TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Perspectives | Will Privacy Be Part of the IoT Standards Battle? Related reading: CES 2015 Dispatch: Challenges Multiply for Privacy Professionals, Part One


The free flow of information is an exciting prospect, especially as we navigate into the wide-open world of the Internet of Things (IoT). I love that I can easily hook up the latest activity tracker with my smartphone and immediately log calories burned and time slept.

But that’s nothing. We’ve featured a number of dispatches from the Consumer Electronics Show (CES) looking at what a new generation of connected technology will bring for privacy pros, the Personal Privacy Marketplace and, yes, drones. And though privacy is making it into many of these products, “it’s not something you’re seeing in marketing messages alongside the size of screens or the speed of processors,” my colleague Sam Pfeifle writes.

The underlying technological factor, here though, is the protocols dictating how all of these connected devices communicate with one another.

Take, for example, this Computerworld report from a few weeks back on AB Electrolux Chief Technology Officer Jan Brockmann’s attempt to shape the IoT world. How’s he doing that? Well, he wants to standardize IoT protocols so that his appliances can freely communicate with the IoT world. He spent time at CES persuading the big vendors to join his effort.

Brockmann goes on to explain that connecting all these appliances and services will create “lifelong” relationships with customers but warns if no agreement is established, “then this business will not take off.” So there’s definitely a very real economic reason to standardize all of these protocols.

But an important question remains: How is privacy being considered as these protocols develop? Are there devices we don’t want to have talk to each other? Are safeguards being considered to wall off sensitive data? And if sensitive data is being communicated, will it be encrypted?

True, if I’ve put a turkey in the oven and have to run to the store, I’d love to have the ability to see how that bird is doing from my smartphone, maybe even turn down the temp if it’s starting to burn. But do I want my health insurance company to find out that I braised pork belly last week and baked two pecan pies this week or used the stove top to brew a milk stout (my avatar is a hell of a cook and brewer)? And do I want this to be part of my online dossier? Definitely not!

And what about other things, like webcams? We’ve seen how easy they are to hack and how often security protocols aren’t built in. What’s that default password by the way? A quick trip to your nearest electronics store this past Christmas reveals entire sections of smart home gadgets. But there’s been countless reports on how easily smart-home kits are hacked.

This once again puts the onus on privacy pros to dig in and figure out what data is being collected, used and shared. Determining what data is sensitive, or potentially sensitive, will be paramount.

We’re also entering some jurisdictional gray areas in the IoT sphere. There’s no doubt the Federal Trade Commission (FTC) is paying close attention; in fact they’ve already slapped a consent decree on one so-called IoT company. But some argue that the FTC will not be able to regulate IoT. Plus, it’s not exactly clear what will be regulated by other agencies.

Take the Food and Drug Administration (FDA), for example. The Hill reports the agency has proposed new guidelines for health devices, including exercise equipment and other devices that promote a healthy lifestyle. According to the report, the FDA would actually loosen oversight of these products. “General wellness products can include exercise equipment, audio recordings, mobile apps, video games and other products that are typically available from retail establishments,” the FDA stated.

Just imagine all of the hacks we’ve already seen online making their way to IoT devices: from straight-up information theft to extortion.

We’ve seen reports on the ease with which smart homes, pacemakers and connected cars are hacked. But there’s more. Nearly 6,000 gas station devices can easily be hacked and manipulated. Now this wouldn’t, to my knowledge, affect personal information, but 5,800 automated tank gauges “were found to be exposed to the Internet without a password.” (Sounds familiar.)

Now, don’t get me wrong, I’m excited about the new gadgets that will come out in this IoT world. Adam Thierer shared some of the amazing stuff that’s on the horizon as well as the huge challenges ahead for privacy pros. For IoT to truly thrive, Brockmann’s efforts to integrate standardize protocols will likely be needed, but so will comprehensive privacy and security protections.

photo credit: waitscm via photopin cc


If you want to comment on this post, you need to login.

  • comment Peter • Jan 26, 2015
    Good insights and questions. What worries me is that so many industry players talk about the need for standards but totally ignore that there is a whole world of professionally-run standards development work done within recognized national and global standards bodies. If everyone simply cries "I believe in please, everyone, use mine" nothing will progress. Organizations such as the standards consortium OASIS or de jure bodies such as ISO are important here (and in disclosure, I'm personally involved in standardization work in both of these bodies), not only because they provide a level playing field for anyone to be involved - but also already have market traction global recognition, by governments, procurement agencies, and private sector - so why would anyone want to go off and invent standards on their own in some corner somewhere rather than benefit from the existing communities of practice and expertise?
  • comment John • Jan 28, 2015
    It is nice to see someone echoing my own concerns.
    Whilst there seems to be a lot of current privacy concern about IoT, at the moment it appears to be about how the service providers for your devices use the data once it has been legitimately collected. By comparison this should be a small concern compared to the privacy risks of stolen data from direct hacking of devices.
    Mundane example: Light bulbs and thermostats are becoming internet enabled, well what's the harm in that? Without adequate security potential thiefs can monitor your house from miles away to see when your heating is set to low or off for a long period and when your lights are not in regular use i.e. when you are away on holiday. Or if you upset the wrong vindictive person they can triple your electricity bill by switching on all your lights, heating and appliances.
    Many IoT devices are using small mass produced internet enabled chips that have little or no level of security. Unless a fuss is made now, the danger is that such devices will continue to be insecure as the cost of creating custom chips will be uneconomical for such embedded uses. 
    With technology there are risks in creating standards that are too concrete as today's secure design is tomorrow well published security flaw. But both for security enforcement and for interoperability some standardised systems and requirements are getting to be desparately needed. And standardisation means secure mass produced chips can be made that are small enough to put in to your light bulbs.