By Susan Crawford for Backchannel.
Smart devices aren’t safe. But if we want to shape our urban security, we need to speak up now.
When a slew of websites couldn’t be reached last week, suddenly people across the US started paying attention to the Internet of Things.
It turns out that tens of millions of digital video recorders and other devices connected to the internet and protected only by factory-encoded, easily-brute-force-guessable passwords can be harnessed in the service of gigantic distributed denial-of-service attacks. When those devices were instructed to send huge numbers of messages to computers providing pointers to some very popular websites, the computers on the receiving end were brought to their knees — incapable of processing any requests.
Without the directional signs in place, suddenly huge numbers of sites couldn’t be found. Who knew the Internet of Things could have such a big effect on our daily lives?
Actually, a lot of people knew. IoT is very big business these days.
While we’re patching those insecure home DVRs, routers, and webcams, let’s back up and talk about the implications of IoT for public values generally. Because it’s not just websites that could be affected by unrestrained Internet of Things deployments. We’re not just using IoT in our homes. We’re also going to be using it, in a big way, in the places where 80 percent of Americans live, work, and play: in cities.
A lot of companies have been looking hard at the revenue potential for IoT deployments by cities. (ReadWrite now devotes all of its columnage to IoT, and reports that the “smart city” market will be $1.4 trillion by 2020.)
Although the hype is ahead of actual adoption, the number of conferences devoted to smart cities has exploded. That means that droves of vendors are pitching cities, looking to provide holistic ecosystems of sensors and software designed to understand and manage transport, energy, pollution, water, traffic, and other systems for which cities are responsible.
This is big: Cities are poised to privatize information flowing from the public right of way — data relating to streets, sidewalks, and uses of public infrastructure — without much policy work or consensus about what values they’re trying to serve.
That’s not to say that it will be easy to achieve consensus. The idea of “public values” is inherently squishy. It could include security protections that lower the risk of the the kind of mishap we saw (or didn’t see) last week—but there’s much more to it than that.
If you want smart cities to serve public values, you have to ask questions such as: What societal problem does this technology solve (hunger, health, education)? Does the planned application, and the sharing or exploitation of data concerning it, pose ethical or inequality issues? How will this technology improve the quality of life in the city? How was the public involved in consideration of this technology? How can the technology be abandoned or changed in later years as public understanding of it changes? Public values are difficult to quantify: It’s far easier to gather and report on improvements in efficiency and economic benefits.
There’s widespread enthusiasm among local government officials for installations that can gather and use information; smart cities can track everything from citizens’ habits to aging physical infrastructure. Given the asymmetry of resources between local governments and the companies selling IoT systems to them, someone needs to be asking all of these “public values” questions, all of the time.
New York City took a stab at this enormous set of issues by publishing IoT Guidelines earlier this year. Several large US cities (including Atlanta, Austin, Boston, Charlotte, Chicago, Dallas, Kansas City MO, LA, Philadelphia, Pittsburgh, San Diego, San Francisco, Seattle, and Washington, DC) recently joined the effort, signing on in support of NYC’s guidelines. (At the federal level, the National Institute of Standards and Technology plans to issue a guidebook for government IoT implementations next summer.)
At this point, concerns about individual privacy seem to be driving the conversation. Case in point: The privacy guidelines are listed first by NYC and are the most specific.
But I’m focused on Guideline 5.3, which reads:
The City shall prioritize access to its assets and public networks for IoT device deployments that are distributed in an equitable manner and have the greatest public benefit. Public-private partnerships and business models that offset costs or generate revenue in ways aligned with greatest public benefit are encouraged but must be closely evaluated for risk.
Look, Guideline 5.3 represents a good-faith effort to write down in words the idea that the city’s public assets (streets, lights, et cetera) should be used primarily for public purposes — uses that are fair and have benefits for citizens. But the guideline also encourages public-private partnerships that make money for the city as long as they are “closely evaluated for risk.”
What does that mean? Should cities be involved in exclusive revenue-sharing deals based on data generated using public assets? Are such deals different from city leasing arrangements for the physical elements of the right of way — like poles or streetlights? If cities are in the business of seeing citizens as sources of invisible informational goodies that might be useful to a company offering the city a large revenue share in the future, will those cities still be capable of taking citizens’ interests in autonomy, agency, and dignity into account? And what about security — will cities now in “partnership” with device vendors have the leverage to require the high level of security that will prevent a municipal DDoS outage?
And what does the “greatest public benefit” mean, anyway? That more money comes into the city’s budget office? Or that more people in the city enjoy better lives than they would have otherwise?
It shouldn’t take a dramatic outage to get us focused on IoT. But wise politicos never let a good crisis go to waste. When it comes to city IoT implementations, this maxim may be helpful: Just because you can doesn’t mean you should.
More from Backchannel:
Related
Before You Go
