1
00:00:00,000 --> 00:00:06,080
All right. Hi, everybody. I'm Mark Eichhorn. I'm with the Federal Trade Commission.

2
00:00:06,880 --> 00:00:16,020
And I wanted to speak to you with my colleague Aaron Alva today about our IOT Home Inspector Challenge.

3
00:00:16,620 --> 00:00:24,740
And we actually have the winner of the challenge on the phone. He's going to chime in later about his project.

4
00:00:24,740 --> 00:00:33,300
But before we dig in, I just wanted to let you know I'm in the Bureau of Consumer Protection at the Federal Trade Commission.

5
00:00:34,320 --> 00:00:39,860
And I work in a division that does privacy and data security work.

6
00:00:40,800 --> 00:00:48,920
I'm Aaron Alva. I'm a technologist at the FTC. I'm in our relatively new security and our new research group, OTEC.

7
00:00:49,080 --> 00:00:54,560
So we do security and privacy research, a whole host of research, anything from network traffic.

8
00:00:54,740 --> 00:00:58,680
analysis of smart TVs to ransomware and so forth.

9
00:00:59,360 --> 00:01:03,280
And so here we also need to give our general disclaimer.

10
00:01:03,740 --> 00:01:10,680
We both work for the FTC, but the views are here our own and not necessarily those of the commission or any one commissioner.

11
00:01:11,060 --> 00:01:18,200
But we want to talk to you about what the FTC has done when it comes to IOT security over the last year and a half or so,

12
00:01:18,320 --> 00:01:21,260
as well as the challenge that we announced this week.

13
00:01:22,100 --> 00:01:22,580
Okay.

14
00:01:22,880 --> 00:01:24,720
So just a word about the FTC.

15
00:01:24,720 --> 00:01:31,980
Our big boss was here, actually, and she was at DEF CON and she was here.

16
00:01:32,460 --> 00:01:39,840
We have two commissioners who are sort of in charge of our agency at the moment, and one of them was here.

17
00:01:40,360 --> 00:01:53,720
And so what we do is, in my division and with support from our friends in OTEC, we do privacy and data security work.

18
00:01:53,880 --> 00:01:54,700
So this chapter is a little bit different.

19
00:01:54,700 --> 00:01:59,360
So the challenge was related to sort of updating IOT devices.

20
00:02:00,580 --> 00:02:09,020
So just to give you some background about what led us to do this challenge, we had done some workshops.

21
00:02:09,380 --> 00:02:16,020
They're sort of like conferences, essentially, on issues relating to, like, mobile security.

22
00:02:17,700 --> 00:02:24,040
So the question of, well, you know, how often are devices updated?

23
00:02:24,940 --> 00:02:34,340
And if the device manufacturer releases an update, how and when does that actually get to consumers?

24
00:02:35,460 --> 00:02:39,400
We also held a workshop on the Internet of Things.

25
00:02:41,080 --> 00:02:50,740
And part of that was learning that, yeah, consumers don't actually do that great a job of, like, finding and downloading patches or updates,

26
00:02:51,000 --> 00:02:52,860
often because they don't know that they're out there.

27
00:02:54,700 --> 00:03:01,040
And we recently did, last month, a workshop on connected cars, privacy and security concerns.

28
00:03:01,960 --> 00:03:05,580
So we also do enforcement work, so case enforcement.

29
00:03:06,960 --> 00:03:13,800
So in that context, we had a case called ASIS involving ASIS routers.

30
00:03:14,060 --> 00:03:18,760
We resolved it through a consent agreement with the company.

31
00:03:19,260 --> 00:03:24,300
But in the course of that, we alleged several things.

32
00:03:24,700 --> 00:03:31,280
And one was that the company actually had received...

33
00:03:31,280 --> 00:03:36,240
Security researchers had reached out to the company over time to alert them to vulnerabilities.

34
00:03:37,080 --> 00:03:43,320
And they just didn't have a good process for handling and processing those.

35
00:03:44,180 --> 00:03:51,140
So they didn't necessarily sort of act on certain tips that they got from researchers.

36
00:03:53,040 --> 00:03:53,800
They also...

