THE INTERSECTION OF PRODUCT LIABILITY LAW AND THE INTERNET OF THINGS LUCAS M. AMODIO INTRODUCTION ........................................................................................................ 1 I. THE INTERNET OF THINGS .................................................................................... 3 II. ISSUES WITH DATA BREACHES ........................................................................... 6 III. PRODUCT LIABILITY LAW OVERVIEW ............................................................... 8 A. TYPES OF PRODUCT LIABILITY .................................................................................... 8 B. THEORIES OF LIABILITY ............................................................................................. 10 C. LIABLE ENTITIES ....................................................................................................... 11 IV. THE INTERSECTION ......................................................................................... 12 V. THE FEDERAL TRADE COMMISSION ................................................................. 18 VI. PROPOSED GUIDELINES .................................................................................... 21 CONCLUSION .......................................................................................................... 24 2021] The Intersection of Product Liability Law and The Internet of Things 1 THE INTERSECTION OF PRODUCT LIABILITY LAW AND THE INTERNET OF THINGS LUCAS M. AMODIO* Abstract: Every year, an increasing number of Internet of Things devices are released. These devices can make our lives easier, but they also make our data, and potentially ourselves, more vulnerable to hackers. The question is no longer theoretical, as many of these devices can have a real impact on the world around them, like a networked sprinkler system that, if hacked, could flood a target’s basement. Going forward, we can look to the current law of product liability and the Federal Trade Commission to protect individuals from harm and loss when these devices might be compromised. INTRODUCTION As data breaches involving millions of stolen records become an everyday occurrence, it raises new issues as hackers can access real world devices and physically harm people and property. New devices come out every day which connect to the Internet, affect the real world, and elevate users’ convenience.1 Known as the Internet of Things (IoT), these devices communicate with each other, enabling networks of shared data and improving user experience.2 Want to double check a diaper without having to smell it? Internet connected diapers can tell parents when to change the diaper and how the baby is sleeping.3 Want to give a delivery person one-time access to the garage to drop off a package? With a smart garage door opener, a user can check the current status of the door (open or closed), create a one-time use code for a delivery person to use, and even check every time that the garage door opens.4 Concerned about the COVID-19 virus? Wear a face mask that includes sensors that test the moisture you expel for the __________________________________________________________________ * Patent Attorney, Armstrong Teasdale LLP, C|EH Certified Ethical Hacker, J.D. 2013, Indiana University Maurer School of Law; M.B.A. 2005, Indiana University; M.S., Applied Computer Science 2001, Purdue University; B.S. Computer Engineering, Rose-Hulman Institute of Technology, 1997. Special thanks to Patrick Rasche and Monica Kriegel at Armstrong Teasdale and to my wife, Miriam Cherry, and our three dogs, Plato, Socrates, and Schopenhauer, for their support. 1 10 Powerful Internet of Things (IoT) Examples of 2020 (Real-World Apps), SOFTWARE TESTING HELP, (Nov. 13, 2020), https://www.softwaretestinghelp.com/best-iot-examples/. 2 Matt Burgess, What Is the Internet of Things? WIRED Explains, WIRED (Feb. 16, 2018), https://www.wired.co.uk/article/internet-of-things-what-is-explained-iot. 3 Samantha Murphy Kelly, Pampers Is Making a ‘Smart’ Diaper. Yes, Really, CNN BUS. (July 19, 2019), https://www.cnn.com/2019/07/19/tech/pampers-smart-diapers/index.html. 4 Trevor Harwood, Best WiFi and Bluetooth Smart Garage Door Openers, SMART HOME SCOUT, https://www.postscapes.com/wifi-garage-door-opener/ (last visited Nov. 11, 2020). 