Bruce Schneier Calls for IoT Legislation, Argues The Internet Is Becoming One Giant Robot (linux.com)

"We're building a world-size robot, and we don't even realize it," security expert Bruce Schneier warned the Open Source Leadership Summit. As mobile computing and always-on devices combine with the various network-connected sensors, actuators, and cloud-based AI processing, "We are building an internet that senses, thinks, and acts." An anonymous reader quotes Linux.com: You can think of it, he says, as an Internet that affects the world in a direct physical manner. This means Internet security becomes everything security. And, as the Internet physically affects our world, the threats become greater. "It's the same computers, it could be the same operating systems, the same apps, the same vulnerability, but there's a fundamental difference between when your spreadsheet crashes, and you lose your data, and when your car crashes and you lose your life," Schneier said...

"I have 20 IoT-security best-practices documents from various organizations. But the primary barriers here are economic; these low-cost devices just don't have the dedicated security teams and patching/upgrade paths that our phones and computers do. This is why we also need regulation to force IoT companies to take security seriously from the beginning. I know regulation is a dirty word in our industry, but when people start dying, governments will take action. I see it as a choice not between government regulation and no government regulation, but between smart government regulation and stupid government regulation."

Comments

Bruce Schneier ...

[Anonymous Coward]

... is an idiot in this instance when it comes to calling for legislation for IoT. The whole problem is humanity did not evolve to make rational decisions in a high tech free market society, no amount of legislation is going to overcome human's old meaty brain. Just like banks got bailouts because they own the government, any legislative body in america will quickly succumb to regulatory capture making the whole thing worthless. Not only that the internet is planet wide, you need co-operation with foreign governments and human beings have problems enough dealing with global warming. The whole regulatory system in america is a clusterfuck especially with trump, is he really expecting trump and his administration to make sound policy? I wouldn't trust trump with my toaster.

Let's just admit, humanity generally at this point in history has accelerated its development before its old monkey brain is able to catch up. Human beings are not evolving as fast as they are developing technology which is the fundamental issue. Human's lack of intelligence, maturity and foresight can't be overcome by adding more burdensome rules especially given the political "don't tread on me" culture of the american people.

Economics

[Anonymous Coward]

>But the primary barriers here are economic; these low-cost devices just don't have the dedicated security teams and patching/upgrade paths that our phones and computers do. This is why we also need regulation to force IoT companies to take security seriously from the beginning.

I highly doubt regulation will cause many iot companies to take security seriously, unless it has some teeth. And then regulation becomes a barrier to entry for smaller companies, so there would be fewer IoT sellers, and maybe that's a good thing according to Schneier.

Professionalize computer science

[VikingNation]

Many engineers who design bridges, roads, buildings, power systems, etc. are required to get a proefessional engineering certificate. There is no equivalent for computer scientist in the United States. Until there is liability for poor designs and implementation there will be changes to improve quality and security.

Re:Professionalize computer science

[bill_mcgonigle]

Until there is liability for poor designs and implementation there will be changes to improve quality and security.

Show me the equations that show if a bridge will hold up. Fine, those are well-known.

Now show me the equations that prove that a computer system is secure, for a non-trivial algorithm, so that a Computer Science "Engineer" can place his professional stamp on one. And remember, nobody will buy Windows that takes thirty years to get out the door at six-thousand bucks a copy.

Really, though, do you even CS, bro? Besides the software-provability problem, a bridge engineer is not responsible for any shoddy work that is hidden from him by a lackluster construction crew (and no, inspections are not fool-proof if there is professional malpractice occurring).

You can't simply make a comparison between a static and a dynamic system and declare equivalene. That's as silly as Schnier thinking that regulators will save us from ourselves. He should look into real insurance, strict liability, and/or marketable torts if he wants a system that can actually provide better results.

Easy fix

[Rosco P. Coltrane]

Don't buy IoT devices. Problem solved.

Everybody knows they offer marginally beneficial services to the user, and massive surveillance and privacy invasion opportunities for big data, unconstitutional government agencies and other sumbitches.

Re:Easy fix

[Anonymous Coward]

I don't think that 'everybody' knows this. Most people will buy whatever they see that is attractively packaged on the front page of Amazon or on the shelves at Home Depot, Target, Best Buy, Office Max or the like.

Re: Easy fix

[Anonymous Coward]

That can be done now. Give it a few years, you won't be able to buy anything that is not made to be connected. Peer pressure, obsolescence and convenient buyback programs will take care of the reticent. It's a done deal.

It is not one giant robot!

[Entrope]

Schneier gives kind of a "shouting at clouds" vibe. The Internet is not like a truck you load things into or off of, it's not a series of tubes, it's not one giant robot that will turn into Skynet once it achieves sentience.

Internet Green is people! Wait, still the wrong movie, but closer.

The Internet is made up of billions of devices, each with different capabilities, each with their own purpose and "goals", influenced by others in its social network. Some of these influencers are nearby, some are far away; some are humans, some are machines. Some of these machines are robust against malicious interference, but most have weak points.

The Internet does not look or act like a single robot. It looks and acts like a network or society, not a monolithic entity, and talking about it as a monolithic thing encourages unwise reactions.

IOT's Creators Are Clueless - Totally Clueless

[dryriver]

I had a 2 hour conversation last year with an IOT devices engineer who works for a multi-billion dollar Japanese Corporation. They guy didn't think Privacy was important or at risk at all through IOT devices. "Every home will have many of them soon" he said. He thought that realtime 3D face recognition - CCTV networks being able to identify you ANYWHERE IN PUBLIC with great accuracy even if you are not facing the camera, have grown a beard or are wearing a baseball cap - was a great step forward in human technological development. They guy kept talking about "new markets, new profits, a great future for our company". He literally DID NOT CARE what these technologies mean for people's Privacy. Every time I voiced even mild concerns about what these surveillance capable technologies might do to people's privacy, he acted terribly *shocked*. Apparently the corporation he works sees great profits in building IOT, face recog tech & other surveillance capable tech, and my bringing up concerns about them was something he was - wait for it - "uncomfortable with". =) This is what IOT is - faceless, nameless engineers crapping all over other people's lives because the companies that employ them expect a new XX Billion Dollar a year market from them.