MarcoPerazaFCC

Thanks for the thoughtful reply. I encourage you to file an official comment with your ideas.

Thank you for this detailed feedback. In the long-run, it's worth asking whether a business that doesn't make money once externalities have been internalized is a business worth having. But this is a voluntary program, and we're just hoping to spur growth of a segment of the device market where these issues are properly accounted for. Hopefully as more and more purchasers begin insisting on higher-standards, maybe by insisting on this label being present, economies of scale and componentization of secure IoT platforms will drive the costs of good IoT security down to the point where your concerns aren't as salient. Please consider sharing your thoughts through official comments.

It's a voluntary label, so it's open to competition from other standard-setting organizations. When it comes to mandatory regulations generally, our office thinks that broad standards that are used to hold people accountable for negligent conduct are better than detailed checkbox-compliance exercises that quickly become out-of-date red tape.

I think if the box says updates until the beginning of 2025, and they've stopped providing updates before then, you have a pretty good contract lawsuit against them. You'd have to show that their failure to issue a patch for four months constitutes a breach, but that is exactly the kind of thing that gets hashed out in lawsuits. You could even have a class action of all the owners suing the manufacturer. We think one of the great opportunities of this labeling program is to begin developing a caselaw of what it means to hold a manufacturer to the commitments on the label.

This will be a completely optional program. And the proposal is that even for participants of the program, they just have to disclose the update period, whatever it may be (could be zero-length).

This is something that has us worried too. The FCC took some action on this issue last year by outright banning equipment from certain companies (e.g. Huawei), but we haven't even scratched the surface of this pervasive problem. I really encourage you to share your concerns through an official comment. Maybe the label can include commitments about the provenance (and, e.g., control of signing keys) of the on-device software and associated cloud services?

I encourage you to file a comment suggesting this. It's actually not irrelevant. The FCC is free to decide that the label (which can include a QR code linking to more information) must include information about cameras and microphones and whether there is a software-tamper-proof way to tell whether they are on. Or the existence of a hardwired LED could even be a requirement to qualify for a label. Your experience with the OLPC project would really bolster the credibility of your comment as well, so don't forget to mention that.