37
00:03:56,140 --> 00:04:03,520
fix things, at one point they had fixed the problem and released a patch but it was eight

38
00:04:03,520 --> 00:04:09,300
months before they actually sort of let people know, like if a consumer had registered with

39
00:04:09,300 --> 00:04:16,280
them, it was eight months before they let them know, hey, a patch is available. And then

40
00:04:16,280 --> 00:04:22,700
finally they had a tool that would allow you to find out whether there was an update

41
00:04:22,700 --> 00:04:31,840
available to the firmware and that tool didn't work. So it didn't, sometimes there was a patch

42
00:04:31,840 --> 00:04:42,620
available but the tool would tell you that there wasn't. So among the relief in that case,

43
00:04:44,080 --> 00:04:50,680
that we required them to provide notice to users, you know, if there's a vulnerability patch

44
00:04:50,680 --> 00:04:52,300
available or an upgrade available.

45
00:04:53,100 --> 00:05:00,660
A couple of other cases that we brought, both again consent agreements, but one

46
00:05:00,660 --> 00:05:09,460
was the HTC matter involving basically some software that HTC had put on top of the Android

47
00:05:10,420 --> 00:05:15,940
smart phone system. And they introduced some vulnerabilities in doing that. So as part

48
00:05:15,940 --> 00:05:22,120
of our relief in that order, we required them to release patches for about a couple million

49
00:05:23,020 --> 00:05:27,960
HTC smart phones. And then finally in the Oracle matter,

50
00:05:28,700 --> 00:05:35,300
Oracle was releasing updated software to address

51
00:05:35,300 --> 00:05:39,960
vulnerabilities. But then they weren't necessarily replacing the

52
00:05:39,960 --> 00:05:44,520
outdated software. So sometimes the new, the newer updated

53
00:05:44,520 --> 00:05:48,780
software would just be installed alongside the old still

54
00:05:48,780 --> 00:05:52,460
vulnerable software. So those were a few of the things that

55
00:05:53,240 --> 00:05:59,700
sort of led us to think about a challenge related to consumer

56
00:05:59,700 --> 00:06:03,580
updates. And we sort of realized obviously companies don't always

57
00:06:04,100 --> 00:06:07,380
update the software when maybe they should. But particularly

58
00:06:07,380 --> 00:06:11,440
when they do release updates, we wanted to make sure consumers

59
00:06:11,440 --> 00:06:16,640
had an easier way to sort of find out about those updates and

60
00:06:16,640 --> 00:06:18,720
download them. Aaron?

61
00:06:18,780 --> 00:06:25,180
So the FTC has authority under what's called the America

62
00:06:25,180 --> 00:06:30,860
Competes Act. And we can bring challenges that help come up with

63
00:06:30,860 --> 00:06:34,120
some sort of technical solution out there that consumers can use.

64
00:06:34,360 --> 00:06:38,660
In the past, FTC has done challenges at DEF CON related to

65
00:06:38,660 --> 00:06:43,720
robocalls. We had Nomo Robo and Zapping Rachel here, DEF CONs

66
00:06:43,720 --> 00:06:48,760
22 and 23. And we're interested in challenges such as the

67
00:06:48,780 --> 00:06:53,700
Home Inspector Challenge that really answer these questions

68
00:06:53,700 --> 00:07:02,160
that are difficult questions to do with, from a policy standpoint

69
00:07:02,160 --> 00:07:06,460
sometimes, but actually scream out for a technical solution. So

70
00:07:06,460 --> 00:07:12,120
in particular with the IoT Security Challenge, the scope of

71
00:07:12,120 --> 00:07:16,820
this challenge was around being able to equip consumers with

72
00:07:16,820 --> 00:07:18,760
understanding what devices are on the market, what devices are on

73
00:07:18,780 --> 00:07:22,000
their network, and whether those devices were up to date, and

74
00:07:22,000 --> 00:07:25,200
potentially what vulnerabilities, common vulnerabilities were in

75
00:07:25,200 --> 00:07:29,980
those devices, and then have some way to help facilitate updates to

76
00:07:29,980 --> 00:07:34,040
those devices on the network. So a lot of what happens when it comes

77
00:07:34,040 --> 00:07:42,900
to a consumer and consumers' understanding of IoT security is we want to be able

78
00:07:42,900 --> 00:07:47,640
to equip these consumers with better understanding the potential attack

79
00:07:47,640 --> 00:07:53,360
surfaces on their home networks and ways that they can actually help facilitate

80
00:07:53,360 --> 00:08:00,980
updates so that updates actually happen to devices. And one of the

81
00:08:00,980 --> 00:08:08,260
discussions that we had here in terms of the scoping of this particular

82
00:08:08,260 --> 00:08:15,520
challenge was around facilitating updates. There was a recognition that

83
00:08:17,900 --> 00:08:24,940
the FTC has said through other processes, including NTIA, comments around IoT upgrades

