Importance of Privacy for Smart Cities and IoT
From The Jetsons to Blade Runner, to Back to the Future, to A.I. to The 5th Element, popular culture has long been fascinated by what the future would look like for ordinary people. In these films and countless others, humans of the future are shown engaging with technology that speaks to them, cooks for them, asks them how their day was and connects them with the outside world in a seamless and intuitive way. These are all examples of what we now regard as smart homes and smart cities – living spaces optimized by devices connected through the Internet of Things (IoT), intelligently responding to our needs.
These homes are a natural extension of the smart capabilities that most of us are already carrying around with us in our wearables or mobile phones. When we leave our homes we take that technology with us and now, with the growth of smart cities, we remain in a connected matrix of device communication throughout the day: at home, on the way to work, at work, around town, visiting friends, and so on. We are connected to a continuous stream of shared information.
There are good motives for this. The world’s population is growing at an exponential rate and by 2050 60% of that population is expected to live in cities. Smart technologies are, and will be, critical to the success of these cities in managing the complex challenges created by having so many people in limited spaces: waste management, energy management, water and power management, connectivity, public safety and security. By 2021, spending on smart city tech is expected to reach $135 billion, mostly through public-private partnerships.
Early adopters in Europe included Barcelona and Amsterdam, with Copenhagen, Dubai, Hamburg, Nice and Singapore quickly following suit. In North America, New York, Chicago, Miami, San Francisco, Kansas City and Montreal are also examples of cities implementing smart city initiatives.
Singapore’s “Smart Nation” project is an excellent example. While living in Singapore I was fortunate to work on many Smart Nation-related programs, learning first-hand how such projects incorporate technology across transport, health, home, and business to create a network of interconnected digital experiences that enhance our lives and optimize our work and play.
China has aggressively developed smart cities, which monitor and seek to address common urban challenges like pollution, traffic congestion and widespread energy consumption through connected technologies. The government’s 12th Five-Year Plan announced in 2013 included the development of 103 smart cities, districts and towns.
Less radical and more pragmatic is India’s “Smart City Mission.” Initially investing in 90 cities to develop smart capabilities, this evolving, layered system solves specific issues such as clean water while organically developing smart integrations over time.
In the US, the “Smart City Challenge“ saw more than 78 cities across the country enter the inaugural challenge focused on tackling 21st Century transport issues. Through shared innovation and intelligence the program nurtured ideas for an “integrated, first-of-its-kind smart transportation system that would use data, applications, and technology to help people and goods move more quickly, cheaply, and efficiently.”
Apart from creativity and future-thinking, all smart city projects have one thing in common: data. These interventions rely on the creation, analysis, and processing of massive amounts of the stuff. It is drawn from sensors and devices connected to the IoT, as well as the multitudes of human-machine touch points that make up daily life in a city, as we move into new era of Human-Computer-Interaction (HCI).
With the application of machine learning and artificial intelligence, this data is used to distill insights and opportunities for improved services, enhanced lifestyles, and better human health. Though the system relies on hyper-connectivity – arguably a reality for the first time with the advent of 5G – the data itself is the foundation for the betterment that smart cities promise urban dwellers. It is the seed of tremendous opportunity. But as with all things it comes at a cost, and individuals may have to pay with their privacy.
When Cyber Meets Physical
Cities are no longer bricks and mortar environment solid to the touch. They are now cyber-physical realms built on data as much as they are built on concrete and glass.
Definitions of smart cities vary, but one of my favorites is from the British Standards Institute (BSI):
“THE EFFECTIVE INTEGRATION OF PHYSICAL, DIGITAL AND HUMAN SYSTEMS IN THE BUILT ENVIRONMENT TO DELIVER SUSTAINABLE, PROSPEROUS AND INCLUSIVE FUTURE FOR ITS CITIZENS”
As with physical construction, the building of smart cities follows some fundamental principles. These include:
- Fast, cheap, hyper-interconnectivity that amalgamates the virtual and physical into an inseparable unit
- Mechanisms that handle multi-directional data flows and have points of convergence. This is likely in the form of smart Industrial Control Systems (ICS)
- Machine learning and artificial intelligence to analyze and optimize data usage
- A policy framework that protects the security and privacy of citizens as smart capabilities develop
- A receptive citizenship and smart products, which may be influenced by 4 above
These five tenets focus on and highlight the dynamic flow between technology and humans in the smart city ecosystem. As human systems grow and evolve, data and technological systems evolve with them, leading to exponential improvements in wellbeing. Some examples are:
- NVIDIA Metropolis’s internet-enabled video cameras and AI that provide services such as smart parking — showing IoT car users where the best spot is to park — or traffic management that keeps the traffic flowing.
- IBM’s intelligent waste management platform that provides visualization of data analytics to optimize collection, transportation, and recovery of waste – a critical service in an age when more than 3 billion people live in cities.
- The Internet-enabled containers created by Veolia that tell waste trucks when to come and pick them up, making inefficient pickup routines redundant and saving time, money and CO2 emissions.
- The UK government’s goal of installing smart utility service meters in all 26 million households by 2020 to make energy usage more efficient and transparent.
