010 - Imperative 3 Prepare Consumers to Thrive in a Digital Age

Section nine of Report on Securing and Growing the Digital Economy. This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox dot org.

Recording by J. D. Gibson. Report on Securing and Growing the Digital Economy by the Commission on Enhancing National Cybersecurity Imperative three Prepare Consumers to thrive in a digital age.

The challenge and way forward innovation in computing technologies continues to accelerate. While this innovation enables exciting new capabilities every day, it is happening in a way that often places the burden on individuals to understand if a product or service is secure to use, and to take actions to secure their devices and their use of those devices. Moreover, consumers often are unaware that buying and using secure devices does more than mitigate threats to their own devices and data.

Their responsible cyber habits also strengthen and protect the broader networks of all users who rely on the Internet and the digital ecosystem. Engineers and designers should create products and systems with security built in and provide consumers with the ability to know how their user experience will be protected. The burden of primary responsibility for cybersecurity should be driven up the chain from the consumer to the manufacturer. The Commission believes that this goal must be met in order to enhance cybersecurity, especially as IoT devices rapidly enter the consumer world.

These shifts must be accompanied by much improved identity management approaches that include stronger authentication see Imperative one Recommendation one point three. As an interim step to advance its products designed with security built in, engineers and manufacturers should pursue security awareness by default, actively prompting consumers to change default passwords, select security preferences, and verify that they are aware of the security implications of an action. For example.

The complexity of cybersecurity and the resources needed to address it must be reduced in the long run. Manufacturers should automate, simplify, and improve the process by which consumers are advised about cybersecurity implications of using their digital devices. They must come up with more intuitive ways that demand the minimum amount of extra thought and effort Recommendation three point one. Business leaders in the information technology and communications sector need to work with consumer organizations and the Federal Trade Commission FTC to provide consumers with better information so that they can make informed decisions when purchasing and using connected products and services.

Despite near universal dependence on computing, technology and information exchange for communication, education, commerce, transportation, housing, healthcare, and many other aspects of daily life, most consumers are unsure about how to protect their data and personal information, much less select the technology, products and services that best support their cybersecurity and privacy needs. Raising cybersecurity awareness has long been a core aim of US cybersecurity strategy, and the notion that consumer awareness about cybersecurity should be heightened is broadly accepted.

Yet public and private sector efforts have fallen far short of achieving this goal. The Commission identified many previous and current federal, private sector, and non profit attempts to increase cybersecurity awareness for every demographic group, but these attempts have not produced the intended results. Unfortunately, some public awareness campaigns are carried out by organizations centered on technology rather than those whose expertise lies in public messaging and effective behavioral change.

These campaigns tend to be fitful periodically highlighting cybersecurity instead of providing a constant focus on the topic. Narrowly framed once in a while approaches cannot sufficiently motivate people to change their cybersecurity behavior and cannot achieve wide scale, large impact success in bolstering security on the larger digital economy. A sustained, multidisciplinary public awareness campaign focused on providing simple, concrete, actionable advice that consumers can and will follow is needed.

There are numerous public service campaigns that have achieved p behavior changing results across broad portions of the public. None has tackled as complex an issue as cybersecurity. Increasing awareness is only part of the solution. To achieve the necessary behavioral change, such a campaign must be coupled with an improvement in the security incorporated into devices and systems.

The ultimate solution is that all devices should be secure to market, but until then, companies must provide information about each product sufficient to enable consumers to make informed and smart security related decisions about the technology, products and services they acquire. Such disclosures should incentivize technology product vendors and service providers to give consumers clear, accurate, and comprehensive information about their cybersecurity and privacy capabilities and practices.

A partial goal of this effort should be to make cyber security a market differentiator Action Item three point one point one. To improve consumers purchasing decisions, an independent organization should develop the equivalent of a cybersecurity nutritional label for technology products and services, ideally linked to a rating system of understandable, impartial third party assessment that consumers will intuitively trust and understand short and medium term, whether at their jobs or in their activities outside of work, consumers rely heavily on technology products and services in their daily lives.

Today, there is no standard format in which technology companies communicate the security characteristics and features of their products to consumers, and for these products and services, unlike mainstream products that are subject to authoritative ratings based on standards and tests by well known independent organizations, there is no system to let consumers know how they rate. This lack of information leaves most consumers unaware of the risks associated with using technology products and services, how these risks might easily be reduced, or how competing products security characteristics compare with each other, making matters worse.

Security considerations increasingly may lead to safety concerns, as many Internet enabled devices can affect the world physically, though this is a complex challenge improvements in consumer awareness and engagement can be made now. First, a standard cybersecurity label for technology products and services should be developed. This label should include privacy related information and be informed by the cybersecurity framework. It should capture cybersecurity related risks for a particular product or service, be user friendly, and convey how easy the technology is for the consumer to secure.

Properly, each label should display reliable, quantifiable information for a technology product in a format easily understood by the product's consumers. Properly designed and deployed, a standard label would enhance consumer decision making. Other areas of consumer information and purchase offer ample precedent for initiatives by one or more independent organizations that would lead to helpful labels. For example, such an effort could be modeled on the nutritional label mandated by the Food and Drug Administration for food products, the Energy Star program, and associated rating information for products that consume energy, labeling programs that use a sticker to provide standard information to prospective buyers of new vehicles, or consumer product rating systems.

Second, a rating system based on an impersonal assessment of a product's cybersecurity risk could be incorporated into the label or provided in associated literature as a further guide to consumers, and several models exist that could be expanded, amplified, or modified. Labeling and rating systems will be far more challenging to advance for technology products and likely will proceed in steps and evolve given the degree of difficulty involved. Designing and launching a rating system will take the concerted efforts of multiple organizations in the private and public sectors, but the need merits of full scale initiative private and public sector resources should be marshaled to tackle this task.