84
00:08:24,940 --> 00:08:32,200
and patching that automatic updates would be the preferable way to go. But for the devices

85
00:08:32,200 --> 00:08:37,740
that don't have automatic updates, how are there ways that we can still help protect

86
00:08:37,740 --> 00:08:47,080
consumers and facilitate updates? And so this particular challenge ran through the

87
00:08:47,640 --> 00:08:57,220
FTC from January, I believe? From January through May this year. And we, the acting chairman

88
00:08:57,220 --> 00:09:02,660
of the FTC announced the winner this week. The criteria around the challenge was we asked

89
00:09:02,660 --> 00:09:11,540
people to submit an abstract, a video, as well as a detailed paper that would talk about what

90
00:09:11,540 --> 00:09:17,540
they had built. And what they had built had gone around certain criteria that was crafted to

91
00:09:17,540 --> 00:09:24,140
help address and kind of tease out the things that the challenge was trying to accomplish. This

92
00:09:24,140 --> 00:09:34,560
criteria was in three large parts. The biggest part was how well does your submission work? And the

93
00:09:35,480 --> 00:09:41,340
idea around that was how do we kind of address the technical feasibility of device

94
00:09:41,340 --> 00:09:47,520
identification on a home network? So can you automatically recognize devices of a home network?

95
00:09:47,540 --> 00:09:54,320
Or provide instructions for input to help facilitate that too if needed? Can you actually profile

96
00:09:54,320 --> 00:10:02,780
the devices to determine the software level that is currently on the device? So you could imagine in

97
00:10:02,780 --> 00:10:09,820
some context this would be easy. Maybe it's broadcast. Maybe it's made known in some way. And in

98
00:10:09,820 --> 00:10:17,520
other cases with devices, particularly devices that are potentially older, it may actually be technically

99
00:10:17,540 --> 00:10:25,060
more difficult to identify at what level, what level, what software level or formal level is on the

100
00:10:25,060 --> 00:10:30,480
device at a particular point. And so being able to do this in an automated fashion is one of the

101
00:10:30,480 --> 00:10:36,300
things that we wanted to help facilitate so that, so that consumers without having to do anything

102
00:10:36,300 --> 00:10:41,820
technical could actually see this information in their homes and have a better sense of all the

103
00:10:41,820 --> 00:10:47,520
devices that were on their network and what they were and crucially whether they were up to date. So,

104
00:10:48,480 --> 00:10:59,080
another part was of the overall criteria around how well does the submission work was around

105
00:10:59,080 --> 00:11:07,600
assisting and facilitating updates. And that's something that you'll see addressed as our winner will

106
00:11:07,600 --> 00:11:14,960
kind of briefly talk about his approach. And something that we are continuing to be interested in.

107
00:11:15,670 --> 00:11:17,500
There was also a wild card approach that we did. And that was to make sure that we were able to

108
00:11:17,500 --> 00:11:17,900
make the device connected to the network. And we also made a new app called the). app which

109
00:11:17,900 --> 00:11:24,060
the honorable mention made use of to kind of take a step out of the criteria and show us kind of a blue sky

110
00:11:24,060 --> 00:11:28,940
approach. So that's, that was the first criteria. How well does it work, what are the technical

111
00:11:28,940 --> 00:11:34,840
feasibilities that we need to facilitate consumers better knowing what's in their network and whether

112
00:11:34,840 --> 00:11:45,920
those devices were up to date. The second part was around how user friendly your tool is. So when we talk about the

113
00:11:45,920 --> 00:11:52,920
our friends and family members that are not in IT that may not know even what antivirus does or

114
00:11:52,920 --> 00:12:03,220
may not know the difference between WPA2 or any other sort of encryption on Wi-Fi. We want to

115
00:12:03,220 --> 00:12:08,560
talk about the consumers that can use this in a user-friendly way and can understand the

116
00:12:08,560 --> 00:12:15,780
information that's being provided to them through this particular tool. So things like how easy is

117
00:12:15,780 --> 00:12:23,020
this tool to use for the average consumer without technical expertise? How easy is it to set up? We

118
00:12:23,020 --> 00:12:27,040
don't want a substantial effort in setting this up. We want this something that anyone can roll

119
00:12:27,040 --> 00:12:34,780
out on their home networks. And then also, you know, does it display or convey information about

120
00:12:34,780 --> 00:12:39,880
the devices that it's assessed and does it accurately communicate in a way that's

