Regulation of the Internet of Things (IoT) is growing at the federal and state level and pushing organizations to include robust security features in their devices.

The U.S. Internet of Things Cybersecurity Improvement Act of 2020 (the "Act") was enacted in December 2020 by Congress, and although it applies only to federal agencies, it is expected to have a significant impact on the development and manufacturing of IoT devices. This Act requires that federal agencies only procure IoT devices that comply with the National Institute of Standards and Technology's (NIST) guidelines for IoT device security.

Currently, NIST has published a draft publication 800-213, titled "IoT Device Cybersecurity Guidance for the Federal Government" that is expected to be finalized this year. This draft guidance recommends that federal agencies have "minimal securability" for IoT devices prior to purchase. NIST defines "minimally securable IoT device" as a device that has "the device cybersecurity capabilities customers may need to mitigate some common cybersecurity risks..."

Given the significant buying power of the federal government, private companies are likely to follow the NIST guidance when it is finalized. Additionally, some states regulate the use and deployment of IoT, including California and Oregon. Laws in both states require manufacturers of IoT devices to equip devices with "reasonable security features." However, each state fails to define "reasonable security features." Instead, the NIST guidance, when finalized, is expected to provide such clarity, at least within the US, through a standard definition. We also expect continued enforcement from the U.S. Federal Trade Commission through litigation and other enforcement activities as they relate to IoT device security.

To learn more about the regulation of IoT and to help answer questions about related trends, we interviewed Donna McPartland and Shamim Mohandessi from Han Santos, PLLC, and Larry O'Connell from Sequitur Labs, Inc.

Shamim Mohandessi (HS): A data breach, while not always fatal, can create significant costs both in remediation and in brand injury. Especially for small and mid-size companies, lax data security (and the ensuing data breach) can make a company a high-risk partner in both commercial and corporate transactions.

Larry O'Connell (SL): IoT is exploding - more than 75 billion devices are expected to be online within 5 years. Most of these devices are being deployed without acceptable levels of security - about half of device vendors experienced a data breach at least once.

Larry O'Connell (SL): Data breaches are expensive. According to the Ponemon Institute, the average cost of a data breach is about $4M and has been rising (10%) over the last five years.

At an individual level, a data breach can exceed 10% of a product's revenue. This does not include other long-term impacts to business, including harm to its brand, loss of customer trust, and theft of your intellectual property.

Donna McPartland (HS): In-house counsel and legal teams working within IoT companies need to understand the legal and regulatory environment and industry best practices related to IoT device security. This is one of those instances where in-house counsel is not protecting against obscure legal risks, but rather providing first-line protection against material business risk.

Larry O'Connell (SL): In addition, edge device security is now a critical concern and can no longer be considered optional. It should be a high priority in any vendor's risk management process.

Larry O'Connell (SL): The problem becomes more urgent with the acceleration of the deployment of Artificial Intelligence (AI) at the edge. Historically, artificial intelligence models were housed in a highly secure central (cloud) area, accessed by devices at the network edge.

Edge devices are now performing these tasks locally, which is an exciting development for applications like robotics, intelligent video analytics, and autonomous machines.

About 75% of all data is expected to be generated at the network edge. This development does, however, increase the urgency to protect AI models – which represent critical intellectual property – on edge devices.

Larry O'Connell (SL): In recent years, cybersecurity for edge devices has become a top-of-mind issue. Recent developments include high-profile supply chain attacks (e.g., Solar Winds), the IoT Cybersecurity Improvement Act, and a recent Presidential Executive Order for improving the nation's cybersecurity. As a result, end-users have increased levels of concern for device security, and device vendor CSO's must prove that their products are secure.

Donna McPartland (HS): Today's in-house counsel should be intimately aware of these issues, but it goes without saying, that we can only juggle so many items at once.

At Han Santos, our experienced attorneys can assist and augment in-house counsel with assessing a given company's data security program. From there, a work plan can be generated to guide any proactive work that needs to be done internally or externally.

It’s also important to note that legal can’t solve all these problems on their own. A certain degree of technical capability is required. We partner with specialty technology firms to help drive proactive enhancements to nascent data security programs.

Larry O’Connell (SL): In-house counsel should recognize that cybersecurity may never be a vendor’s core competency and that finding a strong partner in the space may be the right strategy.

Donna McPartland (HS): In-house counsel should track federal and state laws in this area as well as the finalized guidance from NIST (mentioned above). As a practice, Han Santos continuously monitors and updates clients on the ever-evolving data privacy and cybersecurity landscape. You can find those updates on our website or by subscribing to our Data Privacy and Cybersecurity Team’s updates and blogs.

Larry O’Connell (SL): Cybersecurity at the network edge is difficult. Here are a few challenges:

Companies must understand a complex set of features and functions needed to secure a device, and how to extract those features and functions from the silicon (microprocessor) selected for the product.

• Threats are evolving and technology (for example, encryption methods) is evolving as well.
• Companies are still under pressure to release products on time and keep up with the competition – without sacrificing security.

As a result – companies look for partners who are experts in the space to help them deliver a robust security solution.