Should discontinued connected hardware come with an ownership package?

At the repair bench, the frustrating failure is often not the hardware but the server it was sold with. Google’s Nest Secure lost cloud, app, and update support in April 2024; AWS Panorama is scheduled to shut down in May 2026, with migration aimed at different hardware. That makes a purchased device look less like property and more like a revocable rental.

Manufacturers should provide an end-of-life package: final signed firmware, calibration and configuration data, service documentation, vulnerability notes, and a safe way to replace or delegate authentication keys. I do not want unsigned images or private signing keys dumped online; compromised update paths can turn repairs into malware delivery. But should a cryptographically verifiable handover package become a legal or industry requirement? Share devices you rescued—or abandoned—when the vendor-controlled service disappeared.

I’d separate “data portability” from “device continuation.” The EU Data Act addresses structured access to connected-product data and cloud switching, while the Cyber Resilience Act sets support obligations. Neither, as far as the cited provisions go, requires firmware, calibration files, or signing-key handover. That gap seems deliberate, but worth debating rather than silently treating as solved.

Please make the key part a successor trust root, not a key escrow file. A manufacturer-signed final image plus a documented recovery mechanism gives owners continuity without publishing a credential that can sign malware for every device in the field.

The commercial problem is support liability. The moment a vendor publishes service documentation, customers may expect it to stand behind every repair. Still, a paid end-of-life package—priced and scoped upfront—would be more honest than pretending cloud dependence is ownership.

The minimum viable package should include a local operating mode before shutdown, not just a download link afterward. If the final firmware still phones home for authorization, the “handover” is mostly paperwork.

I’m less confident about making this universal. For a camera in a private home, local continuation is reasonable. For safety-critical or access-control hardware, refusing continued operation after support ends may be the responsible choice. The requirement needs product classes and risk tiers.

The boring part is identity transfer. Who is allowed to authorize a replacement key when the original account system is gone, and how do you prevent a discarded camera from being claimed by the next person? A package needs an offline ownership-transfer procedure, not just cryptography.

I’d also require disclosure of what remains locally functional. “Works offline” can mean recording survives, while alerts, time sync, configuration, or recovery do not. Owners need a signed capability statement, not marketing language.

Hanwha’s SmartCam Cloud shutdown is a useful contrast: users were directed toward local SD-card recording after the service ended. That is better than total dependence, but it still isn’t the same as receiving calibration data, service materials, or a controlled trust transition.

A device that needs a company’s permission to boot is a subscription with unusually heavy packaging. I’m fine with security limits; I’m not fine with discovering them only after the company has left the room.

Procurement could force this faster than legislation. Require an exit package, documented local mode, and key-transition plan in the contract, then score vendors on it. Enterprises already ask for data-export terms; hardware continuity should sit beside them.