121
00:12:39,880 --> 00:12:45,760
understandable to the users? Does it allow consumers also to control, ask the

122
00:12:45,780 --> 00:12:50,400
user for specific aspects of information in case there needs to be analysis done off the

123
00:12:50,400 --> 00:12:55,940
particular device or solution that is being submitted? So if you need to hit back your servers

124
00:12:55,940 --> 00:13:02,580
or cloud or however you want to call it, do you give that type of control to the users for that

125
00:13:02,580 --> 00:13:11,120
particular information? So that was the second criteria. So how user-friendly your tool is to the

126
00:13:11,120 --> 00:13:15,760
reasonable person, to the reasonable consumer. The third was how skilled the user is. So the

127
00:13:15,780 --> 00:13:21,980
key criteria was how scalable your tool is. The key criteria was explaining how the tool could be

128
00:13:21,980 --> 00:13:29,660
used for products other than those specifically addressed in the challenge itself. So is your tool

129
00:13:29,660 --> 00:13:37,740
extendable into other areas? Or can it be extended in other ways? There were also other, and

130
00:13:37,740 --> 00:13:42,360
then there was also an optional aspect of the criteria that dealt with vulnerabilities. The main

131
00:13:42,360 --> 00:13:45,760
focus of the, of the challenge was around facilitating the tool. And then there was also an

132
00:13:45,760 --> 00:13:48,480
additional aspect of the criteria that dealt with creating updates where the manufacturer had an

133
00:13:48,480 --> 00:13:58,560
update available. But we also wanted to address as part of the criteria other ways that could,

134
00:13:58,620 --> 00:14:04,780
that would help consumers guard against broader security vulnerabilities. And so that was

135
00:14:04,780 --> 00:14:10,460
provided as points that you could get as part of your criteria. So that was kind of the overall

136
00:14:10,460 --> 00:14:15,400
criteria. How well does it work? Does it profile the device and understand the level that it's at?

137
00:14:15,400 --> 00:14:22,560
Facilitate updates, usability, user friendliness for the, for the common user, the non IT user, the

138
00:14:22,560 --> 00:14:27,420
consumers that are out there that, uh, have never heard of DefCon, have, don't know anything about

139
00:14:27,420 --> 00:14:35,500
security. Um, and that how scalable your tool is. Um, so we addressed those in, uh, we had a panel

140
00:14:35,500 --> 00:14:42,480
of five independent judges that were outside the FTC that, uh, came together and at, and, uh,

141
00:14:42,600 --> 00:14:45,380
evaluated all of the submissions that came in. And they all turned out to be fairly smooth, and, uh,

142
00:14:45,380 --> 00:14:55,840
in and led to our winner. So before we talk to our winner who is on the phone with us, there was

143
00:14:55,840 --> 00:15:01,800
also an honorable mention that was announced. And I wanted to just briefly talk about the

144
00:15:01,800 --> 00:15:08,960
honorable mention because the honorable mention made use of what we call the wildcard option. And

145
00:15:08,960 --> 00:15:13,960
that was essentially kind of a blue sky approach for a technical solution that would help

146
00:15:13,960 --> 00:15:22,640
consumers in this area. And it was the team pink, pinc persistent internal network

147
00:15:22,640 --> 00:15:31,280
containment. Their honorable mention made use of sandboxing so that each device would have its

148
00:15:31,280 --> 00:15:37,540
own configuration baseline and reporting so that you isolated each device on the network in a

149
00:15:37,540 --> 00:15:43,940
very user friendly way that consumers would understand how to do so that we would be able to

150
00:15:43,960 --> 00:15:49,220
would limit the attack surface and if a device was compromised,

151
00:15:49,780 --> 00:15:54,700
it would limit the risk of the rest of your home network being

152
00:15:55,320 --> 00:15:59,180
potentially vulnerable. So that was the honorable mention. And

153
00:15:59,180 --> 00:16:05,200
then do you want to address the winner? Yeah. Let's get him on

154
00:16:05,200 --> 00:16:09,240
the phone. Steve is muted right now. Let's get him on. This is

155
00:16:09,240 --> 00:16:16,140
Steve Castle, who is the winner of our $25,000 top prize. And

156
00:16:16,140 --> 00:16:22,940
Steve, are you on? Yes, I am. All right. Do you want to talk a

157
00:16:22,940 --> 00:16:29,540
little bit about your winning idea? Yeah, absolutely. So what I

158
00:16:29,540 --> 00:16:34,660
did was the SDPharm mobile application. What it does is it

159
00:16:35,050 --> 00:16:39,220
takes a holistic look in your network. And you run some

160
00:16:39,240 --> 00:16:48,240
What it does, it asks you to log into, it clearly says that all the application credentials

161
00:16:48,240 --> 00:16:50,200
aren't going to be sent anywhere else.

