On Tuesday, the Biden administration will announce its intention to create a “trust mark” label for internet and Bluetooth-enabled devices and appliances that meet federal cybersecurity standards.
The goal is for consumers to be able to trust that their devices, ranging from baby monitors to smart refrigerators, are certified by the government as less susceptible to security and privacy vulnerabilities.
“There are so many devices in our homes -- from smart TVs and smart speakers to home security systems, routers, fitness trackers, baby monitors and more -- that are now connected to the internet,” Federal Communications Commission Chairwoman Jessica Rosenworcel said on a press call previewing the program on Monday. “They can make our lives a whole lot easier. But this interconnection can also bring new security risks.”
“This system is really similar to something that was done a few decades ago, known as the Energy Star program, which was designed to create a market that consumers would get familiar with to promote energy efficiency, but this instead would be a government backed symbol for cybersecurity,” Rosenworcel added.
The label will begin being applied to devices in late 2024 and major retailers have already signed on to the voluntary program, including Amazon, Best Buy, Google, Samsung and Logitech, a senior administration official said.
“We now routinely rely on internet and Bluetooth-enabled devices for tasks as basic as adjusting our thermostat and as complex as securing our homes while we're away,” said Anne Neuberger, Biden’s deputy national security advisor for cyber and emerging technology. “Insecure products can enable attackers to gain a foothold in American homes and offices and steal data or cause disruption.”
“As you shop online and in stores, you'll be able to look for the cyber trust mark’s distinct shield, providing you the peace of mind that the devices you're buying and bringing into your homes or classrooms, your workplace are safer and less vulnerable to cyber attacks,” Neuberger added.
A QR code will be included on the label to allow consumers to stay up-to-date with any development in the product’s certification or evolutions in cybersecurity threats that could impact the device’s use and safety.
The FCC is considering recertifications every 1-2 years, but that won’t be decided until the commission’s rulemaking process plays out over the next year, a senior FCC official said.
To earn the 'trust mark,' companies will have to meet the standards laid out by the government and be subjected to a certification process, according to a senior administration official. New and existing products are eligible for the label, as long as they check all the required boxes.
The standards were based on a publication released last year by the National Institute of Standards and Technology, a division of the U.S. Department of Commerce. They include having secure communications with the cloud and other devices, the ability to detect cyber incidents, secure delivery of software updates, data protection systems and other cybersecurity safeguards.
“We want to make everyone's home a little more safe and a little more secure,” a senior FCC official said.