Consumer IoT and its under‐regulation: Findings from an Australian study

Abstract

The expansive growth of consumer internet of things (IoT) has created a range of concerns around privacy, security, and their broader societal impacts. This article reports on findings from interviews with 32 key stakeholders from the fields of information security, policy and regulation, the IoT industry, consumer and privacy law, and academia in Australia. It details a broad variety of issues and concerns that go beyond the well-recognised issue of privacy or the technical standards of information security, to encompass a wider set of issues regarding the implications for vulnerable communities, the environment and industrial standards of IoT production. Most key stakeholders expressed the view that more robust regulation is required in Australia, but no clear regulatory priority or strategy was identified by our sample. The implications of these findings for further regulation of consumer IoT and future regulatory strategies are considered.

Security and Privacy for Low Power IoT Devices on 5G and Beyond Networks: Challenges and Future Directions

“…When assessing the security regulations of personal IoT devices from an Australian perspective, it has previously been identified that the regulation of IoT in Australia could be more robust [35]. An insipid set of regulations can leave consumers vulnerable to security, privacy, and consent dangers [144].…”

“…While the voluntary code of practice is a step forward, standardisation of IoT is necessary for the robust regulation of the industry. As it currently stands, standards throughout Australia address the overall electrical safety of the device and not the security and privacy aspects VOLUME 4, 2022 [35]. This, however, is changing, with recommendations from the ACCC following their 2019 inquiry paving the way for a suite of reforms that include enhanced protection for consumers under the privacy act [35].…”

“…As it currently stands, standards throughout Australia address the overall electrical safety of the device and not the security and privacy aspects VOLUME 4, 2022 [35]. This, however, is changing, with recommendations from the ACCC following their 2019 inquiry paving the way for a suite of reforms that include enhanced protection for consumers under the privacy act [35]. It is imperative to note that various potential risks to users' privacy, autonomy, and data security from IoT devices were considered by the ACCC.…”

“…It is imperative to note that various potential risks to users' privacy, autonomy, and data security from IoT devices were considered by the ACCC. In the research by the authors of [35], they noted that if implemented, the recommendations would result in several benefits for consumers, with an implementation of standards to protect consumers from unfair or anticompetitive trading practices among them. Although [35] notes that the standards will add protections against unfair and anticompetitive practices, they fall short of applying consistency to cyber security and privacy standards for personal IoT devices using wireless communications across radiofrequency spectrums, and as a result, as identified earlier by the authors of [143], will only serve to contribute to inconsistencies and gaps in existing solutions to these problems.…”

The Internet regulation turn? Policy, Internet and technology

“…Moving beyond the digital confines of Internet applications such as TikTok and other social media platforms is the consideration of consumer IoT as a permeable force and its under‐regulation. According to Harkin et al (2021) in Consumer IoT and its under‐regulation: Findings from an Australian study , under‐regulation is not only impacting consumer privacy and security but presents ‘a wider set of issues regarding the implications for vulnerable communities, the environment, and industrial standards of IoT production’. Aligning with the emerging theme of ambiguity and legitimacy, these scholars hone in on the lack of appropriate regulation for this reasonably area of information and communication technologies.…”