PRIVACY
Data and the Internet of Things
Internet of Things (IoT) data refers to the intentional or unintentional “exhaust”, or infinitesimal bits of information coming from Internet-connected products, platforms, and applications. Examples include data from “smart” homes, traffic, cars, energy, animals, wildlife, food, pills, toys, clothing, diapers, toothbrushes, lighting, mattresses, refrigerators, romance, “smart” sex, parking meters, and smart city applications. Facial recognition technology (FRT) or even iris or gait recognition technology provide enormous amounts of data between billions of cameras and images scraped from Facebook and other social platforms. (NB: With people wearing masks due to COVID-19, facial recognition technology has become a bit more challenging.) Biometric data will flow from “enhanced humans”, aka the Internet of Bodies (IoB), and even from our minds. Augmented reality (AR), Virtual Reality, and gaming provide additional sources of data. You name it, industry has thought of it. It’s in the works, and data will stream from it. With a move to the IoT, we, and all other beings and things on the planet become providers of mega amounts of data as we go through our day. In fact, we humans are referred to now as “digital workers.”
Why all this data?
If industry has its way, our future will be controlled, monitored, surveilled, and manipulated by artificial intelligence (AI). AI depends on data – The more data there is, the better the AI will be.
Not wanting to fall behind China, lose out on potential economic advantage, or miss out on the many applications AI will afford for controlling COVID-19, and of course, to ensure public safety etc., governments are rushing to deploy millions of 5G antennas and tens of thousands of satellites, and billions of sensors to collect our data. All data is useful. No data bit is inconsequential. Nothing to leave behind.
Our data is collected, mined, analyzed, and stored indefinitely in data centers. The data is used for targeted marketing (aka surveillance capitalism), surveillance, law enforcement, research, smart cities systems, and lots more as the IoT evolves. In fact, a whole eco-system is being built with our data, as the data from one application becomes fodder for the next. Data of course will also be used by hackers for their purposes.
Many IoT products are intentionally built to leak data. But in order to market IoT products, manufacturers must come up with applications that also provide a modicum of benefits to the consumer. But sadly, many IoT products are not even succeeding at that. Many IoT applications are, at best, frivolous, and some shamefully harmful. Two such examples are blue tooth pacifiers for infants and musical tampons for babies in utero.
Data collection also brings with it a host of ethical problems. One such example is EarthNow, a company that is developing live satellite video feed of any spot on earth. If deployed, no place on earth would be free from monitoring. (For more on the ethical ramifications of loss of privacy, please see https://whatis5g.info/ethics/)
Data collected from different sources is combined thereby producing more data and more value. Although much data is anonymous, once collected, fusion databases aggregate the data and then can link it back to the original source. As Peter Van Buren explains in a fascinating 2014 Mother Jones Article,
“In these [fusion databases], information from such disparate sources as license plate readers, wiretaps, and records of library book choices can be aggregated and easily shared. Basically everything about a person, gathered worldwide by various agencies and means, can now be put into a single ‘file.’”
Increasingly, government agencies, such as the FBI and NSA are using biometric identifiers such as facial and iris recognition technology, and even gait recognition technology to amass yet more comprehensive and detailed data on each of us. Facial Recognition Technology has even been introduced in some schools. Referring to the National Security Agency (NSA), a CNET article reports,
“The agency is using sophisticated software to harvest ‘millions of images per day from emails, text messages, social media, video conferences, and other communications, according to the documents [referring to specific classified documents referenced by the NY Times].”
In an NBC News article, Chris Calabrese, Vice President at the Center for Democracy & Technology, states:
“It [facial recognition technology] means that I can identify you and know where you are going in public, I can record and keep that information and you don’t know it’s happening. I know where you are, I know whether you’ve just visited a protest rally, I can identify everybody at that protest rally and I can keep records of that. It has a chilling effect.”
Joel Rosenblatt shares an observation made by Marc Rotenberg, President and Executive Director of the Electronic Privacy Information Center (EPIC):
“Biometric identifiers are a key way to link together information about people, such as discrete financial, medical and educational records.…”
For a more detailed understanding of how our data is collected and used please see,
What does the US government know about you? Posted Feb. 17th, 2018 by Dennis Anon on the Website Privacy.Net
https://privacy.net/us-government-surveillance-spying-data-collection/?
