II 

115TH CONGRESS 

1ST SESSION S. 2234 

To require the Federal Trade Commission to develop cybersecurity resources 

for consumer education and awareness regarding the purchase and use 

of devices that are part of the Internet of Things, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

DECEMBER 14, 2017 

Mr. WICKER (for himself and Ms. HASSAN) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To require the Federal Trade Commission to develop cybersecurity resources for consumer education and awareness 

regarding the purchase and use of devices that are part 

of the Internet of Things, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Internet of Things 

5 Consumer Tips to Improve Personal Security Act of 

6 2017’’or the ‘‘IOT Consumer TIPS Act of 2017’’. 

7 SEC. 2. FINDINGS. 

8 Congress finds the following: 


daltland on DSKBBV9HB2PROD with BILLS
2 

•S 2234 IS

1 (1) The term ‘‘Internet of Things’’ refers to de2 vices, applications, and physical objects that are 

3 Internet-enabled, networked, or connected. 

4 (2) The devices that are part of the Internet of 

5 Things are equipped with sensors or developed with 

6 automated functionalities that allow them to collect, 

7 send, or receive data, and perform according to con8 sumer preferences that enhance productivity, effi9 ciency, and convenience. 

10 (3) The rapid adoption of the Internet of 

11 Things among consumers and businesses is driven 

12 by the wide range of economic and societal benefits 

13 that are generated by such devices across almost 

14 every industry and sector. 

15 (4) Consumer trust in the security of the Inter16 net of Things is paramount to the leadership and 

17 competitiveness of the United States in the global 

18 digital economy. 

19 (5) It is the policy of the United States to en20 courage innovation in the development and use of 

21 the Internet of Things and empower consumers to 

22 be responsible digital citizens and manage the secu23 rity of their devices in collaboration with manufac24 turers, sellers, and service providers. 


daltland on DSKBBV9HB2PROD with BILLS
3 

•S 2234 IS

1 SEC. 3. FEDERAL EDUCATIONAL CYBERSECURITY RE2 SOURCES FOR CONSUMERS REGARDING DE3 VICES THAT ARE PART OF THE INTERNET OF 

4 THINGS. 

5 (a) DEFINITIONS.—In this section— 

6 (1) COVERED DEVICE.—The term ‘‘covered de7 vice’’— 

8 (A) includes devices, applications, and 

9 physical objects that are— 

10 (i) part of the Internet of Things; and 

11 (ii) marketed and sold primarily to 

12 consumers; and 

13 (B) does not include— 

14 (i) devices that are marketed and sold 

15 for use primarily in industrial, business, or 

16 enterprise settings; or 

17 (ii) smartphones, tablets, personal 

18 computers, or devices leased to consumers 

19 by multichannel video programming dis20 tributors. 

21 (2) CYBERSECURITY THREAT.—The term ‘‘cy22 bersecurity threat’’ has the meaning given to the 

23 term in section 102 of the Cybersecurity Information 

24 Sharing Act of 2015 (6 U.S.C. 1501). 

25 (3) SECURITY VULNERABILITY.—The term ‘‘se26 curity vulnerability’’ has the meaning given to the 


daltland on DSKBBV9HB2PROD with BILLS
4 

•S 2234 IS

1 term in section 102 of the Cybersecurity Information 

2 Sharing Act of 2015 (6 U.S.C. 1501). 

3 (b) DEVELOPMENT OF EDUCATIONAL CYBERSECU4 RITY RESOURCES.—Not later than 1 year after the date 

5 of enactment of this Act, the Federal Trade Commission 

6 shall, in coordination with the National Institute of Stand7 ards and Technology and relevant private sector stake8 holders and experts, develop voluntary educational cyber9 security resources for consumers relating to the practices 

10 of consumers with respect to the protection and use of 

11 covered devices, including citing evidence of consumer atti12 tudes and expectations. 

13 (c) ELEMENTS.—The voluntary resources developed 

14 under subsection (b) shall be technology-neutral and in15 clude guidance, best practices, and advice for consumers 

16 to protect against, mitigate, and recover from cybersecu17 rity threats or security vulnerabilities, where technically 

18 feasible, including— 

19 (1) the scope of possible security support from 

20 a vendor post-purchase; 

21 (2) how to initiate or set up a covered device 

22 for use; 

23 (3) the use of passwords, available security 

24 tools and settings, appropriate physical controls, and 

25 avoidance of steps that can defeat security; 


daltland on DSKBBV9HB2PROD with BILLS
5 

•S 2234 IS

1 (4) updates to the software of a covered device 

2 during operation or use if applicable; 

3 (5) the recovery of compromised devices; 

4 (6) end-of-life considerations such as resetting, 

5 deleting, or modifying data collected or retained by 

6 a covered device when it is no longer in use or ex7 pected to be used by the consumer; 

8 (7) security services, tools, or platforms for con9 nected devices that may help consumers manage 

10 connected devices; and 

11 (8) varying security considerations depending 

12 on factors, including the type of device and setting 

13 of use. 

14 (d) AVAILABILITY AND PUBLICATION.—The Federal 

15 Trade Commission shall ensure that the resources devel16 oped under subsection (b) are available to and readily ac17 cessible by the public on the Internet website of the Fed18 eral Trade Commission. 

19 (e) PERIODIC UPDATES.—The Federal Trade Com20 mission shall review, and, as necessary update the re21 sources developed under subsection (b), in collaboration 

22 with industry stakeholders, to address changes in cyberse23 curity threats or security vulnerabilities and other tech24 nology developments or challenges. 


daltland on DSKBBV9HB2PROD with BILLS
6 

•S 2234 IS

1 (f) VOLUNTARY USE.—The resources developed 

2 under subsection (b) shall be for voluntary use by con3 sumers. 

4 (g) TREATMENT.—No guidelines, best practices, or 

5 advice issued by the Federal Trade Commission with re6 spect to the resources developed under subsection (b) shall 

7 confer any right on any person, State, or locality, nor shall 

8 operate to bind the Federal Trade Commission or any per9 son to the approach recommended in such guidance, best 

10 practice, or advice. The Federal Trade Commission may 

11 not base an enforcement action on, or execute a consent 

12 order based on, any failure to promote or use such guid13 ance, or any practice used for covered device functionality 

14 that is alleged to be inconsistent with any guidance, best 

15 practice, or advice included in the resources developed 

16 under subsection (b), unless the practice allegedly violates 

17 another provision of law. Nothing in this Act is intended 

18 to limit the ability of the Federal Trade Commission to 

19 enforce section 5 of the Federal Trade Commission Act 

20 (15 U.S.C. 45). 

Æ 


daltland on DSKBBV9HB2PROD with BILLS