US lawmakers are trying to fix the security nightmare that is the 'internet of things'

The internet of things is a massive security nightmare. US lawmakers are finally starting to try and fix that.

A bipartisan group of U.S. senators is introducing legislation that seeks to address vulnerabilities in computing devices embedded in everyday objects — known in the tech industry as the "internet of things" — which experts have long warned poses a significant threat to global cyber security.

The new bill would require vendors that provide internet-connected equipment to the U.S. government to ensure their products are patchable, and conform to industry security standards. It would also prohibit vendors from supplying devices that have unchangeable passwords or possess known security vulnerabilities.

Republicans Cory Gardner and Steve Daines and Democrats Mark Warner and Ron Wyden are sponsoring the legislation, which was drafted with input from technology experts at the Atlantic Council and Harvard University. A Senate aide who helped write the bill said that companion legislation in the House was expected soon.

"We're trying to take the lightest touch possible," Warner told Reuters in an interview. He added that the legislation was intended to remedy an "obvious market failure" that has left device manufacturers with little incentive to build with security in mind.

The legislation would allow federal agencies to ask the U.S. Office of Management and Budget for permission to buy some non-compliant devices if other controls, such as network segmentation, are in place. It would also expand legal protections for cyber researchers working in "good faith" to hack equipment to find vulnerabilities so manufacturers can patch previously unknown flaws.

As such, it's limited: It only applies to vendors supplying the US federal government. But it's a start.