For a good look at privacy and cybersecurity in a 5g-connected world please see,
The Terrifying Potential of the 5G Network April 26th, 2019 | Sue Halpern | The New Yorker
The future of wireless technology holds the promise of total connectivity. But it will also be especially susceptible to cyberattacks and surveillance.
“What is existential to democracy is allowing totalitarian regimes—or any government—full knowledge of everything you do at all times,” he said. “Because the tendency is always going to be to want to regulate how you think, how you act, what you do. The problem is that most people don’t think very hard about what that world would look like.” Robert Spalding as quoted in the article.
https://www.newyorker.com/news/annals-of-communications/the-terrifying-potential-of-the-5g-network
And for more on “smart” cities, please see,
Smile, Your City Is Watching You Local governments must protect your privacy as they turn to “smart city” technology. June 27th, 2019 | Ben Green | NY Times Op-Ed
https://www.nytimes.com/2019/06/27/opinion/cities-privacy-surveillance.html
Metadata vs. Data
Data comes in two forms, data and metadata. Take for example email — the content of an email would be the data. But each email also carries information about the date, time, message size, sender, and recipient of the email, and the specific computer or device used to send the email. These constitute the metadata. Although it would appear that metadata has little value, as it turns out, it’s incredibly useful to law enforcement, governments, marketers, researchers, and cyber criminals.
The more metadata collected, the more valuable the data becomes. Profit is one of the main driving forces behind the collection, sale, and use of big data, as it allows companies to offer more “affordable” IoT products. In the words of Chris Rouland, CEO of Bastille, “Your sensor-packed wearable device isn’t really the product – you are.”
In a Guardian article, Tech titans are busy privatising our data, author Evgeny Morozov explains,
Since data – the fuel of advertising markets – is the source of their profits, tech firms are happy to offer, at highly subsidized rates, services and goods that yield even more data. Ultimately there is no limit as to what kind of goods and services those could be: they might have started with browsing and social networking, but they are as happy to track us exercise, eat, drive or even make love: for them, it’s all just data – and data means cash.
Will Big Data Impact the 4th Amendment?
The 4th Amendment of our Constitution protects our right to privacy. It states that a search cannot be conducted
…without a
warrant, and probable cause supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
But according to the third party doctrine, data collected from a third party does not warrant 4th Amendment protection. So for example, government or law enforcement can access data without a warrant from cell phone companies about where, when, and to whom a particular call was made. Similarly, government and law enforcement can access IoT or smart meter data to use as evidence in court. Note two recent homicide cases, here and here. The rationale is that in using these technologies, customers presumably have agreed to relinquish this information. It should be noted that in some states (such as Pennsylvania, one cannot opt out of a smart meter at all. And in other states, a customer must pay a hefty fee to opt out, rendering “implied consent” meaningless.
Apple Health Data on a smart phone was recently used to gather evidence in a murder trial.
The app recorded a portion of the suspects activity as “climbing stairs”, which authorities were able to correlate with the time he would have dragged his victim down the river embankment, and then climbed back up. Freiburg police sent an investigator to the scene to replicate his movements, and sure enough, his Health app activity correlated with what was recorded on the defendant’s phone.
The streams of data literally oozing from everything we do, and the images increasingly being matched to our data, create a near picture-perfect life log of each of us and the end of 4th Amendment protections.
In Shredding the Fourth Amendment in Post-Constitutional America, author Peter Van Buren states:
In Post-Constitutional America, the government might as well have taken scissors to the original copy of the Constitution stored in the National Archives, then crumpled up the Fourth Amendment and tossed it in the garbage can….Our government spies on us. All of us. Without suspicion. Without warrants. Without probable cause. Without restraint. This would qualify as “unreasonable” in our old constitutional world, but no more.
Van Buren continues:
The techno-gloves are now off and the possible is increasingly whatever an official or bureaucrat wants to do. That means violations of the Fourth Amendment are held in check only by the goodwill of the government, which might have qualified as the ultimate nightmare of those who wrote the Constitution.
