Media Library (10)

SIIA Calls on Congress to Authorize the National AI Research Resource

by Policy

Since release of the National AI Research Resource (NAIRR) Task Force report earlier this year, SIIA has consistently called on Congress to authorize the NAIRR to revolutionize the AI research landscape in the United States, ensure the United States continues to lead in AI innovation and responsible AI, and address core national security challenges. SIIA and other organizations wrote to leadership of the House and Senate Science Committees to prioritize NAIRR authorization in the current session.

Full Letter Here
Media Library (5)

The Case for Right to Repair Has Not Been Made

by Policy

–Chris Mohr, President, SIIA; Paul Lekas, SVP, Global Public Policy & Government Affairs, SIIA

Today, the House Judiciary Committee’s IP Subcommittee held a hearing on “right to repair” – the concept that purchasers of vehicles, electronic devices, and other products should have the ability to repair and make changes to those products without invalidating manufacturer warranties and in some cases by requiring manufacturers to make data and tools available to consumers and repair shops.

Our members are in the business of information, and much of that information is sold as a service through many different devices and different ecosystems. Those ecosystems are protected by intellectual property statutes that prevent unauthorized and harmful uses of those platforms. For example, section 1201 of the Digital Millennium Copyright Act (DMCA) has spawned a huge investment in the distribution of software and other literary works online by preventing businesses from forming around piracy tools. As information has become increasingly sold as a service, changes in technology have changed the relationship between consumers and their devices and a digital market for all kinds of works has exploded—exactly as Congress intended.

Against the tremendous success of the DMCA in promoting the dissemination of online works, we are skeptical of the need for any additional legislation around “right to repair.”  The case for it has simply not been made. We note that when the FTC examined this issue, it found that “the assertion of IP rights does not appear to be a significant impediment to independent repair.”  Even in the most famous example, only 2% of tractor repairs run into an IP-based problem.  And both auto and cell phone manufacturers have entered MOUs that deal with these issues. While individual anecdotes may seem compelling and have convinced some state legislatures, the policy case for risking the backbone of a massively successful ecosystem non-existent.

Importantly, piracy risks are not the only ones implicated by the right to repair movement. When Massachusetts voters approved a ballot initiative to require automobile manufacturers to provide open remote access to vehicle “telematics” data to customers and repair shops, the National Highway Traffic Safety Administration (NHTSA) felt the safety and security concerns of the law were sufficiently significant that it contacted automotive manufacturers to urge them not to comply. As NHTSA explained, the open access required by the Massachusetts law would “allow[] for the manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking, as well as … air bags and electronic stability control.” NHTSA expressed concern that “[a] malicious actor here or abroad could utilize such open access to remotely command vehicles to operate dangerously, including attaching multiple vehicles concurrently. Vehicle crashes, injuries, or deaths are foreseeable outcomes of such as situation.”

The kinds of safety and security concerns raised by NHTSA are not limited to the automotive sector. The business of information can thrive only if its users believe that their data is being handled well.  Indeed, ill-designed right-to-repair legislation could have a significant impact on the safety of personal data in consumer electronic devices and undermine critical cybersecurity protections built into the software and hardware of consumer devices. What too many of the right to repair proposals demonstrate is a lack of awareness of how opening access to manufactured products will create exposure that undermines cybersecurity and privacy.

Finally, some have homed in on right to repair as part of a larger effort around competition.   As this argument goes, restrictions on third-party repair serve only to entrench the manufacturers. This position ignores the essential investment that manufacturers have made to ensure the safety and security of data used in their products. Part of what makes products valuable to users is how those products ensure the safety and security of their data and come equipped with software that mitigates the risk of a cybersecurity breach.  Existing competition law is more than capable of dealing with the minority of situations in which this claimed “right” is implicated.

Media Library (4)

North Carolina Implements Stringent Data Security Standards for Third-Party Vendors Handling Student Information

by Policy

For much of the past decade, states have been implementing new laws and policies to protect the privacy and safety of student data.  Most recently, the state of North Carolina’s Department of Public Instruction (NCDPI) launched new data security standards for any technology or system that receives student information from a state system.  Going into effect on August 1, 2023, this statewide policy design and intent is to ensure that public school units (PSU) have the resources they need to adequately evaluate the security readiness of vendor partners. In an effort to prevent cybersecurity threats in ed tech platforms and tools, NCDPI implemented a new process that impacts third-party vendors at a PSU.  In short, third-party vendors will be required do the following: 

  • Sign the DPI Data Confidentiality and Security Agreement, with no modifications.
  • Articulate which statewide systems they will connect to, data fields requested and rational for collection, and how that data will be restricted to users who have a legitimate business need, and a description of any data written back to a statewide system.
  • Submit security documentation including a vendor readiness assessment report, a third-party conducted assessment report (FedRAMP authorization, ISO 27001 certification, or others) no less than 12 months old, and alignment against the NC DIT Statewide Information Security Manual.
  • Provide additional documentation if not in compliance with the Statewide Information Security Manual. 

