Adaptive governance for the Internet of Things: Coping with emerging security risks

Abstract

The Internet of Things (IoT) is a disruptive innovation known for its socio-economic potential, but also for generating unprecedented vulnerabilities and threats. As a dynamic sociotechnical system, the IoT comprises well-known cybersecurity risks and endemic uncertainties that arise as IoT adoption increases and the system evolves. We highlight the impact of these challenges by analyzing how insecure IoT devices pose threats to both consumer protection and the Internet's infrastructure. While recent regulatory responses are starting to target IoT security risks, crucial deficienciesespecially related to the feedback necessary to keep pace with emerging risks and uncertaintiesmust be addressed. We propose a model of adaptive regulatory governance that integrates the benefits of centralized risk regulatory frameworks with the operational knowledge and mitigation mechanisms developed by epistemic communities that manage day-to-day Internet security. Rather than focusing on the choice of regulatory instruments, this model builds on the "planned adaptive regulation" literature to highlight the need to systematically plan for a knowledge-sharing interface in regulatory governance design for disruptive technologies, facilitating the feedback necessary to address evolving IoT security risks.

Assessing the regulatory challenges of emerging disruptive technologies

“…This has not always been the case, however, as some of the earliest works on regulation did adopt a temporal perspective which can be usefully deployed to examine the case of disruptive technologies. In his pathbreaking 1955 work, Regulating Business by Independent Commission, for example, Marver Bernstein noted the significance of time in the process of regulatory development and suggested that regulatory agencies tend to follow a set pattern of evolution or lifecycle, one which roughly parallels a human life (Bernstein 1955).…”

“…In advancing these arguments, this introductory article brings together two disparate bodies of scholarship: Bernstein's (1955) life-cycle analogy of regulatory development and the "new" design orientation in the contemporary policy sciences to highlight the specific nature of the different kinds of tools that can be used to address contemporary policy challenges. It argues the regulatory challenge facing disruptive technologies centers on how to develop a portfolio of substantive and procedural tools in an asynchronous fashion initially; correcting past problems while developing anticipatory capacities through the early stages of the regulatory life cycle.…”

Governance landscapes for emerging technologies: The case of cryptocurrencies

“…Coalitions determine the outcomes of the policy process; the actors and their individual attributes determine the coalitions. Brass and Sowell (2021), also in contributing to this issue, examine competing and collaborating actors through an "epistemic communities" perspective.…”

Uncertainty, institutions and regulatory responses to emerging technologies: CRISPR Gene editing in the US and the EU (2012–2019)

“…When confronted with emerging technologies, policy-makers and regulators lack knowledge about what precisely the emerging technology entails, how unwelcome effects of the emerging technology can be tackled, and which sorts of applications of the emerging technologies they should be specifically concerned with (Mandel 2009). Similar issues are confronted across a variety of technological advances in such diverse areas as, for example from cryptoassets (Whitford & Anderson 2020) to nanomaterials and from autonomous systems (Firlej & Taeihagh 2020) to the Internet-of-Things (Brass & Sowell 2021).…”