Cybersecurity: the consumer perspective Monique Goyens, Director-General Twitter:@moniquegoyens European Economic and Social Committee, Public Hearing on Cybersecurity Brussels, 9 January 2018

Consumers and Internet of Things There are more and more connected devices in the world (conservative estimates: 31 billion by 2020 and 75 billion by 2025) ‘New world for consumers’ Benefits and challenges for consumers

Cybersecurity and Internet of Things As the IoT ecosystem grows, the exposure of connected products to an eventual cybersecurity breach also increases. In 2016 were more than 4.000 ransomware attacks per day (increase of 300% if compared with 2015) 86% of consumers believe that the risk of becoming a victim of a cybercrime is increasing (1) (1) European Commission, Special Eurobarometer 464a, Europeans’ attitudes towards cyber security, September 2017

Example: smartwatches

Example: smartwatches

Example: smartwatches

Fragmentation of enforcement policies in the EU In December 2016, the Norwegian Consumer Council carried out an investigation on ‘my friend Cayla’ Serious security flaws discovered In January 2018, only two Member States (Germany and France) took action to prohibit Cayla from being sold on their territory. Bullet point number 1: In December 2016, our Norwegian member Forbrukerrådet (Norwegian Consumer Council) looked at the technical features of three popular connected toys sold in the EU market. One of them was ‘My Friend Cayla’ Bullet point number 3: With simple steps, anyone can take control of the toys through a mobile phone. This makes it possible to talk and listen through the toy without having physical access to the toy. This is very disturbing since these products are likely to be kept in children’s room on most occasions. Bullet point number 4: Despite the serious security vulnerabilities revealed by NCC, only two Member States took action to prevent the circulation of Cayla in the European market. Even if the product is sold in all Member States, there was not an EU enforcement reaction to prevent this product from being sold on the EU market. Furthermore, in the only country where the product was prohibited, the ban was based on national law and not EU law. Germany: Cayla was banned in February 2017 following a decision by the German Regulator (Bundesnetzagentur). While we welcomed this decision (BEUC issued a press statement), it is not based on EU law. They used the German Telecommunications Act, which has a specific clause regarding hidden spying (§ 90). France: In December 2017, French Data Protection Authority (CNIL) issued a formal notice to the manufacturer of ‘My Friend Cayla’ for violation of the right to privacy because of a lack of security. The manufacturer has now two months to comply with the French Data Protection Act or otherwise face sanctions.

Lack of will from manufacturers December 2016 November 2017 Recent campaigns from our members have proven that, even when confronted with evident security vulnerabilities in their products, manufacturers remain reluctant to act and improve the security functionalities of their products. Almost one year after the #ToyFail campaign from the Norwegian Consumer Council, UK consumer organisation Which? reassessed the security features of some of the toys tested by Forbrukerrådet (in particular i-Que Robot) only to find that the security flaws identified in December 2016 had not been corrected yet.

EU legal framework not fit to address cybersecurity concerns In key consumer product legislation (e.g. General Product Safety Directive and Radio Equipment Directive), the ‘safety’ concept is completely outdated. Manufacturers are obliged to only make safe products available on the market But ‘safety’ does not cover the safety risks that are generated because of the lack of security connected products.

Securing consumer trust in the internet of things http://www.beuc.eu/publications/beuc-x-2017-137_securing_consumer_trust_in_the_internet_of_things.pdf

Securing consumer trust in the internet of things Security and safety: “4.1. The concept of ‘safety’ in general and sector sepcific product safety legislation should be broadened to reflect new cybersecurity, data security and product safety concerns”. “4.6 Companies should adopt best practices standards such as security by design and by default, and be subject to independent assessments of compliance. (...)”

Security by design and by default Security by design: all connected products and services should better incorporate state of the art cybersecurity functionalities at an early stage of their design process and before putting the products on the market Security by default: the settings of a connected device and service are secure as a basic setting

Thank you for your attention mgo@beuc.eu www.beuc.eu – consumers@beuc.eu