Stakeholders at CES Look to FTC’s Ohlhausen for Signs of Commission’s IoT Role

Technology shouldn’t be used “to separate tech-savvy people from those who may not understand or embrace its benefits,” Ohlhausen said. “Instead, I prefer to focus on the power of technology to include people who may not otherwise have easy access to information or services, entertainment or education.” Regulation should “allow innovation, even disruptive innovation, to thrive,” she said. Ohlhausen’s comments at CES were consistent with her past speeches at an FTC workshop (WID Nov 20 p4) and at the Chamber of Commerce (WID Oct 21 p5), which promoted her vision for the commission’s IoT role.

If harms arise, “we should carefully consider whether existing laws or regulations are sufficient to address them before assuming that new rules are required,” Ohlhausen said. She stressed that consumer privacy and data security will be key issues in the area of IoT. “Because interconnected devices and services often collect and share large amounts of personal information, policymakers and members of the tech community must be sensitive to consumer privacy and data security issues,” she said. “It’s crucial that companies offering these products as part of the Internet of Things act to safeguard the privacy of users to avoid giving the technology a bad name while it’s still in its infancy.”

"In this dynamic environment, the FTC’s approach of doing policy R&D to get a good understanding of the technology, educating consumers and businesses about how to maximize its benefits and reduce its risks, and using our traditional enforcement tools to challenge any harms that do arise offers, in my opinion, the best approach,” said Ohlhausen. This approach enables “free markets and technological innovation to serve the greatest good, while still maintaining a federal role in protecting consumers and evening the playing field for competitors,” she said. FTC Chairwoman Edith Ramirez has also said the commission will closely monitor the data security practices of companies producing IoT devices. But with an FTC staff report coming on the issue, best practice guidelines expected and pending litigation (WID Nov 21 p8), stakeholders told us they are still unsure how involved the FTC will be in IoT.

Privacy and security “have to be taken seriously from the beginning,” said Jeff Hagins, chief technology officer at SmartThings, a Kickstarter-funded IoT hardware and app maker. “They can’t be an afterthought.” In an interview before the panel, Marc Rogers, principal security researcher at mobile security company Lookout, praised Ohlhausen’s hands-off emphasis, as have numerous industry representatives.

"That’s exactly the right thing to do,” Rogers told us of Ohlausen’s approach. The FTC is smartly “taking the cautious path to watch and see what’s going on and ensure companies developing connected things are given access to the information they need in order to develop the things securely,” he said. The IoT market will draw in industries like automakers, medical companies, sectors where Internet-enabled devices are not their forte, Rogers said. With Ohlhausen’s vision, these companies “will now have access to this information and encouragement from a major regulatory body on how they can bring a connected device to market,” he said.

"The reality is we don’t know where” the IoT’s going, said former FCC Commissioner Robert McDowell. “Regulators need to be very careful and allow markets to develop, not try to guess where it’s going to go because they're probably going to be wrong.” Five years from now at CES, “there will be some things that have succeeded, others that have failed, and new things that nobody who is here at this show anticipated at all,” said McDowell, a visiting fellow at the Hudson Institute. In an interview with us, Electronic Frontier Foundation Senior Staff Attorney Lee Tien pushed back against the revolutionary rhetoric surrounding IoT. “It’s the continuation of trends we've been seeing for a number of years,” he said. “The privacy and security issues it raises are are also on the same trajectory. What’s the right way to address them -- that’s the hard question."

Ohlhausen Counsels Caution

"As a regulator, you have to be humble,” said Cisco Global Technology Policy Vice President Bob Pepper, a former FCC official. “Especially in markets that are moving very quickly, technology is moving faster than regulation.” Pepper agreed with Ohlhausen: “It’s about people, not just devices. ... We need to think about building in the capabilities to give the consumer the choice and the control through transparency ... knowing what they're getting and how to control it."

