Congresswoman hopeful on IoT security legislation

Authors of draft legislation to impose security standards on Internet of Things devices purchased by the federal government are in listening mode as they gather stakeholder comments and input, a senior Democratic congresswoman said Thursday.

The authors of draft legislation to impose security standards on Internet of Things devices purchased by the federal government are in listening mode for now, a senior Democratic congresswoman said Thursday.

A discussion draft of the House version of the Internet of Things Cybersecurity Improvement Act of 2017 is out, Democratic Rep. Robin Kelly of Illinois told the Dell Technologies Digital Transformation Summit produced by FedScoop.

“We want the stakeholders at the table,” as the bill is tweaked, she told CyberScoop in a brief interview after her keynote address, referring to tech companies, security experts and business lobbyists.

“We want to get [those views] so it can be developed in a broad bipartisan way,” she said.

Kelly, who is the ranking member of the IT Subcommittee of the House Oversight panel, said the bill is intended as a companion measure to the similar bill introduced in August in the Senate.

“It tracks the Senate version quite closely,” she said, mirroring that bill’s light touch regulatory approach.

Under the bill, each agency would get to draw up its own rules within broad guidance and pre-determined categories. That “flexibility” is important, Kelly explained, “because what works for one agency won’t necessarily work for all of them.”

One difference is that the House version would establish an Emerging Technologies Advisory Board, led by government scientists from the National Institute of Standards and Technology and including representation  from the Department of Homeland Security, the National Technology and Information Administration, the General Services Administration, the Federal Communications Commission, the Federal Trade Commission “and representatives from private industry, nonprofits and academia.”

The bill is designed to leverage the government’s buying power, and emerging consensus standards to improve IoT cybersecurity.

The burgeoning IoT marketplace has created a rush to market by irresponsible manufacturers, she said.

“Unfortunately, this high-demand, lucrative market has has attracted bad actors who crank out cheap products that are insecure, unreliable and vulnerable to malware,” she said.

“We saw the consequences last year” of that with the attack on Internet routing provider Dyn, which brought the web to its knees on the East Coast.

“The proliferation of these devices [IoT] has made these attacks easier and more common,” she said.

The bill has a steep hill to climb, it appears. The sponsors of both House and Senate versions are Democrats and Republicans control Congress. Moreover, while business lobbies like the U.S. Chamber of Commerce and the Consumer Electronics Association pay voluble lip service to the need to improve IoT security, in practice they generally have objections to any efforts to do so through regulation.

The congresswoman said she was “hopeful,” nonetheless. “I couldn’t do this job if I wasn’t an optimist,” she said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure