Why is no one raising a hand to regulate the internet of things?

The National Institute for Standards in Technology is coordinating a pair of government reports dealing with cybersecurity standards for internet-of-things devices and combatting botnets, but any eventual recommendations will be non-binding, and NIST officials said not to expect a significant federal regulatory role.

Security certification efforts underway in China and Europe as well as a significant uptick this year in the use of botnet amplification attacks has put U.S. agencies and industry in a race to set international baseline security standards for connected devices. But NIST officials on Friday emphasized the voluntary nature of the eventual results and insisted the private sector take the lead when it comes to adoption.   

A NIST draft interagency report on IoT cybersecurity standards was put out for public comment on Feb. 15, with comments due April 18. At a public meeting of the Information Security and Privacy Advisory Board (ISPAB) on March 16, NIST officials said the working group coordinating the report wanted to keep the scope narrow, focusing on core aspects of IoT security, defining what constitutes a connected device and identifying gaps in security.

Some industry associations have complained that previous attempts to legislate or regulate connected devices have failed because of overly broad definitions. The draft report defines IoT as having two main characteristics: being connected by a network providing the potential for many-to-many relationships among different components and having sensors and actuators that allow those components to interact with the physical world.

Michael Hogan, the NIST official charged with editing the draft report, said the working group initially shied away from setting parameters around what constituted a connected device, not wanting to spend half its time on the topic. However, members changed course after realizing a common definition was needed within the community. Hogan expressed hope that the standards and definition would serve as a model for industry and other areas of government.

"I'm very interested in seeing if this [definition] gets legs within agencies and elsewhere as a way to discuss IoT," Hogan said.

However, he was lukewarm when it came to the concept of mandatory certification, saying Congress could pass legislation, but that NIST would be "neutral" on the question because it was expensive and the nascent IoT market is in constant flux.

"Maybe it needs to be done, but it's not trivial," Hogan said.

Congress has had its eye on the issue but with little to show for it so far. A bipartisan Senate bill from Cory Gardner (R-Colo.) and Mark Warner (D-Va.) looks to leverage federal buying power to incentivize industry to move away from risky practices like selling unpatchable devices or shipping products with unchangeable, hard-coded passwords. So far the bill has yet to receive a committee hearing or vote.

A Government Accountability Office official told ISPAB on March 15 that the voluntary nature of the Cybersecurity Framework in the private sector made it difficult to assess how effective it has been in raising standards.

"No one could come out and articulate [what] percentage of entities in our sector are implementing the framework or this percentage of the framework," said GAO's Kush Malhotra. "A lot of what was driving that is … the voluntary nature of it, the fact that they couldn't compel entities to really report that information, so that was an inherent limitation."

Officials from NIST and the National Telecommunications and Information Association also provided an update on another draft report dealing with combatting botnets mandated through President Donald Trump's 2017 cybersecurity executive order. The final version of the report is scheduled for completion in May 2018 and -- like with the IoT cybersecurity report -- NTIA senior policy advisor Megan Doscher stressed that any resulting action or standards enforcement would be "industry led."

ISPAB's chairman, AT&T's Chris Boyer, made a case for government intervention if industry failed to pick up the torch and implement security improvements.

"I think that if the private sector doesn't step up and lead … then I think government does have a unique ability to convene industry and other stakeholders on certain issues," Boyer said.

Doscher said NTIA and NIST are looking for a third-party organization to implement standards, but acknowledged Boyer's point.

"We are hoping that an independent entity agrees to coordinate these things, and if nobody steps up, there may be a role for government there," Doscher said. "We don't want it to just sort of peter out because nobody's driving the action."