2026-09-19T03:47:52Zhttps://dspace.mit.edu/server/oai/requestoai:dspace.mit.edu:1721.1/1222192022-01-31T19:08:40Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023
Daniel Weitzner and Adam Chlipala.
Wood, Clark,S. M.Massachusetts Institute of Technology.
Massachusetts Institute of Technology. Institute for Data, Systems, and Society.
Technology and Policy Program.
Massachusetts Institute of Technology. Institute for Data, Systems, and Society
Technology and Policy Program
Massachusetts Institute of Technology. Engineering Systems Division
2019-09-17T19:47:59Z
2019-09-17T19:47:59Z
2019
2019
https://hdl.handle.net/1721.1/122219
1117710226
Thesis: S.M. in Technology and Policy, Massachusetts Institute of Technology, School of Engineering, Institute for Data, Systems, and Society, 2019
Cataloged from PDF version of thesis.
Includes bibliographical references (pages 77-84).
We discuss a problem: Internet of Things devices running software are vulnerable to accidents and exploitation, a technology solution: preventing exploitable bugs by developing machine-checked proofs of software correctness and security, and a policy lever to incentivize adoption of this solution: a safe harbor from FTC unfairness prosecution for manufacturers that use formal methods to guarantee safer, more secure devices. To motivate the potential of formal methods, we present a technical contribution: a formally verified connected lightbulb switch, proven immune to certain types of software exploits. We discuss a framework, the Common Weakness Enumeration, that the FTC and manufacturers could use as a shared language to explain what classes of software vulnerability a manufacturer will defend against. We outline the authority of the FTC in regards to poor data security practices as unfair practices and how our safe harbor would both provide immunity to participants and be updated over time to continue to incentivize ever stronger software protections.
by Clark Wood.
S.M. in Technology and Policy
S.M.inTechnologyandPolicy Massachusetts Institute of Technology, School of Engineering, Institute for Data, Systems, and Society
84 pages ;
eng
Massachusetts Institute of Technology
MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission.
http://dspace.mit.edu/handle/1721.1/7582
Institute for Data, Systems, and Society.
Technology and Policy Program.
A formal methods safe harbor
Thesis
application/pdf
2019-09-17T19:47:56Z
Publication
Master
ESD
IDSS
unknown
unknown
<Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="44da5267-d636-44eb-baa3-86525ab8abbb">
<Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type>
<Language>eng</Language>
<Title>A formal methods safe harbor</Title>
<PublishedIn>
<Publication>
</Publication>
</PublishedIn>
<PublicationDate>2019</PublicationDate>
<Authors>
<Author>
<DisplayName>Wood, Clark,S. M.Massachusetts Institute of Technology.</DisplayName>
<Affiliation>
<OrgUnit>
</OrgUnit>
</Affiliation>
</Author>
</Authors>
<Editors>
</Editors>
<Publishers>
<Publisher>
<DisplayName>Massachusetts Institute of Technology</DisplayName>
<OrgUnit />
</Publisher>
</Publishers>
<License>http://dspace.mit.edu/handle/1721.1/7582</License>
<Keyword>Institute for Data, Systems, and Society.</Keyword>
<Keyword>Technology and Policy Program.</Keyword>
<Abstract>We discuss a problem: Internet of Things devices running software are vulnerable to accidents and exploitation, a technology solution: preventing exploitable bugs by developing machine-checked proofs of software correctness and security, and a policy lever to incentivize adoption of this solution: a safe harbor from FTC unfairness prosecution for manufacturers that use formal methods to guarantee safer, more secure devices. To motivate the potential of formal methods, we present a technical contribution: a formally verified connected lightbulb switch, proven immune to certain types of software exploits. We discuss a framework, the Common Weakness Enumeration, that the FTC and manufacturers could use as a shared language to explain what classes of software vulnerability a manufacturer will defend against. We outline the authority of the FTC in regards to poor data security practices as unfair practices and how our safe harbor would both provide immunity to participants and be updated over time to continue to incentivize ever stronger software protections.</Abstract>
<Access xmlns="http://purl.org/coar/access_right"
>
</Access>
</Publication>