A decision about whether such efforts should remain strictly voluntary should be made after initial efforts have had time to mature. Later assessments may determine that a mandatory labeling or rating program is required. In the meantime, better information for consumers through public awareness campaigns, checklists, consumer oriented websites, and formal education should receive urgent attention. This issue should be a top item on the agenda for the White House Summit recommended below Action Item three point one point two.

Within the first one hundred days of the new administration, the White House should convene a summit of business, education, consumer and government leaders at all levels to plan for the launch of a new national cybersecurity awareness and engagement campaign short term. There have been many public and private cybersecurity awareness campaigns during the past few years that have not achieved the anticipated results. Future awareness campaigns should be built on these efforts and the knowledge gained about what approaches work most effectively.

New initiatives should be undertaken at an even more ambitious scale, aimed at reaching a larger audience and delivering a small number of clear and consistent messages on specific cybersecurity issues more frequently and across a wider variety of communications channels. Campaigns can and have a greater impact if they are informed by the experiences of awareness campaigns and domains other than cybersecurity. Designing successful cybersecurity awareness campaigns should involve gathering input from a wide range of viewpoints by drawing on experts from traditional and novel online media and content providers, advertisers, technology developers, public health experts, internet security providers, and law enforcement, as well as business, education, consumer and government leaders.

To gain the attention and resources that this effort deserves, the President should convene a summit that brings together experts as soon as possible to facilitate the launch of a new national cybersecurity awareness campaign in twenty seventeen. Among the topics that should be addressed at such a summit are the steps needed to launch initiatives designed to generate product and service labeling and rating systems. In addition, specific attention should be given to the need to educate consumers on the selection and use of secure connected IoT devices.

This effort must include the importance of changing default usernames and passwords on their connected devices such as routers, cameras, printers, etc. The goal of this effort is twofold. One to improve security of the millions of IoT devices deployed currently and likely to be purchased in the future, and two to close off a vector commonly used in cyber attacks. The aim must be to minimize, though not entirely eliminate, the need for consumers to be responsible for IoT device security.

The Federal Trade Commission FTC should use this summit to initiate work with IoT device manufacturers and usability experts to create websites, hotlines, and other approaches to assist consumers in changing default usernames and passwords. The FTC should use this forum to gather consumer and industry representatives to better inform consumers about their rights and responsibilities pertaining to digital devices. See the following action item Action Item three point one point three.

The FTC should convene consumer organizations and industry stakeholders in an initiative to develop a standard template for documents that inform consumers of their cybersecurity roles and responsibilities as citizens in the digital economy, along with a consumer's bill of rights and responsibilities for the digital age, medium term security and privacy of digital products or services depend on all ecosystem participants understanding their roles and responsibilities and the consequences of their actions.

Clarifying these expectations enables buyers to understand true costs and to differentiate among market alternatives. A single digital oriented consumer bill of rights could serve as a framework for all parties, including manufacturers, service providers, and consumers. Consumers often do not know or understand what rights they may have regarding cybersecurity and privacy because there is no standard and because current disclosures, if they exist, vary by product, service and manufacturer.

Providers of technology products and services usually express information about their consumer cybersecurity and privacy practices using legal language that most consumers cannot understand. Even if the explanation of these practices were written more accessibly, consumers would still have to take time to review these practices for each technology, product and service. Realistically, few, if any, would do so. A document based on a standard template to educate consumers on their rights would make them much more knowledgeable about what security measures their products and services employ and what technology vendors and providers are legally allowed to do with their information.

Today, the most commonly used terms of use and licensing agreements give companies the right to do what they wish with consumers information as a condition of using the service. If consumers enter accept once prompted, and they must do that before being able to utilize a service, they likely have very limited rights. Manufacturers and service providers should work with consumer representatives, including associations and the FTC to standardize these agreements for clarity and appropriateness.

While standardizing the presentation of information about consumer rights relating to the purchase of a particular device or service would be a positive development, it is not enough to protect and inform consumers concerning cybersecurity and privacy. The Commission recommends that consumer organizations work with industry and the FDC to develop a consumer cybersecurity Bill of Rights and Responsibilities that would simplify consumer education on their rights, provide insights on what technology vendors and providers are legally allowed to do with consumer information, clarify privacy protections, articulate responsibilities of all citizens that participate in the digital economy, and identify the security attributes of products and services.

This Bill of Rights and Responsibilities should be disseminated widely in order to increase consumer's awareness of their roles in the responsible use of digital devices and networks, including the consequences that an individual's actions have for others in the larger digital economy. Recommendation three point two, the federal government should establish, strengthen and broaden investments in research programs to improve the cybersecurity and usability of consumer products and digital technologies through greater understanding of human behaviors and their interactions with the Internet of Things, IoT and other connected technologies.

Human interactions with computing technologies and devices have a direct impact on cybersecurity. Often, the privacy and security protections built into the designs of products are difficult to use or require multiple steps that encourage users to develop workarounds to circumvent those privacy and security features that would protect them. Ease of use must be a key consideration in product development. Additional and ongoing research in this area of human interaction will help designers and manufacturers understand how secure, easy to use products can be created.

Action Item three point two point one. The next administration and Congress should prioritize research on human behavior and cybersecurity on the basis of the twenty sixteen Federal Cybersecurity Research and Development Strategic Plan short Term, the Office of Science and Technology Policy O s t P coordinated the development of a Federal Cybersecurity R and D plan that points out the need to identify and teach human behaviors that enhance security. The plan also makes clear that we need to identify effective methods to encourage more cyber secure behavior in the design and operation of IT systems.