IoT security regulations refocus data privacy best practices
IoT and the many technologies associated with it challenge existing thinking and legal structures. Organizations must understand and abide by regulations that push for greater transparency across IoT security and data policies.
The age of ubiquitous tech surveillance has arrived — countries such as China score their citizens’ social behavior through tech monitoring — and IoT devices are part of the equation. A patchwork of old and new legislation for IoT security regulations empower organizations and constrain data collection and its unauthorized use.
The Gartner report “Top Strategic IoT Trends and Technologies Through 2023” noted that there will likely be broad social, legal and ethical effects associated with IoT security regulations. Some of those effects are already landing on the doorstep of IT.
In IoT, organizations struggle with two areas related to regulation: the security of devices and the privacy and ownership of data collected by those devices, said Ed Featherston, technologist at Hewlett Packard Enterprise. IoT devices must balance being consumer-friendly, small, easy to use and cheap, but also secure. Featherston said many device developers make tradeoffs and don’t focus on the security side, which has driven the U.S. and U.K. to take legislative action. Europe has led IoT security regulations with GDPR. The U.S. lags far behind, with some of the individual states taking up the mantle. For example, California has crafted a regulation similar to GDPR called the California Consumer Privacy Act. “Frequently, people don’t realize that the value of IoT devices is not the devices; it’s the data the devices collect,” Featherston said. For example, if someone has a pacemaker, it might connect via Bluetooth to their phone, which connects to the internet. It constantly sends health updates and information about the individual, including physical activity and heart rate to the vendor and doctor. That data leads to better care for individuals, because the doctor is more aware of their symptoms or potential problems. Patient data also has value for vendor analysis and for sale. “Who owns that data is something governments are struggling with,” Featherston said.
Gartner’s report also points out complexities such as emerging ethical dilemmas. For example, when IoT devices detect an imminent accident, such as a vehicle collision, what is the role of the devices in determining the outcome? Who lives and who dies? Karen Gullo, analyst at Electronic Frontier Foundation (EFF), said the challenges with data privacy and IoT security regulation in the U.S. begin with a law designed originally to protect the entertainment industry. The Digital Millennium Copyright Act (DMCA) of the 1990s, aligns with regulations of the World Intellectual Property Organization and imposes criminal penalties on pretty much anything that circumvents copyright protection on a variety of electronic media. In practice and through further extension, it has largely shut consumers, other businesses and even security researchers from peeking into almost any hardware or software product. This means only the manufacturer controls the inner workings of these devices. Privacy rights will be the lynchpin of successful IoT adoption. “We’ve fought for years against copyright and DMCA abuse and people’s right to repair their devices, vehicles and appliances,” Gullo said. “We have a lawsuit pending against the government that challenges the constitutionality of the Digital Millennium Copyright Act’s anticircumvention and antitrafficking provisions on First Amendment grounds,” she added. Gullo said EFF has also filed petitions with the Library of Congress in the triennial rule-making process seeking exemptions from Section 1201 to protect and expand users’ rights to tinker with and repair their digital, software-controlled and IoT products.
