UL and similar agencies already check that plugging a device into your electrical system doesn't set something on fire. They have simple, yet strict standards that must be applied.

Likewise the FCC is very particular about radio emissions and will outright reject your product if it's too noisy.

We absolutely need something that can handle obvious problems like this, plus a way of coordinating with the vendors of these products should a vulnerability emerge that requires a patch or a recall.

> Likewise the FCC is very particular about radio emissions and will outright reject your product if it's too noisy.

That's only really recently true--just ask a ham radio guy about the noise floor if you want an earful. The FCC was pretty lax about this until this year when they finally quit accepting cross-certification from emissions labs from countries like China.

That's a slippery slope argument. I know regulating tech is not going to be popular here, and maybe we leave it for corporations that are valued at over a certain amount, but right now foreign governments are hacking our financial services companies, communications companies, phones, laptops, everything. 95% of the time a it's an extremely easy hack that would have been discovered by a routine scan.

There's an important distinction between "regulating" as in setting prices, and "regulating" as in setting the rules of the competitive marketplace.

For example: You can't sell phones that explode. You can sell phones that are cheaper than the competition.

Maybe IoT manufacturers or even the consumers owning the things should be liable for damages if their products participate in a DDOS. "Underwriters" labs proves you built your product to some standard, and that presumably makes you insurable because you have a first line of defense against a lawsuit.

But as opposed to EMC standards, software vulnerabilities arise periodically and standards need to be continually updated. Would devices need to be audited periodically to maintain certification?