On Thursday, June 29, 2017, Sens. Hatch and Markey introduced the “Promoting Good Cyber Hygiene Act” that would direct the National Institute of Standards and Technology (NIST) to establish a set of baseline voluntary best practices for safeguarding against cyber intrusions that would be updated annually. The legislation would also direct the Department of Homeland Security (DHS) to study cyber security threats to internet-connected devices generally referred to as the “Internet of Things.” Similar legislation was introduced in the House by Reps. Eshoo and Brooks.
Looking at the first part of the Senate Bill (the NIST directive), the resulting best practices will likely look similar to the guidance currently in place for the federal government and federal government contractors. Having a standard for best practices will have significant impact on both the insurance industry and tort class action suits for breaches.
Turning to the second part of the Senate Bill (the DHS directive), while the legislation would require only a “report” at this time, the Legislature’s focus on this issue suggests that DHS’s powers may eventually expand to include regulatory authority over devices in your house or private property. Devices such as your smart refrigerator, your vacuum robot and your smart weight scale are examples of devices that comprise the “Internet of Things,” (IoT) and these devices can be and have been utilized during cyber intrusions such as denial of service attacks. Finding the right balance between personal privacy and security has always been tricky, and will continue to be so in this space. The one take away from this legislation is that device manufacturers may soon have an additional compliance layer to consider before releasing a product to the public.
Opinions and conclusions in this post are solely those of the author unless otherwise indicated. The information contained in this blog is general in nature and is not offered and cannot be considered as legal advice for any particular situation. Accessing this blog and reading its content does not create an attorney-client relationship with the author or with Miles & Stockbridge. Any federal tax advice provided in this communication is not intended or written by the author to be used, and cannot be used by the recipient, for the purpose of avoiding penalties which may be imposed on the recipient by the IRS. Please contact the author if you would like to receive written advice in a format which complies with IRS rules and may be relied upon to avoid penalties.
[View source.]
