Cybersecurity Policy Report, Commenters Debate IoT Cybersecurity Labeling, (Oct 10, 2023)

By Jeff Williams

The FCC’s notice of proposed rulemaking on establishing a voluntary cybersecurity labeling program for Internet of things (IoT) devices has attracted numerous comments generally supporting the effort, with many arguing the program should be voluntary and agreeing that it should be based on criteria developed by the National Institute of Standards and Technology (NIST).

The FCC unanimously adopted the NPRM in PS docket 23-239 in August and proposed that qualifying products would bear a U.S Cyber Trust Mark (CPR, Aug. 10).

NCTA said the FCC should, among other things, use NIST-developed criteria, along with “collaboration with industry experts” to establish the labeling program and institute a “rigorous process” for testing and evaluating the cybersecurity capabilities of IoT devices.

The program should first be applied to devices, with the FCC considering “over time” if it should be extended to include products or components, such as mobile applications and gateways, the group said.

“Such an approach is more likely to yield the Program’s intended security benefits and avoid the risk of the Commission getting bogged down in navigating real-world technological complexities that could impair the Program’s rollout and subsequent implementation,” NCTA said.

CTIA urged the FCC to proceed with “caution” regarding the “complex” task of establishing a labeling program, which the group said should be voluntary and “[l]everage the existing work of cybersecurity stakeholders, and defer to NIST on all technical matters.”

The group also recommended the Commission subject all labeling and “consumer-facing materials” to “robust pre- and post-market testing,” exclude “general purpose computing equipment” from any labeling requirements, and provide legal safe harbors for manufacturers.

USTelecom said the FCC should, among other things, make the program voluntary and exclude consumer routers from the labeling program, citing the Commission’s intention to establish a separate Cyber Trust Mark for those devices.

The group also said it supported excluding from eligibility to receive the IoT Cyber Trust Mark any IoT devices manufactured by companies on the “covered list” of equipment and services deemed to pose an unacceptable security risk to the U.S.

NTCA questioned whether the FCC had clear authority to establish an IoT labeling system and urged the Commission against implementing a voluntary program that could later turn into “de facto obligations” by being incorporated into other regulatory requirements.

“An industry-led, voluntary standard to assist consumers that draws upon industry consensus and can respond rapidly to evolving technology is preferable to government-mandated guidelines,” NTCA said. “But these standards must remain voluntary and should not be attached to regulatory programs or other obligations.”

The Consumer Technology Association (CTA) suggested a combination of the FCC basing eligibility for the Cyber Trust Mark on the NIST-developed criteria and leveraging the “unique expertise and existing certification infrastructure” of various organizations would spur “strong support and widespread participation” in the program.

“To the maximum extent possible, the U.S. Cyber Trust Mark should maintain a common baseline across IoT products, and NIST should remain the central hub for developing and maintaining the IoT labeling criteria,” CTA said.

Among its recommendations, CTA said the FCC should not modify NIST’s definition of IoT devices to include devices like routers, computers, and smartphones and should initially focus the program on devices rather than other products and services.

TechNet urged the FCC to “align technical security criteria” for the Cyber Trust Mark program with NIST’s “longstanding formal effort" to develop “baseline” guidance for IoT cybersecurity.

“Such clarity will build on years of technical discourse between cybersecurity experts from industry, academia, and NIST, pursuant to statutory direction from Congress and Executive Orders from two Presidents,” TechNet said.

TechNet also said the FCC should “incentivize widespread participation" in the labeling program by clarifying that “any IoT device that earns a Cyber Trust Mark label should be granted a ‘safe harbor’ against federal and state enforcement actions and private civil litigation for alleged damages resulting from a cyber incident.”

The National Association of Manufacturers (NAM) argued that it was “critical” that participation in any IoT labeling program be voluntary, that industry input about "flexible” requirements and processes be considered, and that “participants benefit from robust liability protections.”

The safe harbor should protect manufacturers “who have taken good faith steps to secure” their products, adding that breaches of third-party software used by devices should not be treated as a violation of the program by the manufacturer, NAM said.

The FCC also should provide education and resources to consumers about how to protect themselves from cybersecurity threats, the group added.

The Telecommunications Industry Association (TIA) said it supported the FCC taking the “appropriate steps to ensure that any cyber label for IoT remains voluntary and fits modern day labeling criteria, such as being machine readable.”

The group also contended the FCC should rely on existing industry groups to manage the labeling program, rather than a government agency.

The Connectivity Standards Alliance suggested the labeling regime be “strong/broad enough to meet the challenges of IoT security,” while also being “flexible enough to continue to promote innovation and consumer adoption."

Moreover, the labeling standards should be “updated regularly to meet the needs of a changing security landscape” and “[e]mphasize a strong focus on transparency to further educate consumers around their purchasing decision when it comes to security,” the group said.

