Smart City

Industrial IoT News

Industrial IoT Home

Securing Devices in California: Regulations Call for Compliance By 2020

By Cynthia S. Artin
November 07, 2018

California has become the first state in the U.S. to put cybersecurity regulations on the ever-growing Internet of Things, giving companies who produce those devices until January 1, 2020 to include specific security features.

The legislation requires security measures for any device that can connect to the internet and that has an IP or Bluetooth address, regardless of whether it processes personal information.

The law does not include a private right of action (unlike the California Consumer Privacy Act) and can only be enforced by the state attorney general, county counsel or a district attorney.

Palo Alto-based Morrison & Foerster partner Chris Lyon, who advises companies on issues related to the collection, use, sharing, and safeguarding of data, and helps them develop strategies to comply with U.S. and international privacy and data protection laws, said about the impact  “This new law sends a strong message that California expects manufacturers of IoT devices to take the lead in building data security into their products, regardless of the nature or sensitivity of data transmitted through those devices.”


California has taken “major strides toward regulating the Internet of Things, the network of internet-connected devices that includes everything from televisions and cars, to refrigerators, fitness trackers, and baby monitors,” Lyon wrote in a short article about the new law.

When Governor Jerry Brown signed Assembly Bill 1906 and Senate Bill 327 into law, “California took major strides toward regulating the Internet of Things, the network of internet-connected devices that includes everything from televisions and cars, to refrigerators, fitness trackers, and baby monitors.”

Lyon’s article, co-authored by Allison Lauterbach Dale also explained, “The legislation focuses in particular on user authentication, requiring the manufacturer of a connected device to equip the device with reasonable measures ‘appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, (and) designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.’”

The requirement is not limited to devices that collect personal information, Lyon wrote. “In fact, the legislation makes no reference to the concept of personal information. For devices ‘equipped with a means for authentication outside a local area network,’ the law provides that either of the following will be deemed a reasonable security feature: the preprogrammed password is unique to each device manufactured, or the device contains a security feature that requires a user to create a new means of authentication before access is first granted.”

“The law creates a strong incentive for manufacturers to use one of these two approved security measures, particularly because the law provides no guidance in determining what other types of security measures will be considered reasonable,” Lyon observes.

The legislation does not regulate medical devices, nor does it apply to manufacturers who are already regulated by HIPAA or California’s health privacy law. Connected devices whose functionality is subject to federal security requirements and regulations are also not subject to the new law.

The entire article, and more information about the new regulations can be found here: https://www.mofo.com/resources/publications/181001-new-california-iot-law.html




Edited by Ken Briodagh

Contributing Writer

SHARE THIS ARTICLE
Related Articles

Avnet and Octonion Working to Deliver AI and Security at the Edge

By: Ken Briodagh    11/12/2018

Success in today's Internet of Things (IoT) marketplace requires unique combinations of hardware, software and security delivered in a timely manner t…

Read More

Implementation of the IoT in Transportation: Autonomous Vehicles

By: Special Guest    11/12/2018

The age of the internet and autonomy is upon us; IoT technology is transforming the world with creative innovations in every imaginable aspect of our …

Read More

Comprion PCD Analog Test Solution Qualified for EMVCo 3.0

By: Ken Briodagh    11/12/2018

The validation of the PSM and eDRX tests on the Comprion test platform has activated two new GCF work items. The tests become part of GCF certificatio…

Read More

Ericsson, Einride and Telia Power Sustainable, Self-Driving Trucks with 5G

By: Ken Briodagh    11/8/2018

Ericsson, Telia and Einride work on sustainable transport by connecting electric, autonomous vehicles with 5G; reduction or elimination of harmful emi…

Read More

Renesas Electronics Sub-Gigahertz Wireless Solution Selected as Standard Test Bed Unit for Wi-SUN FAN

By: Ken Briodagh    11/7/2018

Wi-SUN Alliance has adopted the Renesas Electronics Corporation sub-gigahertz wireless solution as an interoperability test bed units for its FAN Cert…

Read More