Two lawmakers want to give consumers a way to know if their IoT devices are secure

A new bill introduced on Friday aims to create a voluntary cybersecurity certification program to "independently identify, verify, and label compliant Internet-of-Things devices with strong cybersecurity standards."

The internet-connected devices that broke the internet in 2016 — what kid needs a Wi-Fi connected teddy bear? — sell like mad to consumers who have little idea if any security lies below the interfaces.

One year after the Mirai botnet attacks brought some of the biggest tech companies to their knees, a new bill introduced on Friday aims to create a voluntary cybersecurity certification program to “independently identify, verify, and label compliant Internet-of-Things devices with strong cybersecurity standards.”

The bill, known as the “Cyber Shield Act,” was introduced in the Senate by Sen. Edward Markey, D-Mass., and in the House of Representatives by Rep. Ted Lieu, D-Calif.

The act would establish an advisory committee to evaluate devices like cameras, cellphones, laptops and baby monitors. Companies meeting the standards could display a label on their products that would better inform customers on security issues.

“It is critical that we prioritize developing products with the security of consumers’ information in mind,” Lieu said in a statement on Friday. “The government and tech companies share an obligation to develop more transparency around the security of our favorite devices.”

These devices, more commonly categorized as the Internet of Things, are rapidly proliferating across the world and are notoriously insecure. The companies selling Wi-Fi-enabled juicers and internet-connected children’s toys often fail to provide adequate cybersecurity, even though they’re subject to the same threats as any other internet-connected device.

With some of these connected products, cybersecurity work can be relegated to an afterthought or ignored altogether — even when the product has no need to be connected to the internet.

The Cyber Shield program’s committee would be made up of industry representatives, cybersecurity experts, public interest advocates and federal experts in certification and cybersecurity. The committee would have a website with a database of certified products. They’ll be mandated to review benchmarks at least every two years.

Markey said the bill would “help ensure consumers can reliably identify more secure products and rewards manufacturers that adopt the best cybersecurity practices.”

A similar bill that would impose security standards on Internet of Things devices purchased by the federal government was introduced earlier this year by Rep. Robin Kelly, D-Ill.

You can read the full bill below:

https://www.documentcloud.org/documents/4147483-CyberShield.html

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure