Sunday, November 2, 2014

The Internet of Things - Data Regulations

The 'Internet of Things' has been an increasing theme in my computer security class lately, as well as my day to day life. In fact, the internet of things, that is the connection of an increasing amount of devices to the web, is becoming a part of all of our lives whether we are aware of it or not. But what exactly does our fridge being connected to the internet mean for the consumer, and what regulations need to be put in place to protect them? With all these new smart devices it becomes apparent the one thing there is an abundance of: Data.

More and more companies are finding new ways to make money off of our personal data everyday and honestly, I just don't think laws and regulations can keep up with technology. Social media sites like MySpace, Facebook, and Twitter have been making a killing as of late off gathering data they convinced users to willingly hand over to them. LinkedIn put a very nice flare on the whole idea by not making it about your personal life, but your professional one. A respectable twist, because in my opinion that would be the type of data I would want to expose to the world. But my question is, do the users of these sites really know what they are doing with your data? And if they knew, would they be OK with it?

It turns out the answer is usually no, and no. A lot of people are just now realizing they power they have handed to these companies, and that it may be too late to stop it. Facebook's Data Scientists have often been known to operate without bounds. And they get sued for it all the time, it doesn't really seem to phase them. My favorite is when they decided to conduct a mood experiment on over 700,000 users unknowingly. Users news feeds were tampered with to show them updates of happy or sad things, and collected data on how it affected their posts. And I'm sure any Facebook user has noticed that if you make your status "Craving some Ice cream" an advertisement for Ben & Jerry's will pop up on the side bar (or wherever they may have put it now, I haven't been on Facebook in years).

But this post isn't meant to bash social media, and how they trick their users to revealing their most precious information to the world. No, it is about data, it just so happens that they have a lot of it. Data, and the regulations that need to be around it to protect the consumer. Protect the consumer in terms of security and privacy. It is becoming increasingly apparent that if these types of things go unregulated, or unchecked, they could have serious repercussions. The recent "fappening" made people seriously question how secure their information was in their own phone, since people were essentially hacked using a public GitHub module taking advantage of simple brute force. Apple was caught with their pants down when they realized they never implemented a check for number of wrong password guesses.

Many people in the technology community believe that it should remain self-governed. But the FTC is starting to catch on to the movement, and recognize this as a serious issue. The have began by conducting studies and workshops to examine the role of new connecting technologies in our society. This all apparently started when they found out TRENDnet's webcams were being hacked due to bad software. A serious issue of security with a very complex answer, but relatively straight forward. However, the answer to the question of privacy is not quite as clear. As Forbes puts it: "it appears the FTC is taking a serious look at what kind of regulatory steps or oversight are necessary for personal and home devices that collect unique user data and transmit it over the Internet."

This "Internet of Things" as it's referred to now-a-days has been a dream of mine ever since watching Disney's Smart House back in 1999. But what little me was seeing back then was only the magic of it all: instantly having my favorite foods, virtual reality and a bathroom that bathes me. Older, more pessimistic me, only sees one thing behind the Smart Houses that are becoming an ever apparent reality: Data, and the people that will try to make money with it. Think of a fridge that knows what food you eat and when you eat it. A watch that keeps track of your vitals and health records. Or a bed that knows when your sleeping, and knows when your awake. These devices are real, and growing in number every year. They are constantly on, and constantly collecting data, which is essentially property of the company. How easy it would be for your Keurig to send you advertisements of your favorite coffees once they finish implementing bar scanners on their k-cups and eventually make them wireless so you can start your brew from your bed. Besides all the studies they could do on who's drinking coffee, when, how much; all that data is very powerful.

Some will say, who care's? Why does it matter if they know which coffee I like? Well, that's not the point. The point is data is being collected everywhere; it's extremely powerful, and even more profitable. With new technologies in homes like security systems, locks, smoke detectors, all being connected to the internet, the data becomes very serious. I still don't like the fact that my Xbox One is "always watching". 

To be clear, I'm not afraid of technology, and I still want the smart house to become a reality. And I do love the fact that if I Google "Family Guy" on my computer a little card pops up on my tablet the next day to let me know their is an episode on tonight. But all this data has very serious power, and shouldn't be left without checks. The FTC found in a study of 43 health related apps only 15% of them actually were encrypting their data before they sent it, and absolutely none of them bothered to encrypt it locally. It seems insane that such a small number would consider that our personal medical records would be sensitive information. 

Forbes concludes: "It’s clear that the accumulation and real-time analysis of personal data is growing rapidly and will fundamentally alter our expectations of services and privacy. What remains to be seen is whether the industry will successfully address fundamental privacy and security concerns on its own or instead be prodded by regulatory minimums that seek to protect consumer rights without slowing innovation." Although I am completely against 'slowing innovation', I do think something needs to be done on the FTC's part to keep companies from using our personal information inappropriately. And as we have seen this charade play out in many different industries before, history tends to repeat itself.

http://www.forbes.com/sites/amadoudiallo/2013/11/23/ftc-regulation-internet-of-things/
http://www.bizjournals.com/sanjose/print-edition/2014/04/18/home-smart-home-the-290b-internet-of-things-market.html?page=all
http://recode.net/2014/07/09/senator-asks-ftc-to-look-into-facebook-mood-experiment/
http://thenextweb.com/apple/2014/09/01/this-could-be-the-apple-icloud-flaw-that-led-to-celebrity-photos-being-leaked/

No comments:

Post a Comment