Companies entering the IoT marketplace need to be cautious, Ohlhausen said. As she has before, Ohlhausen pointed to two FTC complaints that represent “the kinds of data security risks that the Internet of Things may present.” The commission filed a complaint against Internet-connected camera manufacturer TRENDnet, which the FTC alleged failed to adequately secure its cameras’ live feeds. Ohlhausen also highlighted a settled complaint against mobile app Path, which the commission alleged was collecting information from the device’s address book without user consent. “As this case suggests, the collection of personal information from a consumer’s mobile phone without disclosure or permission may be a deceptive or unfair practice under the FTC Act,” Ohlhausen said. “Prudence suggests that such technologies should include some way to notify users and obtain their permission."

The FTC “definitely can” play a large role on IoT, said Tien. “It’s sort of a question of do they want to and if they did want to what impact would they have?"

The Internet of Everything could be worth a cumulative $19 trillion by 2020, Cisco CEO John Chambers said during a CES keynote Tuesday. “This is where I get the attention of CEOs, government, business leaders.” In a decade, the Internet of Everything could have five to 10 times more impact that the Internet has had so far, he said. Retail stores alone could see a “potential return” of $1.5 trillion, he said. “It’s the ability to really put together smart shopping carts,” he said. “The ability to put Wi-Fi capability into that.” The Internet of Everything -- a Cisco marketing term for the Internet of Things -- could generate $4.6 trillion for public-sector organizations over the next decade, said a Cisco study released Wednesday at CES. Cities could save $1.9 trillion over the next decade, much of which could come from “killer apps,” said the company in a news release (http://bit.ly/1aImo3L).

Stalled Congress, Active FTC

With Congress stalled on data security legislation (WID Dec 2 p1), “setting policy by litigation may be the only impactful approach the FTC can take,” said Fletcher Heald communications lawyer Paul Feldman, who represents ISPs. “But that doesn’t necessarily make it easy for industry to know what they can and can’t do.” FTC complaints signal to companies what not to do without saying “what you can do,” Feldman said.

Observers agreed Ramirez has placed a different emphasis than Ohlhausen on the FTC’s IoT role. The FTC has always struck a balance between “promoting innovation” and “protecting consumers,” said University of Washington School of Law Assistant Professor Ryan Calo, who researches emerging technologies and the Internet. Ramirez, a Democrat, chooses to emphasize the latter, while Ohlhausen, a Republican, is “more worried about standing in the way of new ecosystem,” he said. In December, Ramirez also urged Congress to enact “baseline privacy legislation,” saying, “there are limits to what we can do” (WID Dec 4 p1).

Don’t dismiss Ohlhausen’s bully pulpit, Calo said. “Her ideas can compete not only within the institution for what should be the prevailing philosophy but also in the arena of public opinion.” Ohlhausen has supported a more targeted version federal breach notification and data security law (http://1.usa.gov/1erwdFO). “She does have a big voice and does have a voice within the institution,” said Calo.

How important that voice is, and that of the FTC’s generally, will be determined by the pending case Wyndham Hotels brought against the FTC after the commission filed a complaint that the company failed to properly protect consumer data, said Calo and Feldman. If a court sides with the FTC, it will endorse the commission’s ability to pursue companies for failing to protect consumer data, said experts including Calo. “If the chairwoman is saying ‘we intend to crack down on security,’ and the FTC wins the Wyndham case, that essentially ratifies” that action, Calo said.

IoT will even change how garbage is collected, Chambers said. “The way we do garbage collection and waste management today makes no sense whatsoever,” he said. “You pay a given price regardless of what’s picked up. ... You put sensors in the bag and you can restructure how you do garbage collection.” The cost of waste management could be reduced by as much as 30 percent, he said. The overall change “will be bigger than anything that’s ever been done in high tech,” he said.

Chambers brought on a well-known but edgy comedian for comic relief. “Hi, I'm Sarah Silverman, comedian, actor and writer, though I didn’t write this shit,” she said. “I'm here to talk to you about the new Internet of Everything. It will cook your food for you, drive your car and make you more interesting. ... And if you order it now, you will get a free set of Ginsu knives.”,