Schneier on Security

Cassandra • April 4, 2018 3:23 AM

Strict liability for the manufacturer/importer of devices for the entire lifetime of the device, unless the device can have a user-signed firmware installed by the user, in which case the liability moves to the purchaser of the device, but only when when non-original firmware is installed. Purchaser can move liability by purchasing services from a third-party to keep firmware updated, or do it themselves.

Hidden back-doors move liability back to the manufacturer/importer.

This is basic application of the principle of ‘whoever controls the actions of a device is liable for those actions’.

Most people who own their own homes or cars understand the need to maintain them. The same is true for IoT equipment, and this needs to be learned as well. There will always be scofflaws, but most engage professionals to do any necessary maintenance work, and some do it themselves, often to an exemplary standard.

One of the aspects of being a professional maintainer of something is that practitioners will (or maybe should) have professional liability insurance. In many jurisdictions, for example, your fire insurance is only valid so long as only licensed electricians have worked on your domestic electrical system, and you have the paperwork to prove it. Other jurisdictions take the view that most DIY practitioners are competent and the risk/reward calculations are that allowing people to work on their own installations is of net benefit overall (I take the latter view). The distinction between amateur and professional work is the usual test of whether you are paid to do it, so you can still help your friends and neighbours, so long as you do not get paid in ways recognised by tax administrations.

The test of whether you are making responsible use of IoT equipment would probably be along the lines of ‘not unreasonably preventing the manufacturer from pushing an update’ and ‘ensuring any updates you apply are reasonably timely, and known vulnerabilities are addressed within a reasonable period of time’. Reasonable is a weasel word often used in contracts, and lawyers and judges are well-experienced in its interpretation.

I think key things to understand about IoT security are that there is no single panacea, and that established principles of liability, contract law, and public regulation can be used to greatly improve the current situation. There is also no reason to assume that IoT security requires complex technical solutions requiring locked-down firmware – use of user-applied firmware and FLOSS need not be banned.

Cassandra