Antitrust Law Daily Wrap Up, PRIVACY NEWS: Brill discusses security challenges presented by Internet of Things at Bitkom Privacy Conference, (Sep 24, 2015)

By Michael Menzhuber, J.D., LL.M.

In her keynote address, given on today at the Bitkom Privacy Conference, in Berlin, Germany, FTC Commissioner Julie Brill discussed the presence and the growth of the “Internet of Things,” the security issues it presents, and the challenges of maintaining consumer trust.

Brill began her remarks by defining the term “Internet of Things” (IoT) as the phenomenon of connecting nearly everything to the Internet. She noted its current presence and growth by pointing to the number of networked devices now and the projected number in 2020. She pointed out that, as data becomes cheaper to collect and keep, our ability to analyze it is also improving.

In addition to its potential benefit, the IoT also presents some serious privacy and data concerns. According to Brill, the presence of more connecting devices will mean that more sensitive data is collected and, because user interfaces on these devices will shrink or disappear, it will be difficult for consumers to know when data is being connected or to exercise any control.

Brill noted that policy makers in both the United States and Europe have recognized the challenges presented by the IoT and see similar solutions. She pointed to the FTC’s Internet of Things report which noted that consumer trust may be eroded if appropriate privacy protections are not provided. She also discussed how the enactment of both baseline privacy legislation and data broker legislations would play important roles in preserving consumer trust.

Security issues presented by the IoT are, according to Brill, one of the biggest challenges to maintaining consumer trust. There is some evidence that security vulnerabilities are rampant in the IoT and the FTC is ready to use its enforcement authority to protect the personal data that will flow through the IoT.

The technical challenges of security in the IoT are also significant. Brill noted that “we are moving irreversibly toward devices and systems that are more complex and powerful, and that they will be constantly communicating with one another.” As a result, companies will need to: (1) get their devices and data systems ready to handle appropriately sensitive personal information or maintain their ability to keep consumers safe in the context in which their designers expect them to be used; and (2) make their devices and services robust enough to handle the unexpected events that will come from so many devices being connected and passing information back and forth.

Brill went on to state that as software and connections between devices become more complex, it becomes more difficult for developers to avoid introducing vulnerabilities that become exploited and more difficult to find the vulnerabilities through testing.

Brill next discussed the reason that the FTC recommends “privacy by design” and why it promotes “security by design.” She noted that companies owe their customers a reasonable effort to keep their devices and data secure and, that as an enforcement official, it is her job to take action against companies that fail to do so. She concluded by explaining that regulators, companies, researchers and other stakeholders have a larger role which is to work together to find better ways to make connected devices more secure from the beginning.

News: Privacy ConsumerProtection FederalTradeCommissionNews