Q&A with O'Melveny's Steve Bunnell: What's the Real IoT Risks Today?
'I think there is a growing sensitivity among the Googles and Facebooks of the world. But I don't know if the people who make refrigerators are that concerned,' says O'Melveny partner Steven Bunnell on the cybersecurity of the internet of things.
January 11, 2019 at 01:00 AM
5 minute read
The original version of this story was published on Corporate Counsel
The internet of things is a term used for everything from cars to refrigerators that consumers can put their personal data into and connect to the internet. With more products connecting to the internet comes more issues for cybersecurity experts and data privacy attorneys.
Steven Bunnell, a partner in O'Melveny & Myers' Washington, D.C., office and the former general counsel of the Department of Homeland Security, spoke to Corporate Counsel about data privacy as it relates to the internet of things and types of litigation manufacturers could face as more household products are able to connect to the internet. This conversation has been edited for brevity and clarity.
Corporate Counsel: Are the data privacy implications something that in-house attorneys for companies that create “smart” products are thinking about?
Steve Bunnell: The privacy landscape is rapidly evolving with technology. Any one of these devices taken alone may not seem like a major intrusion into one's private realms. When you aggregate it all together, there is a pattern of life that can emerge and feel very “Big Brother-y.” I think there is a growing sensitivity among the Googles and Facebooks of the world. But I don't know if the people who make refrigerators are that concerned. I think the popular feeling is that the collection and use of this data is going to evolve.
CC: With these “smart” products, should companies be worried about class action or other kinds of litigation if customers' data is hacked into?
SB: I'm not aware of any traditional class action involving these products. That doesn't mean there hasn't been some. There are a lot of issues that need to get sorted out in terms of the standing or injury-related issues. How concrete does the privacy harm need to be before it becomes legally actionable? Is it just the potential that your personal information is out there and someone could misuse it, or do you have to show that it has been misused? Related to that is a causation question. If there is some misuse, how do you know it came from that particular breach as opposed to another breach?
Those issues are out there generally. I think in the internet of things context they're even harder because the causation issues are more complicated and the audit trail that is left behind with these devices tends to be minimal. I think those cases may be a little bit further down the road in terms of the traditional privacy class action suits.
CC: What kind of suits do you think are more immediate with products like these?
SB: I think what is perhaps a little more immediate are internet of things issues that result in physical harm. The harm isn't that your personally identifiable information has been breached; for example, it's that the hospital emergency room has been shut down by an attack launched by a bunch of “smart” baby monitors that were hacked and were used to send messages to the hospital's computer all at the same time. Then a ransomware demand is made to the hospital. That is the kind of case that I would expect to see at some point in the near future. The internet of things is also the internet of potential physical harms. The stakes are now much higher for cyberattacks in this realm.
CC: Do you think that companies that create these products need to begin taking a more serious look at cybersecurity in those products?
SB: Absolutely. But how that is going to happen I think is the real question. Historically, these are not expensive devices. They're little computers in a sense, and they're very cheap. So there is no capacity to patch them or upgrade them the way you would a normal network. One of the real challenges is software patching once these items are out in the marketplace. I think there has been a lot of encouragement from the government and consumer groups to build security in the front end. That will increase the price of them.
The other challenge around them is that a lot of these devices are not produced in the U.S. DHS put out a report that is a reflection of this kind of nudging approach that the federal government has taken in this space. I think the effect of that over time is that it has a way of shaping the standard of care. Right now, the law in this space is kind of a reasonableness standard. What that means in practice is something that a judge or regulator has to figure out.
That's a common-law process as much as a dictated process, and I think it's sort of frustrating for companies because they don't have clear guidance on what is required of them. I think insurance companies will play an important role in this space. Using the incentive of perhaps lower premiums or the stick of refusing to offer coverage, insurance companies can shape cybersecurity practices in this area.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTrending Stories
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250