Policy background Part 1: Product Security
Consumer connectable products are consumer products that can connect to the internet or other networks, and can transmit and receive digital data. Examples of these products include smartphones, smart TVs, smart speakers, connected baby monitors and connected alarm systems. They are also known as consumer "Internet of Things" devices ("IoT") or consumer "smart" devices. In 2020, there were an estimated 12.9 billion consumer connectable products worldwide.
	As electrical products, they are subject to product safety regulation including the Consumer Protection Act 1987 and the General Product Safety Regulations 2005. To ensure these products do not create radio interference, many of them are also subject to the Radio Equipment Regulations 2017 (SI 2017/1206). The existing regimes, however, do not create minimum security requirements.
	Insecure products can be used in ways not intended by the consumer, such as the case of security cameras being compromised in Singapore. In addition, insecure products can act as the "point of entry" across a network, enabling attackers to access valuable information, such as the attackers who were able to access a US casino’s customers’ details via a connected thermometer in a fishtank.
	Devices can be compromised at scale as part of DDoS or "botnet" attacks. For example, in 2016, cyber criminals compromised 300,000 products with the Mirai malware. The attackers utilised the collective computing power to successfully disrupt the service of many news and media websites including the BBC and Netflix. The Mirai malware was able to penetrate so many devices due to widespread weak security features (such as default passwords).
	In 2017 and 2018, a range of vulnerabilities were identified in the web service that connected to a smart watch brand that is marketed at children. The vulnerabilities allowed an attacker to access personally identifiable information including the linked mobile phone number and GPS coordinates for each watch.
	UK consumers are rarely able to make security conscious choices at the point of purchase due to a lack of information and so cannot easily protect themselves from cyber threats. A 2020 UCL study surveyed 270 common consumer connectable products and found that consumers were not given clear information outlining how long their connectable product would be supported with security software updates. Without clear information, consumers overwhelmingly assume that a product is secure because it is for sale, so vulnerable devices see continued use in homes where the consumer has no idea that the product represents a risk.
	In response to growing concerns about the vulnerability of baby monitors and domestic CCTV cameras to hacking, the National Cyber Security Centre issued a warning and guidance for consumers to adjust the security settings of products they purchase.
	The Government committed to ensuring that "the majority of online products and services coming into use become "secure by default" by 2021" in its 2016 National Cyber Security Strategy. In March 2018, the Government consulted on its Secure by Design Report and this was followed with the publication of the voluntary Code of Practice for Consumer IoT Security in October 2018, which recognised the ever growing number and types of consumer connectable products. The code shifted the approach to securing devices by moving the burden away from consumers and instead used policy to encourage security features to be built into products at the design stage.
	The Government sought to find an international consensus on how to better secure consumer connectable products. Following a partnership with both countries, Australia’s Department of Home Affairs (2020) and India’s Department for Telecommunications (2021) have both published Codes of Practice that are consistent with the 13 principles that the UK first published in 2018.
	The Government has also worked with the European Telecommunications Standards Institute ("ETSI") to create a new globally applicable standard ETSI EN 303 645: Cyber Security for Consumer Internet of Things: Baseline Requirements, which is consistent with the 13 principles of the UK’s Code of Practice. ETSI has over 900 members from 65 countries. Adopted in June 2020, ETSI EN 303 645 is the first globally-applicable technical standard for the cyber security of consumer connectable products.
	While the Government encouraged industry to adopt the guidelines in the UK’s Code of Practice for Consumer IoT Security, voluntary compliance was slow, and poor security practices remain commonplace. At the time of its publication in 2018, the Internet of Things Security Foundation estimated that 9 per cent of manufacturers maintained an adequate vulnerability disclosure programme. By 2019, the figure was still only 13 per cent.
	In May 2019, the Government launched a consultation on legislative proposals for the cyber security of consumer connectable products. Responses to the consultation demonstrated widespread support for the introduction of a mandatory cyber security baseline aligned with priority security requirements as outlined in the Code of Practice.
	The Government published detailed proposals for regulating the cyber security of consumer connectable products as part of a Call for Views in July 2020. Responses to this Call for Views further supported the Government’s position, that widespread compliance to priority security requirements from ETSI EN 303 645 will have the greatest impact in protecting UK consumers purchasing connectable products.
	The Act creates powers for ministers to specify security requirements relating to consumer connectable products. Businesses involved in making these products available to UK customers will need to comply with these requirements. The Government intends to use these powers to place requirements based on three of the original guidelines in the 2018 Code of Practice, and provisions in ETSI EN 303 645, on a statutory footing. These new statutory security obligations will include a ban on the use of universal default passwords and easily guessable default passwords, a requirement for manufacturers to enable the reporting of security vulnerabilities, and a requirement for manufacturers to make publicly available the minimum period of time that the product will receive security updates.