How digital technology is shaping the future of humanity VI Barcelona Telecom Consultants day. Feb 2017 Martha Buyer presentation

1. How Digital Technology is Shaping
the Future of Humanity
An American Legal Perspective
MARTHA BUYER
MARCH 1, 2017
LAW OFFICES OF MARTHA BUYER, PLLC
WWW.MARTHABUYER.COM
1

2. 2

4. 4

5. Incredible convenience and efficiencies
create incredible vulnerabilities
 Would you want your emails read?
 What steps do you take to keep your private
information private?
5

6. Who is responsible? 6

7. Another (very!) Important Consideration
technical expertise
security expertise
7

8. In the U.S., 4 critical entities
 NTIA – U. S. Department of Commerce
 FTC – Federal Trade Commission
 FCC – Federal Communications Commission
 States
8

9. 9

10. Viviana Gonzalez AGATE
10

11. NTIA – U.S. Department of Commerce
 Not a regulator
 Multiple stakeholders process
 Continuing open standards process
 To continue to be a strong and active user of devices
to learn from the staff’s own experiences
11

12. Federal Trade Commission
 An enforcement agency
12

13. FTC (con’t)
 Same basic principles of software security apply to
IoT
 Making sure that the right people are in charge and
actively managing security issues
 Having a written plan in place
13

14. FTC (enforcement focus)
 Conducting risk assessments and addressing the
identified risks
 Oversight of service providers
A continuous process
 The “reasonableness” in enforcement, not strict
liability
14

15. Quantifiable Harm
 FTC’s pursuit of “deception” will continue
 Industry-specific statutes will continue to be used in
enforcement
 FTC will be looking at harm.
When there’s a failure of an IoT device, there can
be numerous harms
15

16. FCC 16

17. FCC
 FCC’s privacy rules, which are scheduled to take effect this
Thursday, require broadband providers (ISPs) to keep
customer information confidential.
 FCC’s vote gave consumers control, with mandated disclosure
and opt-in requirements for sensitive data, as well as data
security protections, he added.
17

18. State Law 18

19. Managing Increased Connectivity
A Legal Perspective
IoT has many new players who haven’t had to
consider security in the same way that other
information technology providers have.
19

20. 3 key challenges to managing IoT
devices
 1. Ubiquitous data collection
 2. Unexpected uses of consumer data
 3. Heightened security risk, as devices can be easily
compromised.
20

21. Two categories of devices
 Those with privacy implications
 Those without privacy implications
21

22. IoT Device Management
 Current operation
 Ongoing maintenance and support
 Knowledge about how IoT-generated
information is being shared, and with whom
22

23. One more thing…
 Sometimes the information that’s being collected
becomes its own product with its own generated
income stream.
 Whose information is it?
 Who is benefiting from its sale?
23

24. Whose Responsibility is it?
 Manufacturer
 Seller/Distributor
 Consumer
 Software patches
 Security updates
 Ongoing maintenance
 Knowledge of product life cycle
24

25. IoT = Increased Vulnerability 25

26. Every lawyer’s favorite question…
Where is the risk?
Risk in communications to and from
IoT device(s)
Risk to the integrity of the device
itself.
26

27. IoT Trivia
 Large number of IoT devices with factory default
passwords that have never been changed
 Personal devices
 Industrial devices with broad reach
27

28. Cybersecurity Considerations
1. “Mature” manufacturers of newly connected
devices may have little, if any experience in
managing the collection, security and protection
of consumer data
28

29. Cybersecurity Considerations (con’t)
2. Challenge of the manufacturer and
distributor of getting the product to
market v. getting the product to market
safely
29

30. Cybersecurity Considerations (con’t)
3. Threats and vulnerabilities are constantly
evolving. Best practices must continue to evolve
too!
30

31. Cybersecurity Considerations (the last
one)
4. There is no one single best
solution
31

32. OK…one more consideration
Security failures are more likely to occur
when security is not a consideration
throughout the concept and design
processes
32

33. Data Minimization
 The collection and retention of large amounts of data
increases the harms associated with a breach
Larger stores of data are more valuable to hackers
than are small ones
33

34.  If the company collects and retains large
amounts of data, there is a risk that the data
will be used in a way that departs from
consumers’ reasonable expectations of how
that data will be used
34

35. Pre-IoT Purchase Questions
1. Does the hardware contain built-in safeguards?
a. What authentication tools exist?
2. Is a complete testing protocol in place?
a. The keyword here is “complete.”
3. How can security practices be communicated to customers, relevant regulators
and the public?
4. How often will the system be upgraded or patched? Is there a regular schedule
35

36. Regulation
Industry should regulate itself
Regulation stifles innovation
Industry is too young to be regulated
(yet)
Industry cannot regulate itself
36

37. Key Regulatory Considerations
 Privacy
 Security
 Transparency
Notice
Consent
 Intellectual Property
37

38. Who Will Regulate? 38

39. Questions?
39

40. Thank you!
40