Consumer Connected Product Cyber

Wednesday 21st April 2021 Written Statements

[The Parliamentary Under-Secretary of State for Digital, Culture, Media and Sport (Matt Warman)]

This Government have ambitious plans to ensure that the increasingly diverse range of consumer products that can connect to the internet are more secure by having cyber-security designed into them by default.

Since 2018, the UK has been recognised by industry and the security research community as defining a world leading approach of strong cyber-security measures for connected products. My Department published a code of practice for Consumer Internet of Things (IoT) Security on 14 October 2018. Developed in collaboration with industry and cyber-security experts, this set out 13 outcome-led guidelines that manufacturers would need to implement in order to improve the cyber-security of their consumer IoT products. The UK Government have also contributed significantly to the first globally-applicable industry standard on consumer IoT Security—ETSI EN 303 645.

Our work has since been endorsed and supported by the ‘Five Eyes’—a collective statement of intent was published in 2019—as well as the Australian Government—their 2020 code of practice consists of the same 13 principles as those we published in 2018—the Governments of Singapore and Finland—whose national IoT labelling schemes reflects our work—and the Government of India—who published a draft code of practice advocating the same 13 guidelines of our 2018 code of practice.

The Government initially encouraged industry to resolve the issue of insecure consumer-connected products voluntarily. However, despite the publication of the code of practice and the development of industry standards, in many cases, poor security practices remain commonplace.

In May 2019, DCMS launched a consultation on regulatory proposals advocating a minimum baseline cyber-security requirement. There was widespread support for the UK Government seeking to regulate the security of consumer connected products. From July to September 2020, the Government ran a call for views on detailed proposals to regulate the cyber-security of these products, to ensure they are more secure for people to use.

I am pleased to inform the House that today we are publishing a Government response to this call for views. We summarise the feedback received in response to the call for views as well as set out the Government’s response to that feedback, and provide an overview of our updated policy intentions for regulation in this space.

In line with the intentions detailed in the document published today, we will introduce legislation as parliamentary time allows to protect consumers from insecure connected products. This regulation will apply to all consumer connected products such as smart speakers, smart televisions, connected doorbells, connected toys and smartphones, with some specific exemptions due to the specific circumstances of how certain devices are constructed, secured, and regulated, or the impact that regulating these products would have. The security requirements that will be mandated will align with the UK code of practice, and international standards, so are familiar to all manufacturers and other relevant parties across industry. The legislation will also provide powers to investigate allegations of non-compliance and to take steps to ensure compliance.

As a reserved matter, these proposed amendments will apply across the UK. The security of consumer smart products is a priority across the whole of the UK, and my officials will continue to work closely with the devolved Administrations on this policy.

[HCWS934]