Thread by @doctorow

The IoT Cybersecurity Act - passed both houses, awaiting presidential signature - is pretty good. It deputizes @NIST to come up with standards that any IoT device purchased by the federal government must adhere to.

congress.gov/bill/116th-con…

1/

NIST is charged with coming up with guidelines for "secure code, identity management, patching and configuration management" and the GSA has to coordinate vulnerability reporting and response across federal agencies.

theregister.com/2020/11/18/us_…

2/

But for me, the most interesting part is the lever that the act pulls on to achieve its policy ends: procurement. Uncle Sam buys a LOT of stuff, and when the USG refuses to buy substandard stuff, it puts bad vendors at a serious commercial disadvantage.

3/

That means that bad vendors who want government contracts have to clean up their acts and make better products: not because the law requires them to, but because the government won't spend public money on lemons.

4/

Imagine what administrative agencies (or Congress) can do with this: "No federal agency shall buy a vehicle unless it complies with a suite of comprehensive right-to-repair rules."

5/

Or: "No DoE-funded school will buy ed-tech unless administrators can side-load apps and limit data-collection."

Or: "No US Agency shall communicate with the public on a social media platform unless that platform adheres to meaningful, opt-in consent for data collection."

6/

This is the approach that many US states took after @AjitPaiFCC used a blatantly fraudulent process to dismantle Net Neutrality rules: passed state laws banning state agencies from buying internet service from non-neutral ISPs.

7/

None of this is about telling companies what to do: it's about getting the best possible deal for the public. It's the government living up to its responsibility to spend public money wisely.

eof/