FTC wants IoT vendors to safeguard privacy

The agency recommends a set of best practices, but critics fear the FTC will enforce them as regulations

Companies developing Internet of Things (IoT) products should adopt best practices to protect the privacy and security of consumers, the U.S. Federal Trade Commission has recommended.

IoT companies should embrace best practices related to cybersecurity defense and take steps to keep unauthorized users from accessing a consumer's device or personal information, the FTC said in a 71-page report released Tuesday. IoT companies should also monitor connected devices throughout their life cycles, patch security holes, and consider ways to minimize the data the devices collect, the FTC report recommended.

The FTC report generated controversy as soon as it was released, with critics saying it could scare consumers and businesses away from the hot IT field. The report also sets up the FTC to enforce security and privacy standards on IoT companies in much the same way as it brings complaints against companies that suffer data breaches, critics said.

The FTC has brought dozens of complaints against companies for data breaches after the agency determines they didn't follow cybersecurity best practices. "The FTC already does this stuff across the board," Berin Szoka, president of free market tech think tank TechFreedom, said by email. "The FTC has increasingly tried to convert its 'recommendations' into regulations."

Republican Representatives Fred Upton of Michigan and Michael Burgess of Texas, two senior members of the House Energy and Commerce Committee, raised similar concerns.

IoT companies must protect personal information, but "we also must be certain that throughout this process we don't smother innovation that can improve the quality of life for consumers and create jobs," they said in a joint statement. "We must exercise great caution to avoid the slippery slope of the Internet of Things evolving into the Internet of Regulation."

But the FTC report called on IoT companies to take new privacy and security measures because the technology "presents a variety of potential security risks that could be exploited to harm consumers." Those risks include the compromise of personal information and the use of IoT devices to attack other systems, said the report, drawing from a November 2013 FTC workshop on IoT.

"The only way for the Internet of Things to reach its full potential for innovation is with the trust of American consumers," FTC Chairwoman Edith Ramirez said in a statement. "We believe that by adopting the best practices we've laid out, businesses will be better able to provide consumers the protections they want and allow the benefits of the Internet of Things to be fully realized."

The FTC report also called for Congress to pass new legislation, including a national data breach notification law and broad privacy protections for consumers. The agency called on IoT companies to build security into their devices up front, instead of as an afterthought, and to train employees about the importance of security.

But the agency's call for broad-based privacy legislation is an attempt to "shoehorn old ideas" onto a new technology, said Daniel Castro, director of the Center for Data Innovation at the Information Technology and Innovation Foundation, another tech-focused think tank.

"It is disheartening that the FTC staff has failed to propose a forward-looking regulatory approach to technology that narrowly targets actual harms while leaving companies free to innovate," Castro said post on the ITIF's site. "In particular, in calling for companies to reduce their use of data, the FTC misses the point that data is the driving force behind innovation in today's information economy."

The FTC report could also slow the growth of IoT, added Steve DelBianco, executive director of e-commerce think tank NetChoice. The report "risks scaring consumers and businesses away from a technology the report calls a new area of growth," DelBianco said by email. 

The Software and Information Industry Association trade group, however, applauded the report, saying it "strikes the right balance" between security and innovation. Instead of major new legislation, the FTC report "is promoting a set of best practices that guide companies to be responsible stewards of data," SIIA said in a statement.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's email address is grant_gross@idg.com.

To express your thoughts on Computerworld content, visit Computerworld's Facebook page, LinkedIn page and Twitter stream.
Windows 10 annoyances and solutions
Shop Tech Products at Amazon
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.