Washington, D.C. – The Federal Communications Commission (FCC) today voted unanimously in favor of the implementation of a voluntary U.S. cybersecurity labeling program for consumers’ internet-connected devices.
The program would allow manufacturers to place a U.S. Trust Mark on their Internet of Things (IoT) products. To get this mark, manufacturers would have to undergo third-party testing that assesses the security features of their products.
The nonprofit Consumer Reports is a leading advocate for the creation of a robust cybersecurity label. Last year, CR took part in the White House briefing for the official launch of the labeling system. The organization filed comments with the FCC to recommend ways to design the label in order to raise the bar for cybersecurity, help inform consumers, and help protect people from cyber attacks.
The FCC-created labeling program will include the trust mark and a QR code on the packaging of any participating consumer device that meets the FCC’s testing standards. Consumers can scan the QR code on the package to find out additional security information about the product, such as whether it uses a default password and how long the product will get security updates.
Justin Brookman, director of technology policy for Consumer Reports said, “This is a step in the right direction for greater security and transparency. Consumers are bringing new internet-connected devices into their homes everyday without any sort of indication of whether or not the product is secure.
“Labels in other industries have pushed companies to improve the quality of their products, and we hope today’s action will do the same in the connected device space.
“While we’re excited about today’s vote, more work remains. In the future, we’d like to see the FCC include privacy as another element of this label, and more robust security elements are needed,” Brookman said.
Specifically, CR is asking the FCC to consider adding more requirements around encryption, vulnerability reporting, and disclosures about privacy practices, such as the types of sensors on a connected device and what kind of data they collect.
Contact: cyrus.rassool@consumer.org