162
00:16:52,020 --> 00:16:54,440
And it does that.

163
00:16:55,870 --> 00:16:59,660
It backgrounds WebView for the mobile file.

164
00:17:00,800 --> 00:17:09,460
And what it does, that we do the application for those steps of the UG.

165
00:17:12,600 --> 00:17:16,300
From there, we take steps.

166
00:17:18,900 --> 00:17:21,660
Steve, we can't quite hear you.

167
00:17:24,120 --> 00:17:24,800
Okay.

168
00:17:28,000 --> 00:17:29,140
Sorry about that.

169
00:17:31,520 --> 00:17:42,760
So, I will try my best to summarize what your tool has done as much as I can understand it right now.

170
00:17:44,120 --> 00:17:47,120
So, Steve Castle was our winner.

171
00:17:47,500 --> 00:17:57,820
And he came up with an app called the IoT Watchdog that enables simple secure management of IoT devices

172
00:17:57,820 --> 00:17:58,720
on the home network.

173
00:17:58,960 --> 00:17:59,640
And it's a really cool app.

174
00:17:59,660 --> 00:18:04,540
And through his app, it facilitates kind of what we talked about in the criteria,

175
00:18:05,160 --> 00:18:14,560
which is an app that has the devices that have been identified on the network

176
00:18:14,560 --> 00:18:16,060
and the type of device it is.

177
00:18:16,180 --> 00:18:22,560
And for devices that can't be identified, there's actually a user flow that can go by quite easily

178
00:18:22,560 --> 00:18:28,920
that starts at kind of company name and walks the consumer through identifying which device it is in particular

179
00:18:28,920 --> 00:18:29,640
so that they can use it.

180
00:18:29,640 --> 00:18:34,280
And it helps to make it so that you have a better inventory, the consumer has a better inventory of devices on the network.

181
00:18:34,440 --> 00:18:42,520
And it helps then scan the local network for things such as default or weak passwords.

182
00:18:45,840 --> 00:18:54,300
And users can use an app to know about the devices inventoried and their known implementations and configurations.

183
00:18:56,260 --> 00:18:59,620
And also has a part that helps facilitate the user's ability to follow the device.

184
00:18:59,620 --> 00:19:05,100
facilitate updates and notify the consumers and give them a really user friendly way to

185
00:19:05,100 --> 00:19:11,820
describe what's on the network and what might need to be done to help facilitate updates.

186
00:19:13,540 --> 00:19:18,720
Right. So what excited us about this was, again, we're looking for some way, you know, where

187
00:19:18,720 --> 00:19:23,860
companies release an update, you know, like Mirai obviously happened at the time that we were

188
00:19:23,860 --> 00:19:30,140
planning this workshop, but to the extent that these IoT devices might be out there for a long

189
00:19:30,140 --> 00:19:37,400
time, it's great if companies release the updates, but then consumers, if they don't know where

190
00:19:37,400 --> 00:19:43,260
they are, how to get to them, whether there's been an update for their device, you know, that's

191
00:19:43,260 --> 00:19:52,900
not a great situation for our overall security. So Steve's IoT watchdog sort of helped surface

192
00:19:52,900 --> 00:19:53,840
the information.

193
00:20:05,820 --> 00:20:12,280
Yeah. So in summary, we're right up against our time. So in summary, we wanted this

194
00:20:12,280 --> 00:20:19,420
challenge to help equip consumers, non-IT consumers that know nothing about security or anything

195
00:20:19,420 --> 00:20:23,840
technical to help have them understand what's on their network and what they need to know about

196
00:20:23,840 --> 00:20:25,740
their devices. So we're excited to have these devices, and for devices that don't do automatic

197
00:20:25,740 --> 00:20:33,240
updates, help facilitate those updates in a way that is easy for the consumer and helps get those

198
00:20:33,240 --> 00:20:40,560
devices up to the level at which is updated based on the manufacturer and then also takes a step

199
00:20:40,560 --> 00:20:47,580
further in going and addressing vulnerabilities and common design flaws. So we're around here at

200
00:20:47,580 --> 00:20:53,260
DEF CON if you want to talk to us or have other questions about the FTC. But thank you so much for

201
00:20:53,260 --> 00:20:53,520
your time.

