How can privacy survive in the era of the internet of things?

As more and more devices are connected, there are two futures when it comes to privacy. Which one will we pick?

Amazon’s new Dash button, which will order replacement products at the touch of a button, might well usher us further towards the internet of things (IoT), in which a variety of connected devices talk to each other, quietly doing our bidding.

The next step: household appliances that re-order consumables automatically, without the need for a button at all. But what does this universe of connected devices mean for our privacy?

Companies have been talking about the IoT for years. There are many possible visions of it. Some think it’s about your smartwatch talking to your car, while your fridge independently talks to the grocery store to order you some more milk.

Others have a more pervasive vision of hundreds, perhaps even thousands, of embedded, invisible devices that you touch in some way throughout your day.

These could include everything from an embedded sensor in a petrol pump that knows whether you are filling your car with regular or premium, through to sensors in your office building that know where you are and display your files on the nearest screen, through to toothbrushes that know how long and vigorously you’re brushing for.

Whichever way you cut it, the IoT is going to be big. In December 2013, Gartner predicted 26 billion devices installed by 2020. That’s not quite on par with Cisco’s 50 billion, but it’s not inconsiderable, given the relative shipments of more traditional devices.

The PC age began in 1981, and while they were predicted to have reached an installed base of 2bn last year, their growth was hindered by tablets and 2-in-1s, which only began shipping in 2010 and of which 230m currently ship each year. The GSMA, which charts the growth of smartphones after Apple shipped the iPhone in 2007, says that by the end of this year there will be 2.2bn of them installed worldwide.

Clearly, as devices become smaller, they tend to ship more quickly. All of these represent just a fraction of the projected IoT device count within four years. It seems pretty clear that an awful lot of them will be sensors.

What will they be sensing? The obvious scenario is health and fitness, thanks to the increasing number of wearable fitness devices on the market. But we are likely to see sensors for everything from public transport passenger counts through to energy meters, medical devices, environmental sensors, home security, parking meters, and vending machines.

A Big Brother made of little things

Whenever someone introduces a pervasive new technology, someone else gets worried about it. With many already worried about surveillance issues, it’s no wonder that nightmare privacy scenarios surrounding the IoT have been popping up.

“The scariest thing is that we don’t know what the scariest thing is,” said Geoff Webb, senior director of solution strategy at identity and access management firm NetIQ.

The problem with the IoT is that no one quite knows what it’s going to look like. It’s a continuum that things like Amazon’s Dash, connected cars and smart meters usher us along, rather than a state that we suddenly enter. No one really understood how the internet was going to affect things, and the impact of the IoT will probably be more pervasive, rolling out over time, but affecting us more immediately and in more profound ways.

One thing we can predict is that an internet of sensors and other devices could generate a vast ocean of information about our activities.

“People can pull that information together in ways that are very difficult to predict,” said NetIQ’s Webb.

Some rental car firms now include sensors in the vehicles that warn drivers if they are driving too recklessly, based on how quickly and volatile its movements are. Some services are using phone services to do the same. He worries that people might be denied car insurance, for example, based on sensors like these delivering data to interested parties.

“The capacity to correlate information is going to change all of those interactions,” worries Webb. “I lose power over a great deal of my life when there’s a massive amount of information over me that I don’t have control over.”

What about other breaches, though, that may be more difficult to avoid, or are simply invisible? Could your utility’s smart meter – or your Google Nest device – know when you arrive and leave at your home based on energy usage patterns? When your smart bathroom scale beams data to a cloud-based health service, could that data be used by a health insurance provider?

Scary scenarios

Some of these things may seem implausible, but there are already worrying signs. Smart TVs have been found to collect a little too much data about your viewing habits and files, or simply beam eavesdropped conversations back to a manufacturer. And US legislators have attempted – but so far failed to enact – the mandatory installation of ‘black box’ recorders in new vehicles.

The scary scenarios are legion, and they’re serious enough that government regulators are getting interested. In January, the FTC produced a report on the IoT, highlighting some of the risks, and suggesting some ways to mitigate them.

Cora Han, an attorney in the privacy and identity protection division at the FTC, said that companies involved with the IoT should consider “data minimisation” a priority.

“Your device may well need to collect information, and that’s fine, but you should be up front about it, and think about if you need to collect all that information, and how you store it, and whether it makes sense to dispose of it when you no longer need it,” she said.

The data she’s talking about has a monetary value, though, which makes it important to those companies. In many cases, their job is to deliver shareholder value, which means making money where they can.

