Current and Predicted Market Impact of the US Cyber Trust Mark

### Overview This presentation examines the behavioral economics and consumer security decisions surrounding Internet of Things (IoT) devices, focusing on the current and anticipated market impact of the US Cyber Trust Mark (CTM). Grounded in empirical user studies and focus groups, the speaker explores whether consumers understand security labels, whether labels alter purchasing behavior, and how labeling designs intersect with trade policy and country-of-origin biases.

### Key Topics - **Consumer Decision-Making & Usability:** Users balance perceived costs and benefits; many default to insecure options or fail to patch because of downtime, complex privacy policies, or unusable security tools (such as PGP or hardware tokens). - **Evolution of IoT Labeling:** Originating from initiatives dating back to 2015 and legislative efforts such as the Cyber Shield Act, security labeling programs evaluate products across defined technical baselines (e.g., Underwriters Laboratories (UL) IoT Security Top 20 principles, IEEE IoT standards, FTC, and DOT guidelines). - **Comparative Label Testing:** Testing evaluated several formats, including binary US Cyber Trust Mark variants, UL graded shield models, Carnegie Mellon University (CMU) nutrition-style privacy labels, and a five-star/five-lock design. - **Willingness to Pay (WTP):** Using real monetary incentives on the Prolific platform, researchers tested consumer spending choices on a simulated Amazon marketplace. - **Country-of-Origin & Trade Policy:** An unexpected finding showed that security labels—especially binary formats—heavily interact with perceptions of foreign risk, functioning de facto as trade policy favoring US-manufactured products.

### Technical Details & Study Findings - **Label Comprehension & Usability:** The CMU nutrition-style label produced higher factual accuracy regarding specific device features, while simple binary labels and the five-lock design yielded the best balance of helping consumers accurately identify secure devices without inducing design fatigue. The UL graded label caused confusion because consumers associated 'gold' rather than 'diamond' or 'gray' with the highest security tier. - **Marketplace Behavior:** When given $15 to purchase a smart light bulb and retain leftover funds, consumers showed that the presence of security labels consistently reduced purchases of expensive, insecure devices (by 10% to 20%). - **Security vs. Privacy Awareness:** Consumers who prioritized security were 28% more likely to purchase a secure product and paid approximately 20% more for secure items. In contrast, self-identified privacy-conscious consumers (roughly one in five participants) were unwilling to pay a premium for more private devices and mirrored general consumer spending. - **Country-of-Origin Effects:** In tests comparing products labeled 'Made in China' and 'Made in Australia' (with and without FCC/DOD high-risk warning prompts), 75% of participants using binary labels chose the less secure American product over a secure Chinese alternative, even without warning prompts. - **Focus Group Insights:** Consumers struggled to define what qualifies as an IoT device (often failing to recognize smart locks or connected cameras as IoT unless connected to specific assistants like Alexa), demonstrating that a key initial function of the Cyber Trust Mark will simply be defining the scope of consumer IoT.

### Takeaways While immediate broad market shifts may be modest among general consumers, the Cyber Trust Mark creates immediate impact among security-conscious buyers and small-business supply chains that rely on consumer-grade hardware. Security labels penalize expensive, insecure products by aligning price signals with actual device security. Long-term adoption is expected to mirror the Energy Star model, where initial indifference gives way to high consumer reliance as familiarity grows.