Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC seeks public comments on issues raised at mobility security forum, (Apr 17, 2014)
The FTC is seeking comments from the public to further explore issues raised by the agency’s June 2013 forum examining the state of mobile security. Panelists at the forum discussed a number of complex issues that warrant further public input.
The FTC’s mobile security forum consisted of a day-long series of panel discussions and presentations that addressed a wide array of security issues in the mobile arena, including current and potential future threats to user privacy and security, the role that mobile platform providers can play to mitigate mobile threats and ensure the privacy and security of end-users, the unique security challenges posed by the complexity of the mobile ecosystem and the role that telecommunications companies, third-party developers, and other members of the ecosystem can play in securing consumer products and services, and the efficacy and utility of consumer-facing mobile security products, such as authentication and antivirus products.
To expand the record on the issues, the FTC staff seeks public comment on the following topics:
Secure Platform Design:
How can platforms create robust development environments while limiting the potential for abuse by privacy-infringing or malicious third-party applications?
Have particular design approaches proven more or less effective than others in protecting consumer privacy and security?
What, if any, are the trade-offs between different approaches to providing developers with access to consumers’ personal information or device resources?
Secure Distribution Channels:
What role should platforms play in creating secure distribution channels, such as app stores, for mobile applications?
Is application review and testing scalable given the explosive growth of mobile applications? What techniques have proven effective in detecting malicious or privacy-infringing applications?
Do smaller players in the mobile ecosystem, such as third-party app stores, have the resources to deploy such techniques?
Does limiting application distribution to a single channel provide substantial security benefits? What, if any, are the trade-offs of this approach?
What are potential alternative approaches to detecting or impeding malicious or privacy-infringing applications on end-user devices?
Secure Development Practices:
What resources (e.g., application programming interfaces, development guides, testing tools, etc.) are available for third-party developers interested in secure application development?
Is the developer community taking advantage of these resources? Are they making common security mistakes?
Do consumers have the information they need to evaluate the security of an application? Are they aware of potential security risks (e.g., the insecure transmission of data)? Are there ways to make the security of applications more transparent to the end-user?
What more can platforms and other industry players do to ensure that third-party developers have the resources and incentives necessary to implement secure development practices?
Security Lifecycle and Updates:
What is the security lifecycle of a mobile device - that is, how long is a mobile device supported with respect to security? Do companies distinguish between a mobile device’s general product lifecycle and its security lifecycle? What factors - technical, policy, or business - affect the length of a mobile device’s security lifecycle?
What are consumer expectations with respect to the security lifecycle of their mobile devices? Do consumers have the appropriate information (e.g., at the time of purchase) to factor security into their device purchasing decision? Do consumers receive notice when a device has reached “end-of-life” with respect to security support?
What are the challenges in creating, testing, and distributing security updates to end-user devices? What, if any, are the implications of slow update cycles? Are there steps that platforms, manufacturers, telecommunications carriers, and other players can take to streamline this process?
Public comments may be submitted until May 30, 2014. Written comments can be mailed to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex X), 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. If you file your comment on paper, write “Mobile Security Project, Project No. P145408” both on the comment and on the envelope. Comments may also be submitted electronically by following the instructions of the web-based form.
News: Privacy FederalTradeCommissionNews