Experts to Congress: You must act on IoT security. Congress: Encourage industry to develop best practices, you say?
Schneier crap-storm warning falls on deaf ears
Yeah whatever, expert
His arguments continued to fall on deaf ears. Chair Greg Walden (R-OR) started his comments by asking the experts how to avoid "doing something stupid like locking certain standards into statute."
Faced with all three experts saying that it was possible to encode some principles into law that would help fix the problem, Walden continued to stress he was worried about the possible impact on "innovation," and again noted many IoT products are not made in the US.
"We don't want this to be an innovation killer," he said. "I don't think I want my refrigerator talking to some food police." Which is a response just mad enough to illustrate that any action beyond talking about how terrible the problem is will never get through a Republican Congress.
When Schneier tried for a third time to argue for a new agency, Democrat Eshoo told him flat out it was never going to happen. "They're not great fans of that," she said referring to her Republican colleagues. "New agencies? New regulations? We're dead in the water."
"For every one we create, we get rid of two," said Walden, repeating one of the Republican mantras that the party gets behind, but which has also been one of the big causes of Washington deadlock for the past decade.
In the meantime, government agencies continue to fight among themselves over who should be in charge of IoT and security. So far, we have:
- The NTIA (part of the Department of Commerce) and its five working groups it created last month.
- NIST and its new Special Publication 800-160 [PDF].
- The Department of Homeland Security insisting it is the best source, despite having done literally nothing besides give a speech.
- The Federal Trade Commission.
- The Department of Transportation.
There may be others.
And that's just the government agencies. The industry consortiums are even more plentiful. Which begs the question: are we really going to wait for a total internet meltdown and the death of citizens before people get their act together? And the answer is: quite probably, yes. ®