This story was produced as part of the Colorado Capitol News alliance. It first appeared at cpr.org.
Colorado will remain a national leader in Right to Repair consumer protections after lawmakers failed to advance a bill that would have weakened those laws.
Colorado lawmakers passed three laws in recent years to allow individuals and businesses to fix their own personal property themselves or through independent repair shops. It expanded consumer access to software and information on everything from power wheelchairs to agricultural equipment and digital electronic devices, freeing them from manufacturer control over the repair process.
A bipartisan proposal at the statehouse this year attempted to challenge those laws by carving out an exception for so-called “critical infrastructure:” IT equipment deemed vital for national security or public health and safety.
The bill cleared the Senate by a healthy margin not along party lines, only to fail in the House State, Civic, Military, and Veterans Affairs committee on a seven-four vote.
“We were able to protect repair rights in Colorado - it’s a huge win,” said Danny Katz, CoPIRG executive director in a statement. “There was a broad coalition of cybersecurity experts, businesses, repair advocates, recyclers and people who want the freedom to fix their stuff.”
Backers of the bill argued that hackers and bad actors could exploit Colorado’s right to repair laws to get information from equipment manufacturers intended to aid repairs that would allow them to potentially breach other critical infrastructure. Unrestricted Right to Repair, they said, represents a dire cybersecurity risk for everything from computer systems that control traffic lights and sewer systems to power grid and military networks.
“If you can figure out how to fix something — we've all heard reverse engineering and that is what the adversaries of this country do,” said Republican Rep. Anthony Hartsook. “Once they gain how something is done, they reverse engineer to figure out how to get inside and turn it upside down. That's why we want to have the critical infrastructure exempted.”
Technology companies, including IBM and Cisco Systems, hoped to see the bill pass, along with local business groups and the Colorado Technology Association. They argued that Colorado’s Right to Repair laws might be great for consumer products, but could jeopardize critical infrastructure.
“This is not an argument against repair or against consumer rights,” said Christopher Bresee, director of government affairs for the National Electrical Manufacturers Association, who testified in support of the bill. “It's a recognition that fixing a smartphone is not the same as modifying the systems that keep our lights on.”
But advocates for Colorado’s current laws said those risks were overblown and argued the bill boiled down to protecting profitable repair contracts.
“(Corporations) don't want to break that cycle of them making millions and millions of extra money off of these products,” said Democratic Rep. Brianna Titone, a longtime champion of Right to Repair and the prime sponsor of all three current Right to Repair Laws. “They don't want these small businesses to have any control over their devices.”
As for Governor Jared Polis, for whom Right to Repair has become a signature issue, spokesperson Eric Maruyama said he remains a strong proponent of the laws.
“Manufacturers should not be able to force farmers and Coloradans to pay extreme repair costs or face long repair delays,” Maruyama said.
However the governor has acknowledged the potential need for carve-outs in the future and the need for continued conversations about exclusions, including for critical infrastructure. Colorado's laws do already have some exceptions, for instance, the Right to Repair laws don’t apply to video game devices due to piracy concerns.
And even some cybersecurity experts rejected the bill that would have established those carve-outs. Among them is Billy Rios, a cyber vulnerability researcher and co-founder of the critical infrastructure defense firm QED Secure Solutions, who warned that restricting Right to Repair could actually impede an organization’s ability to respond to a breach or threat.
“If we don't do this properly and we restrict access to tools and information that they might need to actually respond to an active cyber attack, that's going to be bad,” he said.
“When you have an attack against critical infrastructure ... they have to move really quickly,” Rios said. “The responsibility for securing their systems … falls to the people that own and operate the equipment, not the manufacturer.
