Issued management: Smart home gadgets will need to be registered
The authorities plan to collect information about smart home gadgets. Their installation addresses, phone numbers linked to them, and other information for identifying the owners will be entered into the Unified Identification and Authentication System (USIA). The relevant measures are provided for by the anti-fraud bill "Anti-fraud 3.0". Accounting for gadgets will prevent the use of phone numbers allocated for smart meters and other systems in fraudulent phone calls, the Ministry of Finance notes. However, registration and re-registration of such devices for end users can be fraught with practical difficulties, market participants warn.
What information about smart gadgets will you have to share?
Data on the phone numbers of SIM cards embedded in machine-to-machine communication (M2M) devices, the addresses of their owners or the locations where such gadgets are installed, as well as other information that identifies users and smart equipment, will need to be entered into the Unified Identification and Authentication System (USIA). This follows from the draft law "Anti-fraud 3.0" published by the Ministry of Finance. If the device uses an eSIM instead of a regular SIM card, you will need to specify its unique IMEI identification number. Operators with M2M gadgets connected to their networks will have to verify the accuracy of information about them, the document says.
The regulation will affect machine—to-machine communication devices - payment terminals, counters and other equipment connected to mobile networks and used by legal entities and sole proprietors, the Ministry of Finance told Izvestia. It is planned to provide a transition period for the owners of such devices so that they can update information about the equipment in the ESIA.
The agency believes that the measure will prevent the use of SIM cards registered for M2M devices of legal entities and sole proprietors for fraudulent purposes, in particular for illegal mailings and phone calls. The government will determine the composition of information about M2M equipment, including IMEI, the procedure for entering it into the ESIA, as well as the specifics of providing mobile radiotelephone services for such devices, the ministry added.
Scammers are already using gray schemes with so-called gray SIM cards and M2M modules. Numbers issued to front persons or organizations are used for mass calls and mailings, as well as the creation of fictitious accounts, Akhmetzhan Makhmutov, ex-Minister of Digital Development of the Vologda Region, told Izvestia. According to him, the new initiative is aimed directly at the infrastructure used in such schemes.
— The bill specifically talks about corporate numbers and equipment that are used in M2M devices. We are not talking about all smart home gadgets, but about the category of them that connects to mobile networks. These are, for example, smart electricity and water meters, alarms, leak and smoke detectors, video cameras with a SIM card, telematics devices for cars, ATMs and payment terminals. Simply put, everything that exchanges data with the outside world without direct human involvement," he said.
Registration reduces the risk that the SIM card is not actually used by the person it was issued to, or, more importantly, that it ends up in a device for which it is not intended, said T2 representative Daria Kolesnikova.
Will smart home device databases stop fraudsters?
Any device connected to the network can become a vulnerability point through which a cybercriminal will gain access to other infrastructure, said Leonid Konik, a partner at ComNews Research. As an example, he cited the hacking of American casino IT systems in April 2018. Despite the high level of cyber defense, the attackers penetrated the infrastructure through a smart aquarium.
The system automatically monitored the fish's feeding schedule, salt levels, and water temperature, and the thermostat could connect to the Internet to warn of overheating or excessive cooling. Cyber protection of the aquarium was not provided, and through this device, the attackers gained access to 10 GB of sensitive data, the expert said.
The Ministry of Finance explains the increased regulation by the need to stop the use of technical SIM cards for illegal calls and mailings, said Andrey Priemykhov, NTI information security expert. Such a link may help to detect that the card claimed for the meter is being used in other equipment. But for this, the operator must compare the registration information with the actual use of the number, the expert emphasized. One entry in the ESIA will not stop a fraudulent call, it also does not protect against hacking the gadget itself, he believes.
The difficulty is also related to the fact that according to the current rules, M2M SIM cards can only be registered by a legal entity, but not by an individual, says Daria Kolesnikova.
— Manufacturers produce smart home devices with built-in SIM modules. When such a device is sold to an end customer (an individual), according to the logic of the law, the SIM card must be re-registered to this person. However, this process is technically difficult and inconvenient. Therefore, manufacturers or distributors register such SIM cards for themselves - for a legal entity. This is easier, but it creates another problem: at the time of registration, the company does not know exactly where a specific sensor or camera will be installed," she said.
With the adoption of the new law, it may be necessary to change the procedure for registration and registration of rooms, they do not exclude in T2. Manufacturers of smart home systems, security equipment and household appliances may have to abandon the mass registration of SIM cards for themselves and issue numbers to end users, Daria Kolesnikova believes. This will require new technical and legal procedures.
Inconveniences are possible, but they will be more technical than domestic, Akhmetzhan Makhmutov believes. For businesses, especially in the housing and utilities and logistics sectors, where the number of connected devices can number in the thousands, the burden will be higher: centralized accounting and data transfer will need to be organized. However, this is a one-time investment in transparency, which in the future can reduce reputational and regulatory risks, the expert added.
— If the bill is adopted in its current version, in the first months after the new rules come into force, we can expect an increase in calls to operator support services: users will need time to get used to the new order. But in a year it may become as familiar a procedure as linking a bank card to a phone," he believes.
According to Andrey Priemykhov, the convenience of registration will depend on the number of actions that the user will need to perform. According to him, it is advisable to combine the procedure with the connection of communication and automatically substitute the data already known to the operator. For businesses with a large fleet of devices, the ability to download data en masse is necessary — such a mechanism is already provided for by the current procedure for registering corporate SIM cards, the expert concluded.
Переведено сервисом «Яндекс Переводчик»
