Internet of (Every)Things Risks, Benefits and Practical Recommendations ACC Georgia Presentation August 16, 2016 Jason Epstein Partner, Nelson Mullins Jason.epstein@nelsonmullins.com 615-664-5364 Melloney Douce General Legal Counsel Rolta AdvizeX Technologies, LLC mdouce@advizex.com 678-942-5029

Nelson Mullins Riley & Scarborough LLP Topics How We Got Here What is the Internet of Things? Use Case Examples What Makes IoT Different? FTC Enforcement Actions Risks, Benefits, Practical Analysis Nelson Mullins Riley & Scarborough LLP

Nelson Mullins Riley & Scarborough LLP How Did We Get Here? “The Third Wave.” Book by Alvin Toffler. First Wave. 1000’s of years. Agricultural society. Second Wave. Post-Industrial Rev. Mass production and distribution. Third Wave. Information Age. Interactive community. “The Third Wave.” Book by Steve Case (2016). Three Waves of the Internet. First Wave. 1985-1999. Building the Internet. [Cisco/IBM/AOL] Second Wave. 2000-2015. App Economy and Mobile Revolution. [Amazon/Google/Facebook] Third Wave. 2016-Future. Internet of Everything. “The Third Wave is the era when the concept of Internet of Things—of adding connected sensors to products—will be viewed as too limiting, because we’ll realize that what’s emerging is the much broader Internet of Everything.” [Partnerships] Nelson Mullins Riley & Scarborough LLP

What is the Internet of (Every)Things? The Internet of Things has been defined as a ubiquitous network of connected sensors embedded in everyday objects for the purpose of collecting and sharing data via the Internet. Experts now predict that IoT-related sensors and devices will reach 50 billion by 2020. Nelson Mullins Riley & Scarborough LLP

Accelerated and New Issues Interoperability Privacy Security Data Management Product Liabilities Patent (Infringement) New Technologies (Blockchain) Nelson Mullins Riley & Scarborough LLP

Use Case Examples: The Landscape Nelson Mullins Riley & Scarborough LLP

Nelson Mullins Riley & Scarborough LLP Use Case Examples Industrial: GE: https://www.youtube.com/watch?v=KzXfFDJWgmQ Auto: HP/BMW: https://www.youtube.com/watch?v=CUjDxgXM3UA Nelson Mullins Riley & Scarborough LLP

Nelson Mullins Riley & Scarborough LLP Dilbert Nails It Nelson Mullins Riley & Scarborough LLP

Nelson Mullins Riley & Scarborough LLP And Nails it Again Nelson Mullins Riley & Scarborough LLP

What Is Different Practically? The sheer velocity of products, services and data. Think Napster. Explosion of consumer applications and thus potential risks and harm are elevated. Products built for interoperable communication through sensors and Internet connectivity and doing a lot more. Seamless connectivity to exchange information (including location, biometrics, purchases, and online browsing history). Affordability. Big Data analytics for companies to store information, share it, and make inferences about customers. Nelson Mullins Riley & Scarborough LLP

What Is Different Legally? Product Liability. Oven Smart meters Vehicles Patent Infringement. Regulatory. Privacy and Security. Updating product (firmware) Interoperability New functionality and Life Cycle Management Nelson Mullins Riley & Scarborough LLP

Notable FTC Enforcement Actions TRENDnet: In 2013 the FTC initiated regulatory action against TRENDnet, a retailer of various networking devices including routers, modems and IP cameras. TRENDnet's IP cameras allowed users to waive the requirement for login credentials and allowed a user's live feed to be publicly accessed when set to private. Hacker's posted the live feeds from various cameras online. ASUSTeK: the FTC alleged that ASUSTeK failed to take reasonable steps to secure the software for its routers, which were advertised and sold to U.S. consumers specifically for the purpose of providing security and protection for consumers’ personal networks. FTC further alleged that the ASUS routers were susceptible to a number of commonplace “well-known and reasonably forseeable vulnerabilities” that allowed hackers to gain easy, unauthorized access. Nelson Mullins Riley & Scarborough LLP

FTC Consent Order Requirements FTC issued a Consent Orders to TRENDnet and ASUSTeK required each company to establish and maintain a security program. These steps included the following: The appointment of a security officer; The identification of material internal and external risks to the security of covered devices; The identification of material internal and external risks to the security of covered information; The design and implementation of reasonable safeguards and controls and regular testing of the effectiveness of such safeguards and controls; The development of vendor management programs; and The continual evaluation and testing of the foregoing. Nelson Mullins Riley & Scarborough LLP

Additional Recommendations Identify Product Liability Issues Identify the Risks to Devices and Networks Implement Operational Controls and Safeguards Implement Personnel Risk Management Controls Implement Software Controls and Safeguards Device Lifecycle Management Reasonable Access Controls Identification of Informational Risk Data Minimization Nelson Mullins Riley & Scarborough LLP

Practical Recommendations TRANSPARENCY IoT Ecosystems will likely include numerous devices that are designed to operate without our knowledge and, as a result, consumers may find it increasingly difficult to answer “what, when, where, why and how” questions regarding IoT devices that hide in plain sight and the data such devices collect. Regulatory agencies have encouraged companies to clearly notify consumers of the presence and purpose of certain IoT devices and sensors. ACCOUNTABILITY Some regulatory agencies have cited corporate accountability as the governing principle in privacy law and, in light of this principle, encouraged companies to be accountable by demonstrating to consumers how they have used, are using, and will use consumer data. NOTICE AND CHOICE Though implementing the traditional consumer protection principles of “notice and choice” may present new challenges in IoT, providing consumers with the opportunity to make informed decisions concerning the use of their data remains critical, particularly where sensitive personal data is implicated. Nelson Mullins Riley & Scarborough LLP

Internet of (Every)Things Risks, Benefits and Practical Recommendations ACC Georgia Presentation August 16, 2016 Jason Epstein Partner, Nelson Mullins Jason.epstein@nelsonmullins.com 615-664-5364 Melloney Douce General Legal Counsel Rolta AdvizeX Technologies, LLC mdouce@advizex.com 678-942-5029