Preventive regulation moves risk assessment upstream to the level of a device's "capability characteristics," such that a device's capabilities of internet connectivity, autonomous software operation, and remote control alone constitute the regulatory basis