The 'third platform'
Okay, so we're producing lots of personal data on what we do, what we use, and perhaps even what we say, but surely the data protection laws in place will always apply? "The IoT is an aspect of the 'third platform', the convergence of mobile, social and data, with cloud data centres as the engine room," says Richard Kemp, founder of Kemp IT Law, who adds that it comes with an explosion in growth of unstructured, internet-generated digital data. Much of it is personally identifiable, and so governed by the 100 or so national laws around the world protecting data privacy.
"So much growth in so much personal data threatens to overwhelm data protection law around the world," says Kemp. In the face of such a massive increase in the amounts of personal data, a new EU draft Data Protection Regulation is on the cards. "It's likely to lead to other structured approaches and solutions based around more systematised personal control for the individual about how their personal data is used – like value exchanges, tiered permissioning, central storage and audited use."
In short, you'll be allowed to choose what you share. Privacy will become a commodity to be controlled by each of us on every device that connects to a network that IoT data-harvesting gadgets also connect to.
Is the smart home safe?
Not yet, as proved by some hacks recently seen on NAS drives that installed 'ransomware', encrypting the contents and demanding a ransom fee to regain access. "Imagine if someone could do the same with your internet-connected TV or IoT smoke alarm?" says Gary Newe, Technical Director, F5 Networks. "We need to do more to secure the operating systems these devices run, keep them up to date, and disable services that are not needed."
Newe advises against mass panic, but insists that the smart home is only as safe as the devices that are used in it. "So far these devices, and their manufacturers, have not demonstrated an ability to create safe devices," he says.
No silver bullet
"There is no silver bullet in security," says Josh Bressers, Security Product Manager at Red Hat, who thinks that all parts of IoT architecture need to be secured, from the devices to the gateway tier and the data centre. "We are currently at a very early stage in this new industry, we don't yet fully understand the challenges we will face around privacy – we all know privacy is important, but how everything will come together is still a mystery."
One thing's for sure; the arbiters of the IoT are not going to protect privacy or anonymise personal data unprompted. "If these companies really cared about an IoT, we would see open APIs become the norm in new product development cycles as opposed to the decline that is now occurring," says Laguna, who recently wrote about Facebook's updated API. "If 22% of users have stopped using an online service over concerns about data privacy, then it is clear that there is a market for services and commodities that have greater respect for privacy, transparency and trust."
Privacy has become a commodity like any other, but only for the tech-savvy minority – it's not yet widely recognised enough to become a mainstream product. Regulators will have a role to play in changing that, but the demand for privacy of often highly personal data will have to come from the general population itself. The stage is set for IoT devices and platforms with far more flexible terms and conditions that put privacy front and centre.
