I think that the use of an escrow service would be an excellent idea. There's some complexity to deal with in order to make this fair for both companies and consumers, but I think that these difficulties are surmountable.
An open source firmware model doesn't always make sense for businesses, but I think that for most hardware-oriented businesses, it makes perfect sense. There are plenty of business models in which the hardware itself is deeply discounted or even sold at a loss in order to sell the overall service -- the IoT portion. Right, wrong, or indifferent, that is a model that many businesses pursue. If their business model makes sense in the marketplace, I think that's fine. Plenty of consumers choose proprietary and service-oriented systems -- e.g. Apple's closed ecosystem -- and that's fine as long as the consumer safety and security is prioritized. However, I think that regulation should ensure that the right for consumers to maintain their devices should fall back to the consumers if or when these companies fail.
That being said, I think that consumers should always have a right to root their devices. If consumers decide that the iPhone or IoT light switch that they purchased does not meet their needs, there is no reason why they shouldn't be allowed to flash any firmware they want on it. In the case that hardware is sold at a loss, there should be an up-front contract with a buy-out clause, which also should be regulated to ensure that the company charges a reasonable and non-discriminatory "regular fee" for hardware independent of contracts, much like how many cellular carriers work. If the consumer chooses to "buy out" this contract in order to root their device, then that should be allowed if they pay the pro-rated "regular fee", adjusted for the amount of time they have paid into the contract.
I've considered governance models that can exist beyond the lifetime of a company that would guarantee escrow access to source code. Pitching this to a company is of course quite difficult, since no company thinks that far ahead, and many in leadership refuse to consider what happens if and when their venture fails. I think that the only way to build such a governance model is to provide an open source framework for managing both builds and OTAs that can ensure this. Escrow as a service could be built into this, using one of various cryptographic election strategies for recovering key details if an organization goes dark.
Either way, having the FCC seriously consider the security of IoT devices is a great first step, as long as it is a step and not a hurdle for innovation.
An open source firmware model doesn't always make sense for businesses, but I think that for most hardware-oriented businesses, it makes perfect sense. There are plenty of business models in which the hardware itself is deeply discounted or even sold at a loss in order to sell the overall service -- the IoT portion. Right, wrong, or indifferent, that is a model that many businesses pursue. If their business model makes sense in the marketplace, I think that's fine. Plenty of consumers choose proprietary and service-oriented systems -- e.g. Apple's closed ecosystem -- and that's fine as long as the consumer safety and security is prioritized. However, I think that regulation should ensure that the right for consumers to maintain their devices should fall back to the consumers if or when these companies fail.
That being said, I think that consumers should always have a right to root their devices. If consumers decide that the iPhone or IoT light switch that they purchased does not meet their needs, there is no reason why they shouldn't be allowed to flash any firmware they want on it. In the case that hardware is sold at a loss, there should be an up-front contract with a buy-out clause, which also should be regulated to ensure that the company charges a reasonable and non-discriminatory "regular fee" for hardware independent of contracts, much like how many cellular carriers work. If the consumer chooses to "buy out" this contract in order to root their device, then that should be allowed if they pay the pro-rated "regular fee", adjusted for the amount of time they have paid into the contract.
I've considered governance models that can exist beyond the lifetime of a company that would guarantee escrow access to source code. Pitching this to a company is of course quite difficult, since no company thinks that far ahead, and many in leadership refuse to consider what happens if and when their venture fails. I think that the only way to build such a governance model is to provide an open source framework for managing both builds and OTAs that can ensure this. Escrow as a service could be built into this, using one of various cryptographic election strategies for recovering key details if an organization goes dark.
Either way, having the FCC seriously consider the security of IoT devices is a great first step, as long as it is a step and not a hurdle for innovation.