Third-party vendors that are contracted or renewed after August 1, 2023 will have to be evaluated with the aforementioned steps, before it can be integrated in the PSU. Vendors that do not comply with the security requirements for integration will not be allowed to receive student data from the PSU.  

SIIA raised concerns with the new policy and requested additional guidance via a letter on  June 20, 2023. We received a response on July 12, 2023 with direct answers to our questions, to which SIIA responded via another letter on July 25, 2023. We are posting these answers for the broader public in case they are of assistance. Further, SIIA participated in a public meeting/call with NCDPI on June 22, 2023, however, there is no recording of that call.  There is still much confusion on this and we look forward to working with our members and the state of North Carolina to make sure student data is protected.  

If you have any additional questions, please contact our education policy team at education@siia.net.

NCDPI Response
SIIA's Letter

North Carolina Implements Stricter Data Security Standards for Student Information: What Third-Party Vendors Need to Know

by Uncategorized

For much of the past decade, states have been implementing new laws and policies to protect the privacy and safety of student data.  Most recently, the state of North Carolina’s Department of Public Instruction (NCDPI) launched new data security standards for any technology or system that receives student information from a state system.  Going into effect on August 1, 2023, this statewide policy design and intent is to ensure that public school units (PSU) have the resources they need to adequately evaluate the security readiness of vendor partners. In an effort to prevent cybersecurity threats in ed tech platforms and tools, NCDPI implemented a new process that impacts third-party vendors at a PSU.  In short, third-party vendors will be required do the following: 

  • Sign the DPI Data Confidentiality and Security Agreement, with no modifications.
  • Articulate which statewide systems they will connect to, data fields requested and rational for collection, and how that data will be restricted to users who have a legitimate business need, and a description of any data written back to a statewide system.
  • Submit security documentation including a vendor readiness assessment report, a third-party conducted assessment report (FedRAMP authorization, ISO 27001 certification, or others) no less than 12 months old, and alignment against the NC DIT Statewide Information Security Manual.
  • Provide additional documentation if not in compliance with the Statewide Information Security Manual. 

Third-party vendors that are contracted or renewed after August 1, 2023 will have to be evaluated with the aforementioned steps, before it can be integrated in the PSU. Vendors that do not comply with the security requirements for integration will not be allowed to receive student data from the PSU.  

SIIA raised concerns with the new policy and requested additional guidance via a letter on  Jun 20, 2023. We received a response on Jul 12, 2023 with direct answers to our questions. We are posting these answers for the broader public in case they are of assistance. Further, SIIA participated in a public meeting/call with NCDPI on Jun 22, 2023, however, there is no recording of that call.  There is still much confusion on this and we look forward to working with our members and the state of North Carolina to make sure student data is protected.  

If you have any additional questions, please contact our education policy team at education@siia.net.

 

To view the letter and response, please click here.  

 

Media Library (3)

SIIA Urges CFPB to Protect Data Brokers and First Amendment Rights

by Policy

The Software & Information Industry Association (SIIA) has expressed concerns to the Consumer Financial Protection Bureau (CFPB) regarding regulations on “data brokers.” SIIA, representing over 450 companies in the information business, cautions against regulations that hinder productive data use or infringe on First Amendment rights. They argue that data brokers play a crucial role in providing information for various purposes such as law enforcement, combating money laundering and terrorism, child support enforcement, insurance, product safety, tax compliance, fraud prevention, and news publishing. These activities rely on publicly-available data and contribute to consumer security and convenience. SIIA asserts that there is a legislative and regulatory consensus that data brokering is protected by the First Amendment. They also argue that restrictions on publicly-available data or its derivatives would violate the First Amendment. While regulations on private data may be appropriate, they emphasize the importance of protecting the public domain and maintaining the availability of information for positive societal endeavors.

Read Full Letter Here