White House Gathers Industry Support for Internet of Things Labeling Work

Written by Suzanne Smalley and Tonya Riley

October 19, 2022 | Cyber ​​Scoop

White House officials Wednesday brought together industry leaders, policy experts and government leaders to discuss plans for security and privacy standards for connected devices.

The conference is being advertised as a workshop for the White House Internet of Things Labeling Initiative, which includes White House cyber chief Anne Neuberger, Federal Communications Commission Chairman Jessica Rosenworthel, and the National Cyber ​​Director Chris Inglis, Senator Angus King, and I-Consumers of Maine attended. Technology associations, industry executives, and non-profit consumer advocacy group Consumer Reports.

Industry leaders from Google, AT&T, Comcast, Amazon, Cisco, Intel, Samsung and Sony, as well as officials from the American National Standards Institute and the National Retail Federation, attended the conference, according to the White House.

The conference will discuss how labels can be adapted to international standards, how barcodes are designed to help consumers find information about products online in a timely manner, and overall consumer awareness of IoT vulnerabilities. The focus was on implementing programs that focused on issues such as how to raise .

CyberScoop first revealed plans for the White House meeting last week.

The labeling program is still in its early stages, but the White House plans to roll out the first set of standards in the spring of 2023, and plans to launch a voluntary program with standards for particularly vulnerable internet-connected devices such as internet routers. is.

A White House official told reporters that the program will implement criteria such as vulnerability remediation, the amount of information collected about consumers, whether data is encrypted, and interoperability with other products. said they would likely evaluate the device based on

“It’s simply ‘If it’s made in one country, it’s safe. If it’s made in another place, it’s not,'” the official said.

Brandon Pugh, senior fellow and policy counsel at the R Street Institute think tank, said at the conference with the impression that broader privacy standards around data collection and sharing could also be considered part of the future rating system. said he left behind.

Pugh said the lack of cybersecurity in internet-connected devices deserves immediate attention.

“As a consumer, you really take a chance and want the best,” Pugh said.

A senior White House official told reporters on Wednesday that the label contains a barcode that consumers scan so they can see a specific manufacturer’s security practices in real time, “keeping the label fresh.” He said he would assure

“Given the way cybersecurity continues to evolve indefinitely, vulnerabilities will continue to evolve,” the official said.

Senior Federal Trade Commission leaders attended the workshop, which highlighted compliance and enforcement tactics, the official added.

“They talk about the ability to enforce on the label and the security of devices that meet the criteria within the label,” the official said, comparing the “model of market enforcement” to nutrition labels.

A researcher at the Carnegie Mellon University CyLab Security and Privacy Institute, who has spent more than four years on a separate grading effort known as the “Privacy Nutrition Label for IoT Devices,” demonstrated the approach at a conference, and his prototype is ready for consumption. I pointed out that it is for people. Tested and ready for implementation across the IoT industry.

Researcher Yuvraj Agarwal said he did some consumer research to determine whether he would spend more money on products with enhanced security and privacy standards.

Agarwal told CyberScoop: “Consumers want to pay for better devices in terms of security and privacy.”

Google representatives who attended the workshop published a blog post on Wednesday praising the effort.

Dave Kleidermacher, Head of Security for Android and Google Play, wrote: “However, the IoT industry does not yet have a globally harmonized method for measuring the security quality of connected products. may not have sufficient visibility.”

Kleidermacher said Google’s leadership is “encouraged” by the White House’s efforts to accelerate IoT security standardization to “increase the security transparency of the IoT products people use every day.” rice field.