FCC Loses Lead Support for Biden-Era IoT Security Labeling

The chief administrator of the Federal Communications Commission’s flagship consumer cybersecurity labeling initiative has formally withdrawn from the role, raising questions about the future of the Biden-era program aimed at helping Americans identify secure smart devices. The departure comes after internal security reviews raised concerns over foreign influence in program management.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

UL Solutions notified the FCC in late December that it was stepping down as lead administrator of the U.S. Cyber Trust Mark program, effective immediately, after completing what it described as foundational work supporting the initiative. Chanté Maurio, vice president and general manager of identity management and security at UL Solutions, said in a letter that the organization was honored to “support the FCC’s goals of prioritizing cybersecurity in consumer IoT products and protecting American consumer safety.” Maurio said UL is committed to supporting the FCC’s efforts “to deliver a voluntary labeling program that advances IoT security and consumer safety.”

In its withdrawal letter to the agency’s public safety bureau, UL said that it had convened stakeholders, helped develop technical and governance recommendations and supported early program design before determining it was time to exit. The move leaves the FCC without a clear entity responsible for overseeing the day-to-day administration of the voluntary labeling program, which was launched roughly a year ago to bring greater transparency and accountability to the consumer internet of things market (see: White House Launches US Cyber Trust Mark for IoT Devices).

UL framed the move as a natural transition point, but the timing has drawn attention inside Washington just months after leadership launched an internal national security review of the entities involved in administering the labeling effort. The review, ordered last summer under FCC Chairman Brendan Carr, examined whether organizations with overseas operations posed potential risks to the integrity of a program meant to certify the cybersecurity of consumer devices sold in the U.S.

The Cyber Trust Mark program was developed during the Biden administration as a consumer-facing response to longstanding concerns that smart home devices often ship with minimal security protections and little accountability once vulnerabilities are discovered. The previous administration said at the time that the program was launched in response to Americans “worried about the rise of criminals remotely hacking into home security systems to unlock doors or malicious attackers tapping into insecure home cameras to illicitly record conversations.”

The FCC tasked UL Solutions with identifying and developing “IoT-specific standards and testing procedures for the program, among other recommendations, and for acting as liaison between the Commission and CLAs.”

It remains unclear whether the FCC plans to appoint a new lead administrator. The White House and UL Solutions did not immediately respond to requests for comment.