The Federal Trade Commission (FTC), the consumer's watchdog within the US government, is responsible for ensuring that commercial entities do not engage in unfair, uncompetitive, or deceptive business practices. Today, the FTC held a public workshop on the Internet of Things (IoT), entitled "Privacy and security in a connected world." The workshop was webcast live, and I was able to listen in to hear the concerns and recommendations of IoT industry leaders.
The agenda for the workshop called for four panel discussions. One explored the smart home, one examined connected health and fitness, and a third looked at connected cars. These are the major emerging application spaces for the IoT where consumer privacy issues are at stake. Much of these discussions were about the kinds of systems appearing in these markets. There was also discussion about the kinds of information these systems collect about consumers, how that information can be used, and how it can be abused. The fourth panel discussion focused on the workshop's main theme of privacy and security in a connected world.
Several key messages repeatedly appeared in these discussions.
Security is essential in IoT designs
As one panelist put it, "Security is like table stakes in the IoT game. You must have it to be able to play." The importance of secure IoT operation has several factors. One is the protection of the data these devices generate -- both from eavesdropping and from corruption by outside agencies. Similarly, the commands and control signals going to these devices must be secure to prevent hijacking of system operations. Security is also essential to prevent these devices from being configured for use in cyberattacks on other systems, such as banking.
However, the panelists agreed that this security needs to be made as transparent as possible to the consumer. As much as possible, security features should be implemented in way that minimizes the need for the user to be involved while maximizing out-of-the-box security. One recommendation was to eliminate the common practice of shipping products with standard default passwords. Systems should be protected with unique passwords, even if the consumer takes no action beyond registering the device with its corresponding support application. Otherwise, adequate security depends on consumer participation in the security setup, which cannot be guaranteed.
A question from the audience raised the issue of cost as an impediment for developers to implement security. Panelists rejected this assessment and said there were many open-source implementations of security functions freely available for developers.
Privacy is a major concern
The panelists all recognized the desire of consumers to keep their private information private. At the same time, sharing of appropriate information is essential to gaining the full benefits the IoT promises. This leaves open the question of how to share information on the IoT without violating privacy considerations.
A few principles arose in the discussions surrounding privacy. One was the idea of depersonalization. If consumer information is disconnected from the consumer's identity, then privacy is preserved. Those accessing the data could have a lot of information about a person, but not the ability to identify that person.
Another principle discussed was ensuring informed consent to allow access to personal information. Panelists universally decried the current practice of publishing privacy policies and getting blanket consents before activating a device. The general impression was that such notification and consent is "a joke," since consumers routinely say yes without review or consideration in order to get on with obtaining use of the recently acquired device. Another approach would be needed. One possibility that was discussed was creating an industrywide seal of approval that would assure consumers that the device and its support applications conform to a uniform set of practices to protect consumer privacy.
We don't know the problems, much less the answers
The IoT will be a disruptive influence on commerce and society. It is difficult to predict all the ways data might be collected, used, and abused. People might not want their cellphones to broadcast their GPS location continually, but they are perfectly happy to have a wrist fitness monitor track their movement and acceleration. Yet that fitness information could be used to extract location if processed appropriately, effectively bypassing any GPS restriction. We simply do not know all the ways the raw data being collected can be turned into information.
Ultimately, one panelist said, we will need to experience the problems that the IoT will generate before we can understand their nature and prepare countermeasures.
The FTC concluded its workshop by acknowledging that it is too early to consider any regulations affecting the Internet of Things. In the meantime, the industry will need to step up and ensure privacy and security issues are baked in to their designs. The FTC will be preparing a report outlining recommendations for best-practices that the industry can adopt. Public comment is invited; send your ideas and comments to firstname.lastname@example.org by Jan. 10, 2014.
— Rich Quinnell, , Editor in Chief, IoT World