Internet Safety Strategy Announced
A green paper has been launched by the government to help shape the strategies in the UK around internet safety.
Manufacturers could face being forced to recall non-compliant products and could also be fined.
The government is now seeking feedback from consumer groups and industry experts to shape its final legislation.
One expert said the new rules would need "strong enforcement".
The "call for views" is the latest step to introduce a cyber-security bill, which was first outlined in May 2019.
Other proposals include a requirement that manufacturers state the minimum amount of time they will continue to provide security updates for a product after purchase.
Hijacked gear
Millions of so-called "internet-of things" (IoT) devices are already in use in the UK, ranging from smart speakers and thermostats to security cameras and televisions.
But the government is concerned that the brands behind these products sometimes pre-load them with one of a few dozen common passwords, which are not subsequently reset by the owners.
As a consequence, cyber-attackers can easily break in and steal personal data, spy on users and even remotely take control of the products.
In some cases, this involves hijacking the devices to stage follow-up attacks, as part of what is known as a "botnet".
In 2016, the Mirai botnet, made up of hundreds of thousands of hacked internet-of-things products, flooded targets with data, causing Reddit, Spotify and Twitter among other services to go offline.
The new rules propose financial penalties for businesses that fail to abide by the rules. Courts would also be able to order that their products be confiscated or destroyed.
It is suggested that manufacturers would be banned from allowing users to reset their devices back to an easy-to-guess "universal factory setting".
Device makers would also have to tell the public how to contact them to report a security vulnerability.
If required, the authorities could order a temporary sales ban while an issue was being investigated and fixed, or permanently pull items from stores if they deem it necessary.
A government spokesman said the law would apply UK-wide and could be enforced as early as 2021 or 2022, but this will depend on how soon it is given parliamentary scrutiny.
https://www.bbc.co.uk/news/technology-53421658?intlink_from_url=https://www.bbc.co.uk/news/topics/cz4pr2gd85qt/cyber-security&link_location=live-reporting-story
