Britain's plans to force internet-connected device vendors to declare legally binding product lifespans won't be easily evaded by shell companies, the government has told The Register .

After the Product Security and Telecommunications Infrastructure (PSTI) Bill was introduced to Parliament [1]last week , some questioned whether the legislation would prevent unscrupulous manufacturers and importers from avoiding legal liability by setting up shell companies.

The proposed new law will, so government spokespeople say, make manufacturers, importers, and vendors declare what a product's supported lifespan is to consumers at the point of purchase. In effect this means anyone involved in consumer internet gadget supply chains is offering a form of product support warranty.

[2]

Government intent is to prevent suppliers of cheap IoT gadgets (and mobes 'n' fondleslabs) from dumping them on the UK market and running away without offering security updates if vulnerabilities are later discovered. Product-pwning vulns typically let malicious people turn the pwnable gadget into a botnet component, or worse.

[3]

[4]

A DCMS spokesman told us: "UK regulators are experienced in dealing with rogue traders and these new laws don't just cover distributors but also manufacturers and importers, which will lead to a reduction in the number of insecure products on the market."

Importers and disties will be legally obliged, in some circumstances, to tell their customers (who might not be end-user consumers) that a vuln has been discovered in any internet-connected gizmos they've brought into Britain, as clauses 18(3) and 18(4) of the Bill suggest

[5]PDF

.

[6]UK.gov emits draft IoT and smartphone security law for Parliamentary scrutiny

[7]The Internet of Things is a security nightmare, latest real-world analysis reveals: Unencrypted traffic, network crossover, vulnerable OSes

[8]Hard to believe but Congress just approved an IoT security law and it doesn't totally suck

[9]Research finds consumer-grade IoT devices showing up... on corporate networks

"We are also educating people on the risks of cyber crime, including through our recent CyberAware Black Friday campaign, meaning rogue traders will find it harder to sell substandard products," added the rather optimistic DCMS spokesman.

The PSTI bill will give government figures the power to order product recalls if DCMS believes a particular item breaches minimum UK security standards. Those standards will be created in legally binding regulations intended to be rubberstamped into law as a statutory instrument after the PSTI Bill itself; the bill creates the legal framework that the regulations will flesh out.

[10]

Government has claimed the as-yet-unpublished regulations will ban default admin passwords, among other things.

Some industry sources, who wanted to remain anonymous, told The Register , that if the regulations were not subject to public debate before being nodded through by Parliament, they would set a standard that was too high or costly for IoT device importers and vendors to meet.

We are told by DCMS that failing to comply with an enforcement notice issued under the PSTI bill's regulations will be enforceable against UK-based directors and officers of shell or shadow companies.

[11]

This follows the latest global regulatory trend of demanding companies have a locally incorporated subsidiary before permitting them to do business inside a country, with cynical people characterising this as [12]the taking of local hostages to ensure obedience . ®

Get our [13]Tech Resources



[1] https://www.theregister.com/2021/11/25/product_security_telecoms_bill_parliament/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YainaRxXM511MXeJBQVVHQAAAJI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YainaRxXM511MXeJBQVVHQAAAJI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YainaRxXM511MXeJBQVVHQAAAJI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://publications.parliament.uk/pa/bills/cbill/58-02/0199/210199.pdf#page=16

[6] https://www.theregister.com/2021/11/25/product_security_telecoms_bill_parliament/

[7] https://www.theregister.com/2020/03/11/internet_of_things_security_nightmare/

[8] https://www.theregister.com/2020/11/18/us_iot_security/

[9] https://www.theregister.com/2021/10/21/iot_devices_corporate_networks_security_warning/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YainaRxXM511MXeJBQVVHQAAAJI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YainaRxXM511MXeJBQVVHQAAAJI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[12] https://restofworld.org/2021/social-media-laws-twitter-facebook/

[13] https://whitepapers.theregister.com/