202
00:20:54,200 --> 00:20:54,900
Thank you.

203
00:20:59,640 --> 00:21:00,100
Yes.

204
00:21:02,360 --> 00:21:02,820
.

205
00:21:17,700 --> 00:21:18,160
.

206
00:21:18,160 --> 00:21:18,300
.

207
00:21:18,300 --> 00:21:18,760
.

208
00:21:18,760 --> 00:21:18,960
.

209
00:21:18,960 --> 00:21:18,980
.

210
00:21:18,980 --> 00:21:19,080
.

211
00:21:19,080 --> 00:21:19,100
.

212
00:21:19,100 --> 00:21:19,120
.

213
00:21:19,120 --> 00:21:19,220
.

214
00:21:25,980 --> 00:21:26,680
.

215
00:21:33,180 --> 00:21:33,880
.

216
00:21:35,140 --> 00:21:35,840
.

217
00:21:35,840 --> 00:21:35,960
.

218
00:21:35,960 --> 00:21:36,300
.

219
00:21:36,300 --> 00:21:36,500
.

220
00:21:36,500 --> 00:21:37,820
.

221
00:21:37,820 --> 00:21:37,860
.

222
00:21:37,860 --> 00:21:37,920
.

223
00:21:37,920 --> 00:21:38,480
.

224
00:21:38,480 --> 00:21:38,520
.

225
00:21:38,520 --> 00:21:38,560
.

226
00:21:38,560 --> 00:21:38,760
.

227
00:21:38,760 --> 00:21:39,120
.

228
00:21:41,240 --> 00:21:41,940
.

229
00:21:42,760 --> 00:21:43,460
.

230
00:21:53,260 --> 00:22:02,840
We wanted a component that was easy to use, to emphasize, and to try to really make sure that whatever comes out of this challenge does get adopted.

231
00:22:04,400 --> 00:22:11,380
I think your question is separate, like out in the marketplace, is FTC going to require ease of use?

232
00:22:11,840 --> 00:22:16,680
And if the market doesn't, if a product's not easy to use, it's just going to fail?

233
00:22:16,680 --> 00:22:26,900
That's an area where I don't, you know, there's no, I don't know personally of any requirements along those lines.

234
00:22:37,400 --> 00:22:44,980
No, we're a law enforcement agency in general, and we leave the legislation for the most part to Congress.

235
00:22:46,680 --> 00:22:46,900
Yes.

236
00:22:48,020 --> 00:22:48,900
Yeah, question.

237
00:23:07,200 --> 00:23:07,940
Yeah, that's a.

238
00:23:16,680 --> 00:23:23,220
We have authority to do reports under our statute, and that report is underway.

239
00:23:23,580 --> 00:23:29,340
I think that the deadline is this fall sometime for announcing that.

240
00:23:36,400 --> 00:23:37,280
Appreciate that.

241
00:23:37,340 --> 00:23:46,020
And the report, just so everyone here is around, FTC has an authority called 6B that says we can go and ask,

242
00:23:46,680 --> 00:23:54,680
different companies to provide us information for the basis of an overall report of what is happening around a particular area.

243
00:23:54,880 --> 00:24:02,460
And that report that we've asked for is around mobile updates and mobile security.

244
00:24:02,860 --> 00:24:12,100
And as part of that, we asked a number of, was it OEMs?

245
00:24:13,840 --> 00:24:16,600
OEMs in conjunction with FTC.

246
00:24:16,680 --> 00:24:24,800
Or with the FCC about what they do for mobile security updates and what their process is and so forth,

247
00:24:24,900 --> 00:24:27,480
so that we can help understand what's going on in that marketplace.

248
00:24:39,880 --> 00:24:43,360
I believe there is an automatic component to AS.

249
00:24:44,360 --> 00:24:46,660
Yeah, I believe there's both an automatic component.

250
00:24:46,680 --> 00:24:51,020
There's an automatic component to it, and there's also a way to add individual devices to it, is my understanding.

251
00:24:55,820 --> 00:24:56,960
I believe so.

252
00:24:57,160 --> 00:24:57,940
I believe so.

253
00:24:58,060 --> 00:25:09,580
But Steve is on the phone, but I could also follow up with you or point you to the winner, too.

254
00:25:11,080 --> 00:25:12,260
All right, well, thank you, everyone.

255
00:25:12,540 --> 00:25:12,980
Thank you.

256
00:25:14,760 --> 00:25:15,640
Thank you.