FTC Offers Comment on Process Aimed at Improving Security of Internet of Things Devices

The Federal Trade Commission has submitted public comments to a working group convened by the U.S. Commerce Department’s National Telecommunications and Information Administration (NTIA) that is developing guidance about ways for Internet of Things (IoT) device manufacturers to better inform consumers about security updates related to the devices.

The FTC comments pertain to draft guidance on “key elements” that manufacturers should consider conveying to consumers to help them make better informed purchasing and use decisions. Such key elements include whether the device can receive security updates, how it will receive them, and when support for the device would end.

The guidance is being developed by stakeholders involved in the working group, which is part of a voluntary multistakeholder process convened by NTIA on ways to improve the security and patchability of IoT devices. In its comments to the working group, the FTC noted that security updates are an important part of protecting such devices from hackers.

The Commission recommended certain modifications to the working group’s “key elements” such as disclosing a minimum amount of time that consumers can expect security support for their product. The FTC noted that consumers might perceive an anticipated timeline of support as a guarantee of such support. Among the other suggested changes, the Commission recommended that manufacturers consider telling consumers upfront if a “smart” device will lose basic functionality after security support ends and if consumers would expect a similar “dumb” device to have a longer, safer lifespan.

The Commission also recommended changes to the “additional elements” section in the guidance such as considering adoption of a uniform method for notifying consumers about updates that are not made automatically and considering providing real-time notification to consumers when manufacturers stop providing security updates for IoT devices.

In providing its comments, the Commission noted that the Internet of Things can provide enormous benefits for consumers. At the same time, in its education, policy, and enforcement work, the FTC has stressed the importance of taking reasonable steps to safeguard privacy and security when it comes to IoT devices.

The Commission vote to authorize the filing of the comment was 2-0.

The Federal Trade Commission works to promote competition, and protect and educate consumers. You can learn more about consumer topics and file a consumer complaint online or by calling 1-877-FTC-HELP (382-4357). Like the FTC on Facebook, follow us on Twitter, read our blogs and subscribe to press releases for the latest FTC news and resources.