Right to Repair: New Legislation Affecting Security Systems

Proposed right-to-repair (RTR) legislation in states and at the federal level has ignited a nationwide debate between consumer advocates and security device manufacturers.

While RTR legislation is supported by many consumer advocates and independent repair providers, it faces opposition from manufacturers and industry groups. Their concerns often center around issues like intellectual property rights, safety, security, and quality control.

Security device manufacturers insist that they must be granted an exception from right-to-repair legislation so that they can continue to control data that the legislation may place in the hands of bad actors.

Right-to-repair advocates, on the other hand, argue that security threats associated with right-to-repair are overstated and that they have made necessary adjustments to their legislative template to address legitimate security concerns.

In this blog post, we'll dissect the entire controversy, answer critical questions, and shine a light on the competing interests and arguments that are driving the current debate.

Why is Right-to-Repair Legislation Proposed?

With technological advancements, original equipment manufacturers (OEMs) increasingly control access to the parts and information necessary for product maintenance and repair. The monopoly they have creates a complex landscape of benefits and harms.

While manufacturer control over repairs provides quality assurance, it also restricts competition, decreases access to repair services, and may cause increased repair costs.

For small businesses and other organizations in need of occasional device maintenance and repair, the need to repair devices through manufacturer-approved routes presents challenges in terms of cost and flexibility.

Right-to-repair legislation is therefore proposed to break the manufacturer monopoly. In theory, at least, RTR legislation reduces maintenance and repair costs for consumers.

Why is Right-to-Repair Legislation Opposed?

Most RTR legislation would grant consumers and independent repair shops access to the tools, parts, and information necessary to repair technology-based devices, including security systems.

Naturally, manufacturers are opposed to such legislation, and the battle lines have been drawn. Advocates for security system manufacturers—such as the Alarm Industry Communications Committee (AICC) and the Security Industry Association (SIA)—stand in opposition to legislation proposed by the Repair Association and other consumer advocates.

Security device manufacturers argue that such RTR legislation would compromise system security by exposing sensitive information to malicious parties.

In particular, the industry claims that making security codes, passwords, and schematics public would enable bad actors to disable alarm systems and make severe security threats uninhibited.

Potential Security Risks of Right-to-Repair Legislation

While the intentions behind RTR legislation are positive—the empowerment of consumers and the encouragement of marketplace competition—manufacturers raise concerns about the potential security risks of such legislation.

Let's delve into the primary safety concerns posed by manufacturers and their industry advocates:

Exposure of Sensitive Information

RTR legislation would force manufacturers to provide security codes, passwords, system schematics, and other critical information needed for repairs.

While intended for legitimate repair providers, manufacturers contend that such information would inevitably land in the hands of criminals and hackers.

Exploitation by Bad Actors

According to security system manufacturers, right-to-repair legislation that doesn’t exclude their industry would allow malicious individuals to discover underlying system data that could be used to disable or manipulate alarm systems at homes, businesses, and institutions.

What’s more, in an era of interconnected devices, granting access to the inner workings of security systems might expose cyber vulnerabilities. Hackers could potentially use these vulnerabilities to launch cyber-attacks on individual systems and the broader networks they connect to.

If RTR legislation were to affect security systems for critical infrastructure—such as power grids, water supplies, and transportation networks—it could potentially result in catastrophic consequences for large populations.

Other Risks Associated With RTR

Burdensome Overhead for Security Manufacturers

Right-to-repair legislation would harm the security industry generally due to burdensome overhead expenses caused by requirements that manufacturers keep spare parts on hand.

Potential Price Hikes on New Systems

In order to maintain profit levels despite overhead expenses and repair work losses, security system manufacturers may significantly raise prices for new system components.

Compromised Functionality

Manufacturers propose that broad right-to-repair legislation would enable unqualified or ill-intentioned repair providers to alter security systems. Without proper vetting or training, these individuals could inadvertently or intentionally make security systems vulnerable.

The Repair Association’s Defense of RTR Legislation for Security Products

Acknowledgment of Security Concerns

Upon recognizing the unique considerations of the security industry, the Repair Association has adjusted its proposed legislation template, adding language to make code requirements clear and addressing other security concerns.

Separation of Repair Design and Cybersecurity Design

The Repair Association has asserted that there is no connection between designing for repair and designing for cyber risk.

While manufacturers claim that bad actors may gain sensitive information, the Repair Association argues that manufacturers wouldn't need to provide cybersecurity backdoors in the repair documentation they’d be required to share.

Compliance with Existing Laws and Regulations

The Repair Association emphasizes that many local building codes or state laws already require that repairs be made only by providers who are licensed or have some form of official qualification. They argue that these existing legal frameworks can further reduce the risk of unqualified people gaining access to repair materials.

Right-to-Repair Legislation Landscape

RTR Legislation in the States

The Repair Association has a legislative template that has significantly influenced state RTR laws. The template provides a standardized foundation for right-to-repair legislation and has streamlined the adoption process of RTR across various jurisdictions.

In fact, the Repair Association’s legislation template has already been used more than 100 times in 43 states to create RTR laws.

New York's RTR Legislation

New York's amended RTR law is seen as a win for security device manufacturers, as it was amended to exclude the security industry. The New York legislature justifies this exemption by emphasizing the unique safety requirements of security devices and the potential risks associated with broad repair access.

Instead, New York’s passed right-to-repair legislation is restricted to products that aren’t related to security.

Congress’s RTR Legislation

The Fair Repair Act (H.R.4006) is federal legislation that was introduced in 2021 to require manufacturers to make diagnostic and repair equipment and knowledge available to independent repair providers.

While the particular proposal is unlikely to be taken up without significant adjustment, the debate is not over, and new federal RTR proposals are likely in the future.  

Mammoth Security Stays on Top of Right-to-Repair Legislation

As the future of RTR legislation continues to unfold, our team at Mammoth Security is closely watching developments.

Not only do we keep track of the regulatory environment affecting security systems, but we’re always on the lookout for new technologies and security practices. Let us leverage our knowledge to provide your business or institution with a reliable, cost-effective, future-proof, and expertly installed integrated security system infrastructure.

For a 100% FREE site survey and security consultation with a friendly and knowledgeable member of our team, just fill out the simple form below. Don’t be shy. We’re here to help!