused by a business's failure to implement and maintain reasonable information security practices.

Following California's lead, Oregon passed its own IoT law, amending ORS 646.607, which largely mirrors the California IoT Law by requiring that connected device manufacturers equip IoT devices with reasonable security features for devices sold in the state of Oregon. Oregon's law is similar to the one in California in that it uses the same language including "reasonable security features." However, unlike the California IoT Law, the Oregon law is limited to devices primarily used for personal, family or household purposes. The U.S. Congress introduced The IoT Cybersecurity Improvement Act of 2019 which would require that devices purchased by the U.S. government meet certain minimum security requirements. However, it's unlikely such law will pass before the 2020 U.S. general election.

IoT device manufacturers looking for guidance on reasonable security features to implement in the production of their devices should pay close attention to the National Institute of Standards and Technology (NIST)'s Recommendations for IoT Device Manufacturers: Foundational Activities and Core Device Cybersecurity Capability Baseline. The NIST Recommendations are voluntary guidance and non-binding but it provides considerations in assessing privacy and security practices. The Recommendations describe six voluntary activities related to cybersecurity with four activities that a manufacturer can perform before a device is sent out for sale with the remaining two activities that can be performed after the device has hit the market.

• Identify expected customers and define expected use cases for IoT devices.
• Research customer cybersecurity goals and how the device will be managed, accessed, and monitored by the customer or other devices.
• Determine how to address customer goals by having IoT devices provide particular device cybersecurity capabilities in order to help customers mitigate their cybersecurity risks.
• Plan for adequate support of customer goals by appropriately provisioning device hardware, firmware, software and business resources to support the desired device cybersecurity capabilities.
• Define approaches for communicating to customers as many customers as many will benefit from manufacturers communicating to them more clearly about cybersecurity risks involving the IoT devices.
• Decide what to communicate to customers and how to communicate it.

Other states such as Virginia and New York have considered their own IoT laws but none have passed at the time of submission of this article. It will be important for IoT device manufacturers to monitor state law developments as more states considering regulating the security features of IoT devices.

*****

Ashley Thomas is an associate in the cybersecurity and privacy group at Morris, Manning and Martin LLP. She can be reached at [email protected].