“Many of the reasons that these products are very inexpensive is because part of the business model is the ability to collect and resell your data,” said Chris Rouland, founder and CEO of Bastille, a company that scans for IoT devices and mitigates their security threats. Your sensor-packed wearable device isn’t really the product, he says – you are.

Politicians “irrelevant”

With that in mind, shouldn’t regulators step in and tighten legislation? The FTC advised against IoT-specific legislation, but called for baseline privacy legislation in the US. In the UK and Canada, such legislation already exists.

Forget the law, said Rob van Kranenberg. “Policies are no longer hacking it. Politicians are fully irrelevant,” said the founder of the IoT Council, a loosely-connected group of professionals that consults on the subject. “What are you going to do with innovative startups that disrupt this? Put them in jail? Fine them?”

“If we want to steer these developments we have to build a system together in which to harness the new ‘oil’: the data of our citizens,” he said.

What does that look like? We need more sophisticated conversations about privacy with the companies harvesting our data from these devices, say commentators. The trouble is, few people seem to have figured out what those interfaces might look like yet. With such a vast amount of data being shared about individuals, trying to set those parameters individually will be tough.

James Schmidt, EMEA director of partner product management Intel Security, says it could be transactional, with people agreeing to give up some data to get rewards, say. “We’re already there. It’s just going to be an evolution,” he said, giving fitness wearables as an example. “If you go to a portal to check out how many kilometers you ran, it could say ‘you hit this specific milestone, would you like to get points with this particular vendor’.”

Rouland sees privacy in the IoT as equivalent to the ‘organic’ label on food; something that users may pay a premium for, to get peace of mind.

“I see an opportunity to pay a premium for retaining my own data, or at least guaranteeing that my data is de-attributed from me,” he said, adding that he’d happily pay his fitness wearable provider another $1.99 (£1.33) a month not to sell his data somewhere else.

Giving power back to individuals

Paying the vendor not to breach your privacy feels more like a protection racket. Others want to put privacy square back in the hands of the individual, by giving them the power to dictate who can access their data.

Usman Haque is the founder of Thingful, which he calls a search engine for the IoT. It documents IoT devices around the world, categorising them by function, so that you search for, say, air quality in Manhattan. Haque says that people should be able to set policies governing which devices can talk to the devices that they own, and what information is shared about them.

“I can make data available in real-time to my doctor, but I might delegate access to monthly figures to my mother,” he explains. “And I might be happy to participate in a medical study where I give the years’ aggregate data. So privacy has to be granular.”

Haque and Kranenberg are working on a “device entitlement layer”, in the form of the Dowse Box. This is a device that plugs into your home network, and allows you to define what connects with it, and how. So, if your new smart meter decides to connect to your utility and tell it things about you, the box would let you know, and give you the chance to do something about it. The team is planning a smart meter device with Dowse integrated in it.

Kranenberg sees more utility in such a box than mere data defence, however. “We could build an internet of neighbourhoods platform on these Dowse boxes, where people start sharing music. We could also create a platform for sharing cars, tools, and food – all the things in these transition town kind of things that are happening,” he said.

A market for personal data

Kranenberg envisages a system in which people could auction their data on an IoT version of eBay, selling it to commercial entities if they wish. But he also says they may give access to others who enhance it for them in some way, perhaps even paying those organisations a fee, creating an entire new market for data in which its owners are equal participants and beneficiaries.

What kinds of enhancements might those be? Haque dismisses what he calls the “1950s” vision of the IoT, where your fridge orders you milk and chats to your smart watch. Instead, he envisages an IoT with connected asthma inhalers, which log where they are used and contribute this data to a network of other inhalers. An inhaler could then warn its user when they enter a risky area where lots of people have needed to use theirs.

So, as often happens in science fiction, we are faced with two possible futures, one dystopian, and one utopian. More realistically, we might get one in which we manage to survive and prosper, in spite of the privacy challenges. So, yes, an Amazon Dash-style IoT predicated on consumption and inaction, but also hopefully a more imaginative one, in which creation and co-operation also have agency.

“We are at the beginning of this, and there is an opportunity to set the agenda,” said Haque.

The worrying part is that we don’t seem to be setting the agenda very well right now, with our centralized servers, PCs and smart phones. In fact, with security and privacy breaches popping up weekly, and with systematic government snooping, you might argue that we have done a terrible job.

Are we equipped to learn from our mistakes and take control of our own data in a world that promises to be saturated with sensors? Perhaps the first step is to be aware of the IoT, and what it can do.