Thankfully, in an landmark decision on June 22nd, the Supreme Court ruled that police must get a warrant to obtain location information from cell phones. Hopefully, this will have a positive impact on law enforcement’s access to IoT data.
Who Will Regulate the IoT?
Industry has no interest in regulating privacy in the IoT.
Consumers remain largely unaware of the problems.
Government is reticent to get involved
No one is regulating privacy in the IoT.
Why industry is not concerned with privacy:
A fundamental principle of the IoT is that products must be affordable. Profits from data must be maximized as data equals money. Attending to privacy concerns, cyber security, health, environmental impacts, and social injustices interfere with producing affordable IoT products.
Why consumers are not concerned with privacy:
Consumers would probably be more disturbed about their loss of privacy if they were aware of it. But most are not. And even if they were, there is little they could do about it. Privacy agreements fail miserably due to their complexity. With surveillance cameras, sensors in public spaces, and driverless cars, reasonable privacy agreements would be virtually impossible to orchestrate. Were privacy disclosed and managed, it would jack up the price of IoT products. There is no fail-safe, practical, and affordable way ensure our privacy is protected except by disconnecting. And industry in in no rush to change this.
Surely government will step in to regulate privacy:
The European Union recently passed new laws regulating privacy. (For more on this please see, https://www.eugdpr.org/.) But in the US, there is an unspoken complicity between government and industry. In 2017, Congress voted to remove FCC privacy protections on our Internet use, and President Trump formed the American Technology Council (ATC) to promote “secure, efficient, and economical use of information technology to achieve its missions.” What this council intends to do is as yet unclear, but chances are it wasn’t created to safeguard our privacy. More recently, the House passed S 139, a bill that further removes privacy protections. The Senate will vote on this bill shortly. If passed, it would result in “…broad NSA surveillance of the Internet…and the government will still have access to Americans’ emails, chat logs, and browsing history without a warrant.”
Schneier elaborates on the workings of complicity:
Data that’s illegal for the government to collect, they purchase from corporations. Corporations purchase data from the government. It goes into databases in the United States. It’s bought and sold. And profiles are generated. And those profiles are used, in both cases, to pigeonhole us, to make decisions about us, maybe whether we can get a mortgage, maybe whether we can board an airplane, maybe what sort of credit card offer we see.
Georgetown University professor of law, Julia Cohen, notes this as well. Author Julia Powles quotes her in an article entitled; We are citizens, not mere physical masses of data for harvesting:
In her lecture Cohen outlines the deal we have struck with the ‘surveillance-innovation complex,’ involving a deeply worrying complicity between state and private actors – ‘a mutually satisfactory game of regulatory arbitrage.'”
As things stand now, government is electing to largely steer clear of regulating the IoT so as not to “stifle innovation.”
FCC Chair Wheeler was unequivocal in his views on regulating the IoT:
Turning innovators loose is far preferable to expecting committees and regulators to define the future. We won’t wait for the standards to be first developed in the sometimes, arduous standards-setting process or in a government-led activity. Instead, we will make ample spectrum available and then rely on a private sector-led process for producing technical standards best suited for those frequencies and use cases.
Even if government were to adopt a strong stance on privacy and Big Data, these efforts would likely not succeed. In the digital world. Innovation happens so quickly that by the time legislation is crafted and passed, it’s already outdated.
Policymakers are somewhere between three and 20 years behind what we’re doing. By the time policy is discussed, we’re on the third generation, and the reality on the ground overrides policy. Jim Waldo as quoted in Now arriving: Internet of Things.
Another reason for our government’s inability to regulate the digital world, is that government operates in a compartmentalized manner with each agency having jurisdiction over a specific area. Digital technology touches so many systems simultaneously that it defies regulation by a single agency or branch of government. Schneier explains:
Government operates in silos. In the U.S., the FAA regulates aircraft. The NHTSA regulates cars. The FDA regulates medical devices. The FCC regulates communications devices. The FTC protects consumers in the face of “unfair” or “deceptive” trade practices. Even worse, who regulates data can depend on how it is used. If data is used to influence a voter, it’s the Federal Election Commission’s jurisdiction. If that same data is used to influence a consumer, it’s the FTC’s. Use those same technologies in a school, and the Department of Education is now in charge. Robotics will have its own set of problems, and no one is sure how that is going to be regulated. Each agency has a different approach and different rules.
