1. Internet of (Every)Things
Risks, Benefits and Practical Recommendations
ACC Georgia Presentation
August 16, 2016
Jason Epstein
Partner, Nelson Mullins
Melloney Douce
General Legal Counsel
Rolta AdvizeX Technologies, LLC

2. Nelson Mullins Riley & Scarborough LLP
Topics
How We Got Here
What is the Internet of Things?
Use Case Examples
What Makes IoT Different?
FTC Enforcement Actions
Risks, Benefits, Practical Analysis
Nelson Mullins Riley & Scarborough LLP

3. Nelson Mullins Riley & Scarborough LLP
How Did We Get Here?
“The Third Wave.” Book by Alvin Toffler.
First Wave ’s of years. Agricultural society.
Second Wave. Post-Industrial Rev. Mass production and distribution.
Third Wave. Information Age. Interactive community.
“The Third Wave.” Book by Steve Case (2016). Three Waves of the Internet.
First Wave Building the Internet. [Cisco/IBM/AOL]
Second Wave App Economy and Mobile Revolution. [Amazon/Google/Facebook]
Third Wave Future. Internet of Everything. “The Third Wave is the era when the concept of Internet of Things—of adding connected sensors to products—will be viewed as too limiting, because we’ll realize that what’s emerging is the much broader Internet of Everything.” [Partnerships]
Nelson Mullins Riley & Scarborough LLP

4. What is the Internet of (Every)Things?
The Internet of Things has been defined as a ubiquitous network of connected sensors embedded in everyday objects for the purpose of collecting and sharing data via the Internet.
Experts now predict that IoT-related sensors and devices will reach 50 billion by 2020.
Nelson Mullins Riley & Scarborough LLP

5. Accelerated and New Issues
Interoperability
Privacy
Security
Data Management
Product Liabilities
Patent (Infringement)
New Technologies (Blockchain)
Nelson Mullins Riley & Scarborough LLP

6. Use Case Examples: The Landscape
Nelson Mullins Riley & Scarborough LLP

7. Nelson Mullins Riley & Scarborough LLP
Use Case Examples
Industrial:
GE:
Auto:
HP/BMW:
Nelson Mullins Riley & Scarborough LLP

8. Nelson Mullins Riley & Scarborough LLP
Dilbert Nails It
Nelson Mullins Riley & Scarborough LLP

9. Nelson Mullins Riley & Scarborough LLP
And Nails it Again
Nelson Mullins Riley & Scarborough LLP

10. What Is Different Practically?
The sheer velocity of products, services and data. Think Napster.
Explosion of consumer applications and thus potential risks and harm are elevated.
Products built for interoperable communication through sensors and Internet connectivity and doing a lot more.
Seamless connectivity to exchange information (including location, biometrics, purchases, and online browsing history).
Affordability.
Big Data analytics for companies to store information, share it, and make inferences about customers.
Nelson Mullins Riley & Scarborough LLP

11. What Is Different Legally?
Product Liability.
Oven
Smart meters
Vehicles
Patent Infringement.
Regulatory.
Privacy and Security.
Updating product (firmware)
Interoperability
New functionality and Life Cycle Management
Nelson Mullins Riley & Scarborough LLP

12. Notable FTC Enforcement Actions
TRENDnet: In 2013 the FTC initiated regulatory action against TRENDnet, a retailer of various networking devices including routers, modems and IP cameras.
TRENDnet's IP cameras allowed users to waive the requirement for login credentials and allowed a user's live feed to be publicly accessed when set to private.
Hacker's posted the live feeds from various cameras online.
ASUSTeK: the FTC alleged that ASUSTeK failed to take reasonable steps to secure the software for its routers, which were advertised and sold to U.S. consumers specifically for the purpose of providing security and protection for consumers’ personal networks.
FTC further alleged that the ASUS routers were susceptible to a number of commonplace “well-known and reasonably forseeable vulnerabilities” that allowed hackers to gain easy, unauthorized access.
Nelson Mullins Riley & Scarborough LLP

13. FTC Consent Order Requirements
FTC issued a Consent Orders to TRENDnet and ASUSTeK required each company to establish and maintain a security program. These steps included the following:
The appointment of a security officer;
The identification of material internal and external risks to the security of covered devices;
The identification of material internal and external risks to the security of covered information;
The design and implementation of reasonable safeguards and controls and regular testing of the effectiveness of such safeguards and controls;
The development of vendor management programs; and
The continual evaluation and testing of the foregoing.
Nelson Mullins Riley & Scarborough LLP

14. Additional Recommendations
Identify Product Liability Issues
Identify the Risks to Devices and Networks
Implement Operational Controls and Safeguards
Implement Personnel Risk Management Controls
Implement Software Controls and Safeguards
Device Lifecycle Management
Reasonable Access Controls
Identification of Informational Risk
Data Minimization
Nelson Mullins Riley & Scarborough LLP

15. Practical Recommendations
TRANSPARENCY
IoT Ecosystems will likely include numerous devices that are designed to operate without our knowledge and, as a result, consumers may find it increasingly difficult to answer “what, when, where, why and how” questions regarding IoT devices that hide in plain sight and the data such devices collect. Regulatory agencies have encouraged companies to clearly notify consumers of the presence and purpose of certain IoT devices and sensors.
ACCOUNTABILITY
Some regulatory agencies have cited corporate accountability as the governing principle in privacy law and, in light of this principle, encouraged companies to be accountable by demonstrating to consumers how they have used, are using, and will use consumer data.
NOTICE AND CHOICE
Though implementing the traditional consumer protection principles of “notice and choice” may present new challenges in IoT, providing consumers with the opportunity to make informed decisions concerning the use of their data remains critical, particularly where sensitive personal data is implicated.
Nelson Mullins Riley & Scarborough LLP

16. Internet of (Every)Things
Risks, Benefits and Practical Recommendations
ACC Georgia Presentation
August 16, 2016
Jason Epstein
Partner, Nelson Mullins
Melloney Douce
General Legal Counsel
Rolta AdvizeX Technologies, LLC