Oregon governor signs bill requiring ‘reasonable security’ for online gadgets
Gov. Kate Brown signed a bill Thursday requiring tech companies to install “reasonable security features” on connected devices and appliances to prevent hackers from gaining access to steal information or manipulate the devices.
Attorney General Ellen Rosenblum proposed the bill last winter and it won broad support in the Legislature. The House approved it 53-5 last month and the Senate voted in favor last week by a margin of 19-9.
House Bill 2395 could apply to anything from streaming video devices to digital cameras, garage door openers and connected microwaves. Though such devices are relatively new to the market, already there are many instances of digital intruders using the devices to snoop or to repurpose the gadgets to engineer larger digital attacks.
Shipping devices without reasonable security is now a violation of Oregon’s consumer protection laws, which gives the state authority to sanction companies that don’t meet the standard. Oregon’s new law echoes a similar law passed in California last year.
Critics complain that Oregon’s law is too vague.
“The bill is currently drafted so that after an attack occurs, manufacturers and the Attorney General can debate in a courtroom, possibly 10 or 20 years after a product was manufactured, what is ‘reasonable,’ Kevin Messner, vice president at the Association of Home Appliance Manufacturers, said in written testimony on the bill last month.
The new internet security law is one of several technology-related bills Oregon lawmakers considered this spring.
On Tuesday, Brown signed a bill repealing Oregon’s gigabit tax break. Lawmakers approved the property tax exemption in 2015 in hopes of luring Google Fiber’s fast internet service to Portland. Google never came but Comcast and Frontier used the law to secure millions of dollars in tax savings.
Still under consideration is a proposed fee on cellphone service that would cost subscribers between $4 and $12 a year to fund $10 million in rural broadband projects. A “right to repair” bill, which would require electronics manufacturers to make tools and information available to fix their gadgets, died in committee.
-- Mike Rogoway | twitter: @rogoway | 503-294-7699
Gloss