Finally, the Internet of Things is a global platform. Regulations set in one country will not affect products manufactured in other countries. Schneier calls it “a domestic solution to an international problem.”
Final Thoughts
Even If governments and industry are not asking the following question – we should be: Will the supposed benefits of a particular IoT product outweigh the “downsides” – loss of privacy, cyber security risks, health harms from the increased radiation, impacts on the environment, social injustices, use of conflict minerals, and the vast increase in e-waste? If not, you may wish to do without this IoT product or platform. Enjoy the freedom of one less gadget to configure, one less instruction manual to navigate, and one less useless “thing” that will likely break and end up taking up space in a closet, and ultimately, add more e-waste for our earth to try to digest.
In light of all the harms from the IoT, it might be time to disengage from the gargantuan IoT albatross that is suffocating the public and adversely impacting all life on the planet.
For more up-to-date information about the current state of affairs on regulating privacy and big data in the IoT, see Electronic Privacy and Information Center’s overview, Big Data and the Future of Privacy.
Additional resources on privacy
- Is Facebook's Facial-Scanning Technology Invading Your Privacy Rights? A court case threatens the social network with multibillion-dollar claims. Joel Rosenblatt | Oct. 26, 2016
- Schneier on Security | Website and Blog
- Berkmann Klein Center for Internet & Society at Harvard Privacy Series
- Bruce Schneier on Security and Privacy on the World-sized Web
- The Berkman Klein Center for Internet & Society | Video series 49 videos | Last updated, Mar. 23, 2016
- Electronic Frontier Foundation Defending your rights in the digital world
- Electronic Privacy Information Center (EPIC) "Privacy is a fundamental right"
- Internet of Things; Privacy and Security in a Connected World FTC Staff Report | Jan. 2015
- Evgeny Morozov - What is technological sovereignty Zündfunk Netzkongress 2016
- Click Here to Kill Everyone | With the Internet of Things, we’re building a world-size robot. How are we going to control it? Bruce Schneier | NY Magazine | Jan. 27, 2017
- Privacy in Our Digital Lives: Protecting Individuals and Promoting Innovation January, 2017
- New computers could delete thoughts without your knowledge, experts warn Ian Johnston | 26 April 2017
- Otonomo raises $25M to help automakers make money from connected cars Darrell Etherington | April 7, 2017
- The Electronic Frontier Foundation | Website
- The Universal Declaration of Human Rights "No one shall be subjected to arbitrary interference with his privacy, family, home, or correspondence.”
- Electronic Frontier Foundation (EFF) | Website
- Universal Declaration of Human Rights Privacy International | No one shall be subjected to arbitrary interference with his privacy, family, home, or correspondence.
