Ministers consider proposals aiming to help consumers identify which products are more and which are less secure.
Smart TVs and other internet-connected household devices will be made to carry labels setting out how secure they are, under proposals being put forward by the government.
Ministers want the labels introduced on a voluntary basis at first, but propose that they are eventually made mandatory. The labels would help consumers identify which products are more and which are less secure.
Under the plans, announced by the digital minister Margot James on Wednesday, retailers would only be able to sell products that carried the label, which would indicate to consumers whether the device conforms to the principal three security standards set out by the government in a longer code of practice in February.
The move is designed to tackle the problems posed by insecure connected household devices, such as TVs, thermostats and doorbells and locks, which can be hijacked by malicious actors. There have also been warnings that governments could use them to spy on people in their homes.
Guardian Today: the headlines, the analysis, the debate - sent direct to you
James said: “Many consumer products that are connected to the internet are often found to be insecure, putting consumers’ privacy and security at risk. Our code of practice was the first step towards making sure that products have safety features built in from the design stage and not bolted on as an afterthought.
“These new proposals will help to improve the safety of internet-connected devices and is another milestone in our bid to be a global leader in online safety.”
Prof Alan Woodward, a cybersecurity expert at the University of Surrey, said the proposals represented a good start, but added: “The problem is what happens to those who don’t follow the guidelines. Or, more importantly, who is going to check that a device does follow whatever the eventual guidelines are.”
He likened the plan to the existing CE mark, saying: “Of course, people can fake those. It happens at the moment and so trading standards have to chase down those who are, effectively, making false claims.”
Woodward said the government would need to “put some teeth behind whatever standards they set out,” suggesting a watchdog along the lines of the Information Commissioner’s Office.
The scheme will form part of a wider government consultation into improving general cybersecurity in the UK, with three key requirements in a code of practice for device manufacturers.
The requirements include ensuring passwords on internet of things devices are not resettable to a universal factory setting, and ensuring they provide a public point of contact as part of a policy for disclosing any discovered vulnerabilities.
It also calls for device makers to explicitly state the minimum length of time a device will receive security updates.
Dr Ian Levy, the technical director at the National Cyber Security Centre, said the latest step to target connected devices is crucial to reduce failings in the industry. “Serious security problems in consumer IoT devices, such as preset unchangeable passwords, continue to be discovered and it’s unacceptable that these are not being fixed by manufacturers.”
Ministers also set out alternative proposals to make the sale of any device that does not conform to the three standards illegal, without the need for a label system.
Source: The Guardian