2 Boston College Intellectual Property & Technology Forum [BC IPTF virus.5 Heading home and want to warm up or cool off the house for arrival? Access the house’s remote control thermostat to change the temperature of the house.6 Users can even remotely start a cozy fire in the fireplace.7 Want to take the perfect shower? An internet connected shower can set the temperature, monitor the water usage, and even remotely shut the shower off.8 Want to check on Fido to make sure he is not on the couch? Activate a pet camera that will allow the user to hear and speak to the dog, as well as dispense treats for good behavior.9 The purpose of all these devices is to “enrich the customer experience” and to provide their manufacturers insight into the users, ultimately providing an edge over competing products.10 Although these products can help users control and manage their lives, these devices may also provide a pathway for bad actors, hackers, to access users’ homes and negatively impact their lives. For example, if a hacker is able to control a house’s thermostat, the hacker can turn the heat off in the winter, potentially freezing pipes and causing significant water damage. Or the hacker could remotely turn on a sprinkler system for days, potentially flooding the yard, and perhaps even neighboring basements. There are also IoT devices outside of the home that can cause physical damage. A lead hacking story of 2015 involved two hackers who demonstrated how to compromise an automobile while it was on the road.11 Turning off a driver’s brakes and causing them to crash could hurt people and cause major property damage. For example, if a hacker takes remote control of a vehicle and rams the vehicle into a china shop, who is responsible for the damage to the china shop? The damage to the vehicle? The damage to the driver and/or the passengers? Or even a bystander who was hurt? __________________________________________________________________ 5 Susan Biagi, Sensors that Detect COVID-19 Could Be in Your Next Face Mask, IOT INTEGRATOR (July 29, 2020), https://www.theiotintegrator.com/health/sensors-that-detect-covid- 19-could-be-in-your-next-face-mask. 6 Megan Wollerton, The Best Smart Thermostat of the Year, CNET (Nov. 23, 2020), https://www.cnet.com/news/best-smart-thermostat-of-the-year/. 7 Creating a Smart Fireplace Switch with a Shelly Relay, HOMETECHHACKER (Nov. 14, 2019), https://hometechhacker.com/creating-a-smart-fireplace-switch-with-a-shelly-relay/. 8 Andy Crabtree et al., Probing IoT-Based Consumer Services: ‘Insights’ from the Connected Shower, 24 PERS. & UBIQUITOUS COMPUTING 595, 598 (2020); see also Eric Blank, Would You Shower with Alexa? These Smart Showers Can Make It Happen, THESMARTCAVE.COM, https://thesmartcave.com/best-smart-shower/ (last visited Nov. 20, 2020) (discussing benefits of internet connected showers such as allowing users to calibrate “their preferred water temperature, outlet, flow rate, shower duration, and much more”). 9 Furbo Dog Camera, FURBO, https://shopus.furbo.com/ (last visited Nov. 11, 2020). 10 Tom Raftery, How to Enrich the Customer Experience Using Internet of Things, FORBES (Dec. 21, 2017), https://www.forbes.com/sites/sap/2017/12/21/how-to-enrich-the-customer-experience- using-internet-of-things/#1e16a8705bb0. 11 Andy Greenberg, Hackers Remotely Kill a Jeep on the Highway —with Me in It, WIRED (July 21, 2015), https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/; see generally CHARLIE MILLER & CHRIS VALASEK, REMOTE EXPLOITATION OF AN UNALTERED PASSENGER VEHICLE (2015), http://illmatics.com/Remote%20Car%20Hacking.pdf. 2021] The Intersection of Product Liability Law and The Internet of Things 3 Courts have encountered difficulties determining damages in data breacH cases where private information was stolen.12 Nevertheless, in the case where a house is flooded or a car is crashed into a store, the damages will be more quantifiable. Although technology is generally several years, or even decades ahead of the law, there is an area of law, where the path to the courthouse is well worn and where rules are already in place, that may apply in these situations: product liability law. This area of law may provide a way for victims of physical IoT damage to recover more easily than those that suffer data breaches. To explore this argument further, Part I of this Article discusses the IoT, and the physical damage that hackers could do if they gained control over remotely controlled devices, say, in a user’s home.13 Part II explains how the law surrounding data breaches has not developed in a way that is helpful to parsing these disputes, mostly because the victims of data breaches are unable to show how, precisely, they were damaged in ways that can be recognized by the law.14 Part III provides an overview of product liability law.15 Part IV notes how plaintiffs will naturally turn to product liability law to provide them with a path to recovery. It further describes potential causes of action and notes the instances where a negligence standard would be helpful due to the evolving state of technology.16 Then, Part V discusses recent developments at the Federal Trade Commission to ascertain best practices for security and the IoT.17