The reverse cascade: Enforcing security on the global IoT supply chain

atlantic council logo

The Internet of Things (IoT) refers to the increasing convergence of the physical and digital worlds. Hundreds of “things” are being connected to the Internet and each other, with more than fifty billion devices expected to be connected by 2030. These devices vary from Internet-connected power-generation equipment to wearable health trackers and smart home appliances, and generally offer some combination of new functionality, greater convenience, or cost savings to users.

Enter the reverse cascade. This paper proposes a policy tool premised on strategic upward pressure applied to information and communications technology (ICT) product supply chains, using domestic distributors as a point of leverage to enforce standards on foreign-based manufacturers. This section develops a detailed case study of how this reverse cascade would apply to home Wi-Fi routers. 

The FTC and other domestic regulators should recognize and exploit the fact that while supply chains are global, they often terminate with a domestic distributor. The reverse cascade starts with applying regulatory pressure on the distributor to sell products that adhere to a specified set of design and manufacturing standards. In a competitive market like home routers, where multiple vendors compete in the same product segments, a small number of compliant vendors could threaten others’ market access through distributors in the same jurisdiction. This creates subsequent pressure from vendors up their own supply chain for hardware components and software. 

The reverse cascade’s essential components are a regulator’s jurisdiction over a domestic distributor and a source of security standards. The home Wi-Fi router is a particularly useful example because its IoT security impacts the security of all other devices connected to it. Home routers are also representative of other consumer IoT products; routers are mostly inexpensive consumer-electronics products largely built offshore by a plethora of foreign manufacturers.

June 25th, 2020