12345 No Longer Acceptable: UK to Ban Devices with Weak Passwords

Under new regulations in the UK, technology that relies on weak passwords like “admin” or “12345” will be prohibited. These laws mandate that all smart devices must adhere to minimum security standards to protect consumers from hacking and cyber-attacks.

Effective from Monday, as announced by the Department for Science, Innovation, and Technology, manufacturers of various devices such as phones, TVs, and smart doorbells are legally obliged to ensure that internet-connected devices are safeguarded against unauthorized access by cybercriminals. Users will also be prompted to change any commonly used passwords.

Furthermore, brands are required to publish contact information for reporting bugs and issues, and they must be transparent about the timing of security updates. These measures aim to enhance cybersecurity and protect consumers using smart devices.

It is hoped the new measures will help give customers confidence in buying and using products at a time when consumers and businesses have come under attack from hackers at a soaring rate.

The consumer champion Which? said it had been instrumental in pushing for the new measures and it welcomed the changes.

Rocio Concha, a director of policy and advocacy at Which?, said: “The OPSS [Office for Product Safety and Standards] must provide industry with clear guidance and be prepared to take strong enforcement action against manufacturers if they flout the law, but we also expect smart device brands to do right by their customers from day one and ensure shoppers can easily find information on how long their devices will be supported and make informed purchases.”

The science and technology minister, Jonathan Berry, said: “As everyday life becomes increasingly dependent on connected devices, the threats generated by the internet multiply and become even greater.

“From today, consumers will have greater peace of mind that their smart devices are protected from cybercriminals, as we introduce world-first laws that will make sure their personal privacy, data and finances are safe. We are committed to making the UK the safest place in the world to be online and these new regulations mark a significant leap towards a more secure digital world.”

The laws are taking effect as part of the product security and telecommunications infrastructure (PSTI) regime, which aims to strengthen the UK’s resilience against cybercrime.