Which government? The US government, which is the representative body for the affected victims? The Chinese government, which is the representative body for the manufacturer? The different governments of the countries where the actual devices were in use and where the actual traffic came from?

Right now it's considered a tour-de-force of international cooperation when police agencies from two different countries can cooperate enough to arrest scammers who were pretending to be IRS agents over the phone and were doing real damage to peoples' lives. (http://arstechnica.com/tech-policy/2016/10/cops-arrest-hundr...)

Unfortunately, the U.S seems to have this completely unhealthy obsession with keeping the government impotent and companies powerful at the expense of the people. And not just the american people, but the entire world.

Americans understand that even well-intentioned laws and regulations can ultimately be used against citizens and consumers through regulatory-capture. These are all rules being set by democratic states, yes, but dilution-of-interest is a real thing and very few people vote for a president or prime minister based on their telecommunications policy.

I would rather the government just butts-out unless peoples' lives are at risk.

Do it the same way you handle contaminated food, appliances that cause fire and sales of illegal goods. Fine/jail the locals selling dangerous crap, and leverage international law to move against the people who manufacture it. There need to be safety and security standards developed, just as they are for almost everything else you buy.

Were any of these being sold in the US?

and leverage international law to move against the people who manufacture it.

International law really doesn't work the way you think it does. International law, that most diaphanous of concepts and most nebulous of efforts, is just barely effective enough to prevent the sale of materials used in the manufacture of nuclear weapons. $30 IoT routers that can be used to attack silicon valley internet companies isn't on anyone's radar.

And what does move against mean? Fines? Jail time? How long will it take to convince anyone to agree to that? Would anyone even agree on a dollar figure for damages? What was damaged here? Was any equipment broken? Was anyone killed?

There need to be safety and security standards developed, just as they are for almost everything else you buy

This makes sense, but I think it's a long road. Safety standards are imposed and enforced at a national, not an international level, except to harmonize regulations (not unify enforcement!) in some cases. And packets don't respect national boundaries.

I don't think regulation is tractable in this case. I think all we've got is technical solutions or 'internet governance', much like how everyone knows not to allow open mail servers on their networks anymore.

That's simply untrue. The European Union and its predecessors have for decennia regulated safety standards of products on an international level.

The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there.

Untrue?

Let me know when the United States and China have joined the European Union.

The entire framework that would be required for regulating security standards on electronic equipment is already in place. It already operates on a global scale. Try looking at some of the packages (or stickers on larger electronics) and look for the CE mark. That's the Conformité Européenne stamp of approval. We can easily include security in there.

That's absolutely crazy.

CE can regulate electrical and physical safety because Frenchmen die from roughly the same electrical voltages as Englishmen. There's just not much argument about this, and it doesn't apply to goods not sold in the EU anyways.

Who really agrees about computer security? Really? An open telnet port is BAD. What about an ssh port using a shared key that doesn't require a password reset? What if the network stack hasn't been audited? What about a web interface? Is that secure?

Computer security is so much more complicated and so much more nebulous than electrocuting Frenchmen. And you want to hammer out standards for this at the UN or the OECD or some other body that interfaces to national police? That's insane and it's going to turn into some horrible OSI-esque regulatory Frankenstein monster.

There is no international, let alone global "police" checking these products' conformity before they enter the market. In different countries, there are local authorities who might make random inspections, potentially exposing a fraction of the products that do not actually meet the regulations.

So yeah, CE may be a self-certification stamp, but if you put one on your product, you open yourself for legal actions if your product doesn't conform to the appropriate standards. Extending this to cover networking safety aspects of devices is the minimum I hope regulators will do.

Still, don't worry about it, global ISP market is huge and very competitive, it's in their best interest to solve the problem, once it becomes one. We've been there before with "big and scary" ddoses from five years ago.

Out of curiosity, imagine I decided to do a Linux based IOT device today. What liberally licensed reasonably mature security and updater framework would I use?

I can find numerous competing communication frameworks, but nothing around doing updates or the higher level platform. It looks like this has to be re-invented by each IOT vendor, which is going to be a lot of work.

Heck even just trying to do SSL on a LAN is very difficult - https://news.ycombinator.com/item?id=11956088

[Edit] perhaps I should add that if any regulation is deployed in this space, its that an IoT device manufacturer must release their source in a publicly accessible manner... end users must be able to patch beyond the support lifetime.. etc.

That's the kind of thing that gives regulation a bad name.

One of the worst ways an IoT device can get hacked is if it's reflashed with malicious firmware that then can't be reflashed back. You've got a permanent backdoor that requires trashing the device and a lot of users won't throw away a device that still works (for them) even if they know it's infected with something that causes problems (for someone else). That's real money.

A simple way to fix that is locked bootloaders that only runs signed code. Then even if the running image gets hacked, a reboot fixes it and at least the device can't be irreversibly hacked.

A regulation like the one you propose would presumably make signature-locked firmware illegal, or at best, require the checks to be disabled after a certain date (which then requires secure clocks: more stuff to go wrong). It's the sort of thing that sounds good but can cause more problems than it solves, which is the typical problem of regulation.

Unfortunately, my neighbour did, and now his toaster is used as part of a DDOS attack against a critical piece of internet infrastructure.

How does your solution help?

Or, how about instead of drowning in lawsuit chains over pennies, we establish some basic rules about how commercial devices connected to the internet are allowed to behave.

That's how this problem is solved by every other industry that manufactures devices that are dangerous when used correctly. Software isn't a special snowflake.

We could help that right away, by bricking all the vulnerable IoT devices. The media will then inform of what manufacturers and models were affected :D