- IT’S TOO COMPLICATED: HOW THE INTERNET UPENDS KATZ, SMITH, AND ELECTRONIC SURVEILLANCE LAW Steven M. Bellovin, Matt Blaze, Susan Landau, & Stephanie K. Pell| Harvard Journal of Law & Technology
- Phones Move – and So Should the Law Susan Landau | Aug. 16th, 2017 | Lawfare
- Internet of Things (IoT) Electronic Privacy Information Center (EPIC)
- First Digital Pill Approved to Worries About Biomedical ‘Big Brother’ Nov. 13th, 2017 | Pam Belluk | The NY Times
- Why Silicon Valley wants you to text and drive Nov. 30th, 2017 | Jack Barkenbus | The Conversation
- Welcome to the neighbourhood. Have you read the terms of service? Mathew Braga | Jan. 18th, 2018 | CBC News
- GDPR Portal | Website website is a resource to educate the public about the main elements of the General Data Protection Regulation (GDPR)
- Are You Really the Product? The history of a dangerous idea. April 27th, 2018 | William Oremus | The Slate
- Victory! Supreme Court Says Fourth Amendment Applies to Cell Phone Tracking June 22nd, 2018 | Andrew Crocker and Jennifer Lynch | Electronic Frontier Foundation
- Inside China’s Dystopian Dreams: A.I., Shame and Lots of Cameras July 8th, 2018 | Paul Mozur | NY Times
- The Wiretap Rooms June 25th, 2018 | Ryan Gallagher, Henrik Moltke |The Intercept
- Protecting data-driven cyberspace from exploitation (Analysis/opinion) July 9th, 2018 | Joshua Sinai | Washington Times
- he Smart Enough City: Putting Technology in Its Place to Reclaim Our Urban Future (Book) April 2019 | Ben Green, Jascha Franklin-Hodge (Foreword by)
- Alarmed by Admiral's data grab? Wait until insurers can see the contents of your fridge The Guardian | Nov. 2, 2016
- Corporate surveillance, digital tracking, big data & privacy Dec. 29, 2016 | Wolfie Christi | 33th Chaos Communication Congress
- Networks of Control A Report on Corporate Surveillance, Digital Tracking, Big Data & Privacy Wolfie Christl and Sarah Spiekermann
- Internet of things: the greatest mass surveillance infrastructure ever? The Guardian | July 15, 2015 | Does the expanding network of connected devices herald a brave new compact for our digital lives – or the end of politics?
- The government just admitted it will use smart home devices for spying The Guardian | Trevor Tim | Feb. 9th, 2016
- Data populists must seize our information – for the benefit of us all The Guardian | Evgeny Morozov | Dec. 3, 2016 |
- Data populists must seize our information – for the benefit of us all. The Guardian | Evgeny Morozov | Dec. 3, 2016 |
- US intelligence chief: we might use the internet of things to spy on you The Guardian | James Clapper, US director of national intelligence. ‘In the future, intelligence services might use the internet of things for identification, surveillance, monitoring, location tracking, and targeting for recruitment’, says James Clapper, US director of national intelligence. Photograph: Alex Brandon/AP Spencer Ackerman and Sam Thielman | Feb. 9, 2016 |
- The internet of things - the next big challenge to our privacy The Guardian | Jat Singh and Julia Powles | July 28, 2014 |
- How can privacy survive in the era of the internet of things? The Guardian | April 7, 2015 | Danny Bradbury
- Consumer organisations across the EU take action against flawed internet-connected toys BEUC, the European Consumer Organization | June 12, 2016
- Internet-Connected Toys Are Spying on Kids, Threatening Their Privacy and Security Josh Golin, Jeff Chester | Dec. 6, 2016
- Parents Across America - Our Children @Risk
- Class action filed against ‘smart’ dildo for tracking customers intimate movements Sept. 14, 2016
- The Human OSRoboticsRobot Sensors & Actuators Mood-Detecting Sensor Could Help Machines Respond to Emotions Charles O. Choi | Sept. 20, 2016
- Why you may have good reason to worry about all those smart devices Washington Post | Larry Downes | Dec. 6, 2016
- FTC Report on Internet of Things Urges Companies to Adopt Best Practices to Address Consumer Privacy and Security Risks Jan. 27, 2015 | Report Recognizes Rapid Growth of Connected Devices Offers Societal Benefits, But Also Risks That Could Undermine Consumer Confidence
- Any computer connected to the Internet can be hacked by the US government without a warrant Privacy International says the ruling will have 'astounding implications for privacy and security'
- Data Is a Toxic Asset, So Why Not Throw It Out? Bruce Schneller | Mar. 1, 2016
- The Eternal Value of Privacy Bruce Schneller | Wired | May 2006
- Don't Panic. Making Progress on the "Going Dark" Debate Berkman Center for Internet and Society | Harvard Univ. | Feb. 1, 2016
- PF Nov 2016 - The Internet of Things vs. Personal Privacy - Con Position Resolved: On balance, the benefits of the Internet of Things outweigh the harms of decreased personal privacy.
- The Privacy Wars are about to Get a Whole Lot Worse Locus Online Perspectives | Cory Doctorow | Sept. 4, 2016