The FISMA Focus IPD

California, the state that so often seems to strive to dictate policy for the whole country, is now considering a bill that would use reasonable-sounding goals to impose a heavy burden on connected product makers and sellers around the country. A state senator has proposed a bill to require the manufacturers of connected products to implement security measures and provide specific notices to consumers about information collection practices, among other objectives. The sponsor introduced the bill, S.B. 327, on February 13, 2017, styling it the “Teddy Bear and Toaster Act.”

The bill itself is fairly simple, with only three sections. However, the requirements apply broadly to all connected products, meaning “any device, sensor, or other physical object that is capable of connecting to the Internet, directly or indirectly, or to another connected device.” This language is so broad that it would apply to any device that is capable of connecting to the internet or to another device, including computers, toys, appliances, cell phones, and professional equipment. Even products such as Ethernet and USB cables potentially would be included, since they are, strictly speaking, “physical objects” that can connect to the internet or other connected devices and transmit information.