ACM and RDI: manufacturers and sellers need to do more for keeping smart devices running and secure
The Netherlands Authority for Consumers and Markets (ACM) and the Dutch Authority for Digital Infrastructure (RDI) have jointly had a study carried out into the functioning and security of smart devices. The most important finding is that the information that consumers receive when purchasing their smart devices often leaves much to be desired. Despite some shortcomings, the technical security of these devices often proved to be in order. However, updates were not always provided.
This study marks the first time ACM and RDI have jointly had a study carried out. For both ACM and RDI, the study’s findings serve as the basis for their oversight over smart devices for consumers.
The study’s findings
The study focused on home automation devices (also known as domotica), which are smart devices in and around the house that are used by many consumers. Examples are smart thermostats, baby monitors, doorbells, or smart TVs. When purchasing such devices, consumers are entitled to a properly functioning device (including updates) as well as to all of the necessary information, for example about the policy regarding functionality and security updates, how long these will be provided, and what the consequences are if consumers fail to install updates. The study used a sample of fifteen commonly used devices.
Prior to, during, and after the purchase, sellers and manufacturers provided little information about what their device does, in what kind of digital environment it works, and with what other devices it can interact. For example, one in two sellers of devices purchased online failed to provide any information about the update policy. In some cases, manufacturers provided different information than sellers did. When making their purchases in brick-and-mortar stores, consumers receive less information than they purchase online.
Edwin van Houten, Director of ACM’s Consumer Department, adds: "This study gave us an overview of what information consumers receive prior to, during, and after their purchases of smart devices, and also of whether the purchased devices are safe, and will continue to work. We see that the information that is given still leaves much to be desired, and that the update policies have room for improvement, too. These findings are important for our oversight."
Apps
Many home automation devices can be controlled using apps. These apps often only work with certain versions of operating systems. With two devices, the minimum requirements for the operating system were mentioned. That means that, when purchasing smart devices, consumers often are not sure whether their devices will communicate properly with the version of their operating systems.
John Derksen, Director of RDI’s Devices Department, explains: "RDI conducts oversight over the availability, reliability, and integrity of the digital infrastructure. One crucial precondition in that context is the security (including cybersecurity) of smart devices. This study shows that many devices still have shortcomings. That is reason for concern, and therefore an important point of attention in our future regulatory efforts. In our own ‘IoT-lab’, we study the security of smart devices. In that context, the findings of this study offer us valuable information, and will ultimately help us further enhance the digital security of devices and, by extension, of the Netherlands itself."
See also
- 04-03-2024 Study into smart devices for consumers commissioned by ACM and RDI (in Dutch)
- 24-02-2022 ACM and AT to investigate security and information aspects in connection with smart devices