The Rise (and Pitfalls) of Connected Devices January 29, 2016 Presented By Erin M. Bosman Julie Y. Park

Transcription

1 The Rise (and Pitfalls) of Connected Devices January 29, 2016 Presented By Erin M. Bosman Julie Y. Park mofo.com

2 2

3 Connected Devices & IoT The Internet of Things (IoT) is a global infrastructure for the information society, enabling advanced services by interconnecting (physical and virtual) things based on existing and evolving interoperable information and communication technologies. 3

4 Connected Devices Are Everywhere 4

5 IoT s Future 5

6 Rise of IoT In 2008, the number of connected devices surpassed the number of people on earth. By 2017, the IoT market will surpass the PC, tablet, and phone markets combined. 6

7 Rise of IoT 82% of companies will have IoT applications implemented into their business in some way by According to Cisco, only.06% of things that could be connected to the Internet currently are Approximately 10 billion things out of the 1.5 trillion that exist globally are currently connected. A recent study predicts that the worldwide IoT market will grow to $7.1 trillion by 2020, compared to $1.9 trillion in Cisco study places value at $14.4 trillion by

8 Rise of IoT Leading industries: smart homes, smart cities, smart buildings (2014) Smart homes: $79.4 billion in revenue Smart cities: $59.2 billion Smart building/infrastructure: $25 billion. Expert studies estimate that by 2020 there will be over 50 billion connected devices. Some place this number as high as 212 billion. 8

9 Rise of IoT 9

10 Pitfalls of IoT Product Liability Issues Manufacturing Defect Design Defect Failure to Warn Misrepresentations Third Party Interference Information Retention and Management Issues extend to companies that use connected devices 10

11 What Is A Product? Software has not been analyzed by many courts Software integrated into a connected product is likely to be subject to product liability 11

12 Manufacturing Defects A defect in the manufacture of a product exists if the product differs from the manufacturer s intended result, or ostensibly identical products made by the same manufacturer Historically challenging to prove New opportunities for liability Software errors Products may themselves contain more information about their history and even creation could provide evidence for plaintiffs that manufacturing defect occurred 12

13 Design Defect A product is defective if: It fails to perform as safely as an ordinary customer would expect when used in an intended or reasonably foreseeable manner or There is a risk of danger inherent in the design that outweighs the benefits of the design. New opportunities for liability based on foreseeable misuse 13

14 Failure to Warn Liability may exist if manufacturer of a product knew or should have known of a potential danger and failed to give adequate directions or warnings of a potential danger. New opportunities for liability: Connected devices allow more opportunities for interactions between the manufacturer and customer Connected devices may provide manufacturers more metrics and information about their connected devices and the manner in which they are being uses 14

15 Misrepresentation Manufacturers can be held liable for making a representation about their product that turns out not to be true New opportunities for liability: Manufacturers are at an increased risk of misrepresenting a security feature or a potential safety issue that may arise from many new types of connected appliances 15

16 New Areas of Liability Information retention Third party interference 16

17 Is Too Much Data A Bad Thing? Ability to capture and collect vast amounts of information raises risks Retained information may impact the scope of manufacturer s duty to warn users When manufacturing and marketing new products, companies need to determine what information is important to retain 17

18 Data Rights/Ownership Data rights typically drive from data ownership and corresponding rights of use Ownership varies depending on the type of data Individual Corporation/entity University Government Public Domain Not always so simple Need for a common data rights framework? 18

19 Compliance With Reporting Obligations Consumer Product Safety Commission (CPSC) impute[s] to the subject firm knowledge of product safety related information received by an official or employee of a subject firm capable of appreciating the significance of the information. Does the data collected by connected devices constitute knowledge of product safety related information? If a manufacturer chooses not to analyze information available to it, can it then claim it was not capable of appreciating the significance of isolated reports? 19

20 Third Party Interference Connected nature of devices provides more opportunities for third parties to do harm 20

21 Third Party Interference - Security Unauthorized access and control of devices can result in a variety of types of harm Threats to individual Physical safety Identify theft Ransomware Traceability and unlawful profiling Threats to Corporations and other entities Corporate theft and espionage Tangible property Physical security Data Security Cyberwar and cyber-terrorism 21

22 Manufacturer Liability Intervening cause as an affirmative defense What happens with third party hackers who cannot be identified or traced? Progressive courts are likely to adopt legal theories that will allow plaintiffs to be compensated (i.e. manufacturer liability) 22

23 Insurance Issues New connected devices also raise questions concerning whether or not traditional insurance policies will cover potentially novel claims Companies need to carefully review policies to see if they would cover consequences of a breach Insurance underwriters are likely to require documentation of strict security controls. 23

24 IoT Best Practices Warnings & Security Provide warnings regarding security and safety risks Disclose duration of security and firmware updates Implement strict password requirements 24

25 IoT Best Practices - Warnings Disclose hazards of running appliances while no one is home and include remote start warnings 25

26 IoT Best Practices - Disclaimer Disclaim liability for user negligence in security measures 26

27 IoT Best Practices Data Collection Collect only what is needed and know what is being collected 27

28 IoT Best Practices Allow basic functionality of connected device even if it is disconnected Implement a kill switch into connected devices 28

29 IoT Best Practices Failure detection 29

30 IoT Best Practices Ongoing evaluation of custom modes and settings 30

31 IoT Best Practices Maintain ability to distinguish product lines, lots, and serial numbers for selective delivery of firmware updates 31

32 Non-Manufacturer Liability New liability issues need to be considered in business and service contracts for connected devices Review contracts and agreements for indemnification terms Work with manufacturers and urge them to implement safeguards 32

33 Contact Us Erin M. Bosman Partner Chair of Product Liability Practice Group Julie Y. Park Associate 33