Internet of Things Consumer Tips to Improve Personal Security Act of 2017

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Internet of Things Consumer Tips to 
Improve Personal Security Act of 2017''or the ``IOT Consumer TIPS Act 
of 2017''.

SEC. 2. FINDINGS.

    Congress finds the following:
            (1) The term ``Internet of Things'' refers to devices, 
        applications, and physical objects that are Internet-enabled, 
        networked, or connected.
            (2) The devices that are part of the Internet of Things are 
        equipped with sensors or developed with automated 
        functionalities that allow them to collect, send, or receive 
        data, and perform according to consumer preferences that 
        enhance productivity, efficiency, and convenience.
            (3) The rapid adoption of the Internet of Things among 
        consumers and businesses is driven by the wide range of 
        economic and societal benefits that are generated by such 
        devices across almost every industry and sector.
            (4) Consumer trust in the security of the Internet of 
        Things is paramount to the leadership and competitiveness of 
        the United States in the global digital economy.
            (5) It is the policy of the United States to encourage 
        innovation in the development and use of the Internet of Things 
        and empower consumers to be responsible digital citizens and 
        manage the security of their devices in collaboration with 
        manufacturers, sellers, and service providers.

SEC. 3. FEDERAL EDUCATIONAL CYBERSECURITY RESOURCES FOR CONSUMERS 
              REGARDING DEVICES THAT ARE PART OF THE INTERNET OF 
              THINGS.

    (a) Definitions.--In this section--
            (1) Covered device.--The term ``covered device''--
                    (A) includes devices, applications, and physical 
                objects that are--
                            (i) part of the Internet of Things; and
                            (ii) marketed and sold primarily to 
                        consumers; and
                    (B) does not include--
                            (i) devices that are marketed and sold for 
                        use primarily in industrial, business, or 
                        enterprise settings; or
                            (ii) smartphones, tablets, personal 
                        computers, or devices leased to consumers by 
                        multichannel video programming distributors.
            (2) Cybersecurity threat.--The term ``cybersecurity 
        threat'' has the meaning given to the term in section 102 of 
        the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 
        1501).
            (3) Security vulnerability.--The term ``security 
        vulnerability'' has the meaning given to the term in section 
        102 of the Cybersecurity Information Sharing Act of 2015 (6 
        U.S.C. 1501).
    (b) Development of Educational Cybersecurity Resources.--Not later 
than 1 year after the date of enactment of this Act, the Federal Trade 
Commission shall, in coordination with the National Institute of 
Standards and Technology and relevant private sector stakeholders and 
experts, develop voluntary educational cybersecurity resources for 
consumers relating to the practices of consumers with respect to the 
protection and use of covered devices, including citing evidence of 
consumer attitudes and expectations.
    (c) Elements.--The voluntary resources developed under subsection 
(b) shall be technology-neutral and include guidance, best practices, 
and advice for consumers to protect against, mitigate, and recover from 
cybersecurity threats or security vulnerabilities, where technically 
feasible, including--
            (1) the scope of possible security support from a vendor 
        post-purchase;
            (2) how to initiate or set up a covered device for use;
            (3) the use of passwords, available security tools and 
        settings, appropriate physical controls, and avoidance of steps 
        that can defeat security;
            (4) updates to the software of a covered device during 
        operation or use if applicable;
            (5) the recovery of compromised devices;
            (6) end-of-life considerations such as resetting, deleting, 
        or modifying data collected or retained by a covered device 
        when it is no longer in use or expected to be used by the 
        consumer;
            (7) security services, tools, or platforms for connected 
        devices that may help consumers manage connected devices; and
            (8) varying security considerations depending on factors, 
        including the type of device and setting of use.
    (d) Availability and Publication.--The Federal Trade Commission 
shall ensure that the resources developed under subsection (b) are 
available to and readily accessible by the public on the Internet 
website of the Federal Trade Commission.
    (e) Periodic Updates.--The Federal Trade Commission shall review, 
and, as necessary update the resources developed under subsection (b), 
in collaboration with industry stakeholders, to address changes in 
cybersecurity threats or security vulnerabilities and other technology 
developments or challenges.
    (f) Voluntary Use.--The resources developed under subsection (b) 
shall be for voluntary use by consumers.
    (g) Treatment.--No guidelines, best practices, or advice issued by 
the Federal Trade Commission with respect to the resources developed 
under subsection (b) shall confer any right on any person, State, or 
locality, nor shall operate to bind the Federal Trade Commission or any 
person to the approach recommended in such guidance, best practice, or 
advice. The Federal Trade Commission may not base an enforcement action 
on, or execute a consent order based on, any failure to promote or use 
such guidance, or any practice used for covered device functionality 
that is alleged to be inconsistent with any guidance, best practice, or 
advice included in the resources developed under subsection (b), unless 
the practice allegedly violates another provision of law. Nothing in 
this Act is intended to limit the ability of the Federal Trade 
Commission to enforce section 5 of the Federal Trade Commission Act (15 
U.S.C. 45).

Summary: Internet of Things Consumer Tips to Improve Personal Security Act of 2017 or the IOT Consumer TIPS Act of 2017 This bill requires the Federal Trade Commission (FTC)&nbsp;in coordination with the National Institute of Standards and Technology and relevant private sector stakeholders and experts&nbsp;to develop voluntary educational cybersecurity resources for consumers relating to the&nbsp;protection and use of the Internet of Things (devices, applications, and physical objects that are Internet-enabled, networked, or connected). The resources must be technology-neutral and include guidance, best practices, and advice for consumers to protect against, mitigate, and recover from cybersecurity threats or security vulnerabilities. The resources do not bind the FTC to any particular guidance, best practice, or advice. The FTC may not base an enforcement action on any failure to promote or use such guidance, best practice, or advice unless such practice violates another provision of law.