US lawmakers balk at call for IoT security regulations

Compromised IoT devices could be used to launch dangerous attacks, Schneier says

The U.S. government needs to pass regulations mandating internet of things security measures before device vulnerabilities start killing people, a security expert told lawmakers.

A massive distributed denial-of-service attack aided by IoT devices in October "was benign" because a couple of websites crashed, said Bruce Schneier, a veteran cybersecurity researcher and lecturer at Harvard University. But the next attack may be more dangerous.

With cars, airplanes, thermostats, and appliances now connected to the internet, "there's real risk to life and property, real catastrophic risk," Schneier told two House of Representatives subcommittees Wednesday.

While some Republican committee members questioned the need for IoT security regulations, Schneier suggested that sellers and customers of IoT devices have little reason to fix them without a push. 

Many IoT devices are low-profit products with little security built in, no easy avenue to patch vulnerabilities, and no way for customers to know their devices are compromised, he and other experts said. And while users replace smartphones every 18 months, a compromised DVR may be used for five years, a car for 10, and a thermostat may be replaced "approximately never," Schneier said.

This leads to a market failure where regulation is needed, he said. "The market really can't fix this," Schneier added. "Buyer and seller don't care."

Schneier's call for IoT regulations is likely to meet resistance in the Republican-controlled Congress, however. Regulations aren't completely off the table, but they would be a "knee-jerk reaction" to recent attacks, said Representative Greg Walden, an Oregon Republican. "The United States cannot regulate the world."

Many IoT devices are manufactured overseas, Walden noted, and U.S. regulations can't mandate their security measures.

In addition, regulations could limit innovation from U.S. IoT companies and hurt the nation's chances to be a world leader in the IoT industry, Walden said. "We don't want this to be an innovation killer," he added. "I don't think I want my refrigerator talking to some food police."

Other witnesses during Wednesday's hearing called on the U.S. government to push for IoT standards that the industry can adopt. On Tuesday, the U.S. National Institute of Standards and Technology released updated guidance on securing IoT.

IoT security remains "woefully inadequate" even as security experts saw the problems coming, said Kevin Fu, CEO of Virta Labs and a computer science professor at the University of Michigan. "We are in this sorry and deteriorating state because there's almost no cost for a manufacturer to deploy products with poor cybersecurity."

Fu called for national IoT security standards, more federal research on IoT security, and a national testing lab for devices. 

The U.S. should start with standards and "apply pressure" to IoT device makers, added Dale Drew, CSO for Level 3 Communications. "They can be applied globally, and I think we can get some traction and momentum before we start regulating."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Grant Gross

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?