Maryland HB 888: Consumer Protection - Security Features for Connected Devices

Bill Text

EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.
*hb0888*

HOUSE BILL 888
I3 0lr1973
CF SB 443
By: Delegates Carey and C. Watson
Introduced and read first time: February 3, 2020
Assigned to: Economic Matters

A BILL ENTITLED

AN ACT concerning 1

Consumer Protection – Security Features for Connected Devices 2

FOR the purpose of requiring the manufacturer of a connected device to equip the device 3
with a certain reasonable security feature; providing that a security feature for a 4
connected device is reasonable if the connected device is equipped with a certain 5
means for authentication; providing that a violation of this Act is an unfair, abusive, 6
or deceptive trade practice within the meaning of the Maryland Consumer Protection 7
Act and is subject to certain enforcement and penalty provisions; providing for the 8
construction of certain provisions of this Act; defining certain terms; providing for a 9
delayed effective date; and generally relating to security features for connected 10
devices. 11

BY renumbering 12
Article – Commercial Law 13
Section 13–301(14)(xxiii) through (xxxiii), respectively 14
to be Section 13–301(14)(xxiv) through (xxxiv), respectively 15
Annotated Code of Maryland 16
(2013 Replacement Volume and 2019 Supplement) 17

BY adding to 18
Article – Commercial Law 19
Section 13–301(14)(xxiii) 20
Annotated Code of Maryland 21
(2013 Replacement Volume and 2019 Supplement) 22

BY adding to 23
Article – Commercial Law 24
Section 14–4201 through 14–4204 to be under the new subtitle “Subtitle 42. Security 25
Features for Connected Devices” 26
Annotated Code of Maryland 27
(2013 Replacement Volume and 2019 Supplement) 28

2 HOUSE BILL 888

SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 1
That Section(s) 13–301(14)(xxiii) through (xxxiii), respectively, of Article – Commercial 2
Law of the Annotated Code of Maryland be renumbered to be Section(s) 13–301(14)(xxiv) 3
through (xxxiv), respectively. 4

SECTION 2. AND BE IT FURTHER ENACTED, That the Laws of Maryland read 5
as follows: 6

Article – Commercial Law 7

13–301. 8

Unfair, abusive, or deceptive trade practices include any: 9

(14) Violation of a provision of: 10

(XXIII) TITLE 14, SUBTITLE 42 OF THIS ARTICLE, SECURITY 11
FEATURES FOR CONNECTED DEVICES; 12

SUBTITLE 42. SECURITY FEATURES FOR CONNECTED DEVICES. 13

14–4201. 14

(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 15
INDICATED. 16

(B) “AUTHENTICATION” MEANS A METHOD OF VERIFYING THE AUTHORITY 17
OF A USER, PROCESS, OR CONNECTED DEVICE TO OBTAIN ACCESS TO RESOURCES 18
THROUGH AN INFORMATION SYSTEM. 19

(C) “CONNECTED DEVICE” MEANS A PHYSICAL OBJECT THAT IS: 20

(1) CAPABLE OF CONNECTING TO THE INTERNET, DIRECTLY OR 21
INDIRECTLY; AND 22

(2) ASSIGNED AN INTERNET PROTOCOL ADDRESS OR A BLUETOOTH 23
ADDRESS. 24

(D) (1) “MANUFACTURER” MEANS A PERSON WHO: 25

(I) MANUFACTURES OR ASSEMBLES A NEW CONNECTED 26
DEVICE FOR SALE OR DISTRIBUTION; OR 27

(II) CONTRACTS WITH ANOTHER PERSON TO MANUFACTURE OR 28

HOUSE BILL 888 3

ASSEMBLE A CONNECTED DEVICE ON THAT PERSON’S BEHALF. 1

(2) “MANUFACTURER” DOES NOT INCLUDE A PERSON WHO 2
CONTRACTS WITH ANOTHER PERSON TO PURCHASE AND BRAND A CONNECTED 3
DEVICE. 4

(E) “SECURITY FEATURE” MEANS AN ATTRIBUTE OF HARDWARE, 5
FIRMWARE, SOFTWARE, PROCESS, PROCEDURE, OR A COMBINATION OF THESE 6
FACTORS THAT COULD PREVENT OR LESSEN THE LIKELIHOOD OF FAILURE OR 7
COMPROMISE OF THE CONFIDENTIALITY, INTEGRITY, OR ACCESSIBILITY OF A 8
CONNECTED DEVICE OR INFORMATION STORED WITHIN A CONNECTED DEVICE. 9

(F) “UNAUTHORIZED ACCESS” MEANS ANY USE, MODIFICATION, 10
DISCLOSURE, OR DESTRUCTION OF ANY INFORMATION STORED WITHIN A 11
CONNECTED DEVICE THAT IS NOT AUTHORIZED BY THE OWNER OF THE CONNECTED 12
DEVICE. 13

14–4202. 14

THIS SUBTITLE MAY NOT BE CONSTRUED TO IMPOSE ANY DUTY ON: 15

(1) A MANUFACTURER OF A CONNECTED DEVICE FOR AN 16
UNAUTHORIZED ACCESS THAT ARISES FROM AN UNAFFILIATED THIRD–PARTY 17
APPLICATION OR SOFTWARE THAT A USER ADDS TO A CONNECTED DEVICE; 18

(2) A MANUFACTURER TO PREVENT A USER FROM HAVING FULL 19
CONTROL OVER A CONNECTED DEVICE, INCLUDING BY ALLOWING A USER TO 20
MODIFY THE SOFTWARE OR FIRMWARE RUNNING ON THE CONNECTED DEVICE; OR 21

(3) THE OPERATOR OF AN ELECTRONIC STORE, AN ELECTRONIC 22
MARKETPLACE, OR ANY OTHER MEANS OF PURCHASING OR DOWNLOADING 23
SOFTWARE OR APPLICATIONS TO ENFORCE COMPLIANCE WITH THIS SUBTITLE. 24

14–4203. 25

(A) A MANUFACTURER OF A CONNECTED DEVICE SHALL EQUIP THE DEVICE 26
WITH A REASONABLE SECURITY FEATURE THAT IS: 27

(1) APPROPRIATE TO THE NATURE AND FUNCTION OF THE 28
CONNECTED DEVICE; 29

(2) APPROPRIATE TO THE INFORMATION THE CONNECTED DEVICE 30
COLLECTS, CONTAINS, OR TRANSMITS; AND 31

4 HOUSE BILL 888

(3) DESIGNED TO PROTECT THE CONNECTED DEVICE FROM 1
UNAUTHORIZED ACCESS, DESTRUCTION, OR MODIFICATION. 2

(B) A CONNECTED DEVICE HAS A REASONABLE SECURITY FEATURE FOR 3
THE PURPOSE OF THIS SUBTITLE IF: 4

(