Government rolls out new cybersecurity laws for smart devices
The government today unveiled new laws to help protect millions of internet-connected household devices from the threat of cyber attacks.
The measures mean all consumer smart devices sold in the UK will have to adhere to three security requirements.
Under the new legislation, all internet-connected device passwords must be unique, with users unable to reset them to any universal factory setting.
In addition, manufacturers will be obliged to provide a public point of contact for reporting security flaws and must explicitly state the minimum length of time for which they will provide security updates.
The plans, drawn up by the Department for Digital, Culture, Media and Sport, comes amid a rise in the number of connected devices, which together are known as the Internet of Things (IoT).
Research suggests there will be 75bn internet-connected devices — such as TVs, camera and home assistants — in homes around the world by the end of 2025.
“Our new law will hold firms manufacturing and selling internet-connected devices to account and stop hackers threatening people’s privacy and safety,” said digital minister Matt Warman.
“It will mean robust security standards are built in from the design stage and not bolted on as an afterthought.”
Following consultation with the National Cyber Security Centre and the business industry, the government said it aims to develop further legislation to protect consumers without harming the long-term growth of the IoT.
“Consumer IoT devices can deliver real benefits to individuals and society but Tech UK’s research shows that concerns over poor security practices act as a significant barrier to their take-up,” said Matthew Evans, director of markets at industry body Tech UK.
“We are therefore supportive of the government’s commitment to legislate for cyber security to be built into consumer IoT products from the design stage.”