According to this district court decision, the FTC has no action against the manufacturer of insecure IP-enabled cameras because it cannot show that something bad actually happened yet.
https://consumermediallc.files.wordpress.com/2017/09/dlinkdismissal.pdf
This is dismissal at the failure to state a claim, so the (assuming the ruling stands) it means the FTC cannot act on cybersecurity problems until after harm occurs.
See also: https://www.engadget.com/2017/09/21/ftc-lawsuit-d-link-lax-router-security-took-hit/
This illustrates the problem in the case-by-case adjudication approach v. the rulemaking approach.
https://consumermediallc.files.wordpress.com/2017/09/dlinkdismissal.pdf
This is dismissal at the failure to state a claim, so the (assuming the ruling stands) it means the FTC cannot act on cybersecurity problems until after harm occurs.
See also: https://www.engadget.com/2017/09/21/ftc-lawsuit-d-link-lax-router-security-took-hit/
This illustrates the problem in the case-by-case adjudication approach v. the rulemaking approach.