House passes SMART IoT Act

The House passed the SMART IoT Act on Nov. 28 in a unanimous voice vote, sending the bill  to the Senate with just over two weeks until Congress is set to adjourn.

The legislation, introduced by Rep. Robert Latta (R-Ohio), tasks the Department of Commerce with studying the current internet-of-things industry in the United States. The research would look into what companies develop IoT technology, what federal agencies have jurisdiction in overseeing this industry and what regulations have already been developed.

The congressman outlined the motivations behind the bill in Nov. 28 remarks from the House floor: "We must equip ourselves and industry with information about what the landscape for federal, public, private, and self-regulatory efforts are in place or underway."

Latta's comments did not touch on security concerns surrounding IoT technology.

"This is not a piece of legislation that is directly regulating the technology; instead, we're seeing Congress calling for a growing awareness in the agencies of what’s going on," said Jennifer Skees, research fellow at the Mercatus Center at George Mason University. "In part, it almost seems like an effort to prevent agency overlap."

Latta touched on that topic in his floor remarks, saying that overlapping regulations at multiple agencies would place an unjust burden on technology companies.

Joshua New, a senior policy analyst at the Center for Data Innovation, called the bill "a welcome piece of legislation" that could "advance our understanding … as the public and private sectors increasingly work to make their products and processes 'smart' through the use of connected devices and the data they generate."

New told FCW via email that an important addition to the passage of the SMART IoT Act would be a national IoT strategy, which the House showed interest in when it passed legislation outlining that idea in 2016. Congress has not done much to further this idea since then, he noted.

"Hopefully, the SMART IoT Act will be the push Congress needs to move forward with developing a national IoT strategy," he said.

The bill -- which has 18 cosponsors, including 13 Republicans and five Democrats -- defines IoT technology as devices that connect to the internet "either directly or indirectly through a network," can communicate to an individual and have a computer that can handle data. This is similar to the definitions found in other legislation, including the IoT Cybersecurity Improvement Act of 2017, which sets procurement rules the federal government must follow when buying IoT technology.

However, some experts think the definition for IoT should be narrowed because the current language can easily cover a number of other technologies from laptops to smartphones.

"Having such a broad definition for IoT can be problematic," New said in an interview earlier this year while speaking about the IoT Cybersecurity Improvement Act.

Trevor Rudolph, the vice president for global digital policy at Schneider Electric and former chief of cyber and national security at the Office of Management and Budget, said that ongoing work from the National Institute of Standards and Technology will be important to defining the space.

"There is still no clear federally accepted definition of what an IoT device means," Rudolph said last month, also referring to the IoT Cybersecurity Improvement Act. "So … I think federal legislation is probably premature, and what we should be spending more time on is a NIST coordinated activity or set of activities to define the universe."

Bills involving IoT have not found much success in Congress. Skees said this is a trend that is affecting technology legislation in general, forcing agencies to largely shoulder the responsibility of oversight. She pointed to the Department of Commerce considering export controls for emerging technology and the Department of Transportation working to create guidance on automated and connected vehicles.

"Unfortunately, or fortunately, depending on your point of view, when it comes to technology, we've seen this kind of congressional lack of action," Skees said.