The Wi-Fi Alliance said the FCC “can and should take advantage of the work of industry groups, like Wi-Fi Alliance, in the implementation of the proposed IoT Cybersecurity Labeling Program and empower those groups to develop cybersecurity standards and performance tests that will ensure products bearing the Commission’s IoT Cybersecurity Label are secure.”

The Alliance for Automotive Innovation suggested, among other things, that products already subject to other cybersecurity regulations be exempt from the proposed IoT cybersecurity labeling program.

The National Electrical Manufacturers Association (NEMA) said the IoT labeling program should not “undermine existing and internationally recognized cybersecurity standards which companies may have already integrated into their information technology and operational technology (‘OT’) systems and products.”

The ioXt Alliance was among those supporting using the NIST-developed labeling standards, as well as making participation in the labeling program voluntary and providing “clear and concrete guidance” regarding the products eligible to participate.

The Information Technology Industry Council (ITI) said the FCC should focus the labeling program on IoT products rather than devices and suggested “expansively labeling all devices or components in an IoT product is unnecessary and would create confusion with consumers who may not fully understand the label does not apply to the entire physical product.”

The National Retail Federation (NRF) said any participation by retailers in a consumer education campaign regarding IoT labeling “should not be viewed as a stepping stone to holding retailers liable for the cybersecurity of the products they sell—these responsibilities and liabilities should appropriately remain with the companies that develop and produce IoT devices and services.”

The U.S. Chamber of Commerce called for the FCC to preempt state IoT cybersecurity laws to “provide national uniformity and align duplicative and often conflicting compliance burdens.”

The Power Tool Institute (PTI) suggestions included that the IoT label be a QR code placed on packaging of an IoT device that would direct users to a manufacturer’s website.

Doing so would “help facilitate keeping information live and current,” PTI said.

Plumbing Manufacturers International (PMI) joined others in advocating for keeping the labeling program voluntary and providing “strong safe harbor provisions” to protect companies participating in the program from liability.

Consumer Reports was among those that argued the labeling program should apply to devices and products, including applications and networking between an application and device.

In addition, to be eligible for the mark, the FCC should require device makers to commit to updating their devices using over-the-air updates for a “set number of years,” as well as “securely encrypt data at rest on the device and in the cloud, and in motion when traversing local and public networks,” Consumer Reports said.

Internet Safety Labs (ISL) recommended the labels include information about how personal data is encrypted by IoT devices and that use of labels be made mandatory over time.

Garmin International, Inc., called implementing the labeling program an “exceedingly complex endeavor” that would “require exceptionally careful collaboration and coordination, ideally with individual manufacturers as well as a number of different government and industry stakeholders.”

The FCC must establish “clear” criteria for which IoT devices are eligible to participate in the labeling program, establish a “pragmatic process” for establishing and managing the testing and evaluation of covered devices, and select "qualifying technical standards that enable manufacturers to efficiently assess the adequacy of cybersecurity measures implemented in the IoT device, which may be subject to separate cybersecurity-related assessments by other government agencies.”

LG Electronics USA, Inc., said it supported the FCC’s proposal to initially limit the labeling program to IoT devices.

“The alternative—a broader, 'product'-based approach—would require device manufacturers to attest to the security of product components that are outside of their control,” LG said. “Requiring manufacturers to accept responsibility for the security of an entire ecosystem, much of which will be outside of their control, will disincentivize participation.”

The FCC also should allow self-testing and self-certification for those participating in the program, the company said.

Samsung Electronics America, Inc., called for the labeling program to rely on “industry-led standards that are developed in an open and transparent process,” with NIST leading the collaboration between industry and government.

In addition, it said, the FCC should "clearly communicate what the Mark does and does not signify, so that consumers can be informed, for example, that meeting baseline capabilities does not guarantee 100% security against all possible cyber attacks.”

The company also was among those urging the FCC to apply the labeling criteria only to IoT devices.

Comcast Corp. joined those commenters offering support for the FCC’s proposal that the IoT labels be based on the NIST criteria and informed by input from industry players.

In addition, the FCC should ensure consumers understand the labeling system in a way that informs them without “providing too much information” in a way that “potentially hampers the effectiveness” of the program.

Somos, Inc., said the Commission’s definition of devices and products covered by the labeling program’s definition “should include not only RF emitting and internet connected devices and products, but also those which can communicate to intermediate devices with internet connectivity either via wired or wireless means, such as USB connected peripheral drives and connected cameras (which come in both wired and wireless forms).”

The company was also among those arguing in favor of the FCC using NIST’s labeling criteria and suggested that any registry of covered products and devices include “relevant operational information” about those cataloged.

News: FederalLegislation DataSecurity