This new world promises exciting things, but at what cost? What does the individual sacrifice for the greater good? Where are the lines drawn on personal privacy and the use of data? These are nuanced issues, and are difficult enough to solve in situations where data is being collected to help reduce crime and public violence. But what about those instances when your privacy is violated with criminal intent?
Pain or Gain From the Smarter City?
George Bernard Shaw once said: “Science never solves a problem without creating ten more”. In the case of smart cities, where the tendrils of connectivity reach into our homes, our work, our day to day activities and the wider Cloud, Mr Shaw may have been right.
Smart cities and data privacy are often poorly matched. Here are some examples of where they clash:
The smart home: Smart begins at home. We are already embracing the IoT in our homes with lifestyle products like Amazon Alexa and Google Nest. The UK’s Smart Meter initiative mentioned above may not connect to the Internet, but it still transmits private energy and gas usage to a central data reservoir using radio waves. It may not be as compelling as stories of vacuum cleaners used to spy on their owners, but the Smart Meter example is important for precisely that reason. Few people think of their energy consumption as being interesting or usable, not realizing that such data can be used to deduce many things about your living preferences, even what TV shows you enjoy watching. For this reason, organizations like Stop Smart Meters are actively campaigning to protect the privacy of Smart Meter data which they are saying can be sold on and used by marketing companies.
A myriad of technologies is entering our home environment. They are fun, remind us to buy that loaf of bread, and can even sing our children to sleep at night. But anything that can bring data in can send data out. Hacked domestic devices can watch or listen, passing on your sensitive private moments to unknown entities. Such was the case with VIZIO who was ordered to pay $2.2 million to the FTC for collecting viewing histories of smart TV owners without permission, and then selling that information on to third parties.
Out and about in the smart city: In order for a smart city to function optimally it needs self-awareness, in the form of millions of sensors. These include cameras – traffic cameras, street cameras, drone cameras, building cameras – linked to software that performs processes like facial recognition. Beyond concerns of being a victim of unsolicited marketing, these interventions could threaten to create imbalances of power between those who watch and those who are watched.
Smart cities will be navigated through autonomous cars connected by a complex network of sensors. Though there are inherent cyber-kinetic threats in such a system, privacy is also a major concern. A paper from the University of South Carolina demonstrated how a Tire Pressure Monitoring System (TPMS) used in a smart car could be used as a vector to eavesdrop. It also harnessed location tracking to identify potentially sensitive places an individual had visited.
Privacy issues extend beyond the individual to the aggregation of data. In a London-based project “Renew London” “smart bins” were set up to track the MAC address of pedestrian phones. The system was based on a network of sensors which would then be used to aggregate location data against local businesses and put up targeted advertising images on the recycle bins as the person passed by.
Smart working: Wearables such as the Fitbit are no longer limited to personal wellbeing use, they are now being co-opted into “corporate wellness programs“. It may make sense that your positive health data and activity is used to reward and incentivize you, maybe even offer you better insurance. But what of your poor results – could they be used to discriminate against you?
In smart cities, every aspect of our lifestyle and daily histories will be available for the world to see. But privacy risks are often hidden – the most everyday activities divulge information. Charging an electric car can disclose your location and movements. Your power consumption at home reveals what you’re watching on TV. Privacy implications of a smarter world are a complex web of interrelated and correlated data , much of which we are only just beginning to understand.
A briefing paper on Open Data and Privacy states:
“BEFORE ANY DATASET IS RELEASED, THE RISKS TO INDIVIDUAL PRIVACY SHOULD BE SYSTEMATICALLY BALANCED AGAINST THE POTENTIAL VALUE OF PUBLIC DISCLOSURE“
The balance of rights and responsibilities should form the cornerstone of smart city development. The civic open data toolkit from the City of San Francisco is a good example of how privacy and security issues around shared personal data can be addressed. And knowledge bases such as this need to become part of the framework of smart city development. Without a rigorous privacy-focused approach to smart city development, we can only expect a backlash from residents when their most personal information is hijacked for unauthorized purposes.
Being Smart About Smart Cities
Last year it was announced that Bill Gates has bought up 25,000 acres of land in Arizona, with the express purpose of building a smart city from scratch. This is a chance to go beyond the Internet-enabled device, to the Internet-enabled city. In doing so, we have an opportunity to build cities that reduce waste, connect us to our health-practitioners in novel ways, make sure the traffic flows easily, and reduce CO2 emissions, amongst many other things.
But harmful intentions will endure. It is as important that new cities are built with the frameworks and systems in place to prevent privacy violation as it is that they are built with super connectivity. Privacy has become an afterthought, as evidenced by manufacturers rushing to get smart devices like TVs, robot hoovers, and CCTV cameras out to market, only to be punished for noncompliance with data protection laws.
As a global community, we must recognize the complex issues surrounding the lifecycle of smart city data, especially when these data are aggregated or open to abuse or malicious exposure. To take our cities into the next era we need to learn the lessons of the last decade and build a robust privacy infrastructure into the very foundation stones of our future smart dominions.
Marin Ivezic
For over 30 years, Marin Ivezic has been protecting critical infrastructure and financial services against cyber, financial crime and regulatory risks posed by complex and emerging technologies.
He held multiple interim CISO and technology leadership roles in Global 2000 companies.