There are billions of devices connected to the Internet, with millions more coming online every day. That’s nice because the Internet is useful and even sometimes fun, but a huge majority of those devices have no business being connected and probably should be unplugged immediately.

The IoT devices that have proliferated in the last couple of years have become punching bags for both security researchers and attackers. It’s open season on Internet-enabled appliances, light bulbs, toys, watches, and anything else that has been hooked up to the network with little in any forethought. The lack of security and privacy protections built into these devices is also starting to draw attention from Capitol Hill and some advocacy groups are asking Congress to act before things get much worse.

The Electronic Privacy Information Center (EPIC), a research group, is one of those groups, saying that manufacturers and consumers don’t have any real reason to fix the security and privacy problems in IoT devices.

“These problems will not be solved by the market. Because poor IoT security is something that primarily affects other people, neither the manufacturers nor the owners of those devices have any incentive to fix weak security. Compromised devices still work fine, so most owners of devices that have been pulled into the “botnet of things” had no idea that their IP cameras, DVRs, and home routers are no longer under their own control,” EPIC wrote in a letter to members of the House Committee on Energy and Commerce, which held a hearing on IoT this week.

“Moreover, consumers rarely have adequate knowledge about the security of an IoT product when they are determining whether to purchase it. This information asymmetry makes it impossible for market forces to regulate the IoT effectively.”