UK intends to regulate cybersecurity of consumer IoT products

The UK government was consulting until 6 September 2020 on a proposal to regulate the cybersecurity of consumer internet of things (IoT) products sold in the UK. The aim of this initiative is to ensure that security requirements are built into such devices already at the design stage.

If the proposal is adopted, consumer IoT devices will not be allowed to be made available in the UK, unless they comply with the security requirements outlined in the proposal.

The proposal would capture any product supplied to the consumer and that has one or more network interfaces capable of receiving and/or transmitting digital data.

The government has not provided a timeline for the adoption of the proposal.

Despite the previous adoption of a code of practice for consumer IoT security, the government observes that poor security standards are still common among IoT consumer devices in the UK.

The voluntary code of practice, adopted in 2018, contained 13 principles providing manufacturers of IoT products and other stakeholders with the flexibility in developing and implementing security solutions appropriate to their products.

The proposed security obligations would make mandatory some of the principles already found in the code of practice. The proposed mandatory security obligations would require:

• passwords to be unique or user defined for all IoT consumer devices;
• device manufacturers to implement a clear and transparent disclosure policy to report vulnerabilities in the devices; and
• device manufacturers or distributors to inform consumers about the minimum length of time for which the device will receive security updates.

The code of practice for consumer IoT security identified these three requirements as the main priority as they bring the largest security benefits in the short term.

The proposal explains that more than 70% of purchases are done online nowadays, thus also distributors acting as online marketplaces or consumer sales platforms would be captured by the rules.

The devices intended to be in the scope of the regulation are:

• connected children’s toys and baby monitors;
• connected safety-relevant products such as smoke detectors and door locks;
• IoT base stations and hubs to which multiply devices connect;
• smart cameras, TVs and speakers;
• wearable health trackers;
• connected home automation and alarm systems, especially their gateways and hubs;
• connected appliances such as washing machines and fridges;