California's IoT Security Law – Will This Law Really Improve Security?

California's legislature recently passed SB-327, which is designed to require Internet of Things (IoT) and other "connected device" manufacturers to implement security features into internet connected devices. California Governor Jerry Brown signed the bill into law on September 28, 2018. While the attempt to improve security of these devices is admirable, the law is ambiguous in many respects, and will likely create significant challenges in its implementation and effectiveness.

As we have previously written, there have been a number of significant distributed denial-of-service ("DDoS") attacks over the past few years resulting in large part from the proliferation of IoT devices. The increasing prevalence of IoT devices present a heightened risk of DDoS attacks because many of these attacks exploit the relative security weaknesses in IoT devices to create "botnets" made up of thousands of devices, to launch powerful DDoS attacks.