A large share of these experts wrote about the ways in which solutions might be found to mitigate the risks posed by highly connected life. Some expressed hopes that market forces might punish Internet of Things creators if they do not build safe and reliable products and come to an agreement on appropriate system standards. Some predicted there will be consumer protests that might shame makers of shoddy products. Others expressed the hope that the ever-evolving code underlying the IoT and its connected items will be intentionally aimed \u2013 as a first priority \u2013 at security, safety and human rights while keeping up with the emergence of negative exploitations of the IoT. And they predicted that there may be solutions that could wall off mass-scale attacks on the IoT.<\/p>\n\n
An anonymous<\/strong> vice president of global engagement<\/strong> replied, \u201cThe hacks and attacks to come will be followed by market-driven and regulated demands for increased security and resilience measures, rather than people deciding to disconnect.\u201d<\/p>\n\n Hacks, ransomware and so forth will continue to be a game that we play, but the market will generate fixes and provide services to continue to allow people to participate online.\nSusan Price<\/cite><\/p><\/blockquote>\n\n Robert Bell<\/strong>, co-founder of the Intelligent Community Forum, wrote, \u201cSooner or later, there is going to be a significant wave of cybercrime that makes every company in the ecosystem and every user wake up to the dangers. We may see a step back at that point, but I have confidence that services providers on one side and the users themselves will find solutions that strengthen security online. It unfortunately takes a crisis to make people care.\u201d<\/p>\n\n David Karger<\/strong>, a professor of computer science at MIT, said, \u201cAs it becomes ever easier for computers to kill people, I do expect a dramatic increase in pressure on people in the computing industry to develop more trustworthy and reliable computing systems. There are ways to do that, but they come with costs in time, effort and money that haven\u2019t yet been seen as worth it. I do expect some highly visible and severe incidents to occur, but I expect that people\u2019s chronic preference for fun\/convenience over safety (consider the number of people who still smoke, ride motorcycles, play football, etc.) will continue to drive adoption of risky but convenient IoT technologies.\u201d<\/p>\n\n Brian Behlendorf<\/strong>, executive director of the Hyperledger Project at the Linux Foundation, wrote, \u201cA greater premium than before will be placed on systems that are resilient to failures of different sorts; are focused on individual sovereignty (e.g., personal control over personal technology, if not control over one\u2019s personal data); and are interrogatable (able to answer the question of \u2018why\u2019 \u2013 why it did a certain thing, or recommends a certain course of action). Those greater premiums may be expressed in the form of regulations, or in lower insurance premiums, or in new consumer meta-brands that operate like \u2018organic\u2019 did.\u201d<\/p>\n\n An anonymous associate professor active in wireless research<\/strong> said, \u201cThe Internet of Things is a cyberphysical security disaster in the making. Think Sony Pictures (the company was being run by North Korean-employed hackers<\/a> for some weeks) times 50 billion networked things. Now that is a disaster movie I never want to see. These IoT risks will lead many sensible people to be very wary of the first-generation crap now on offer by Silicon Valley Unicorns and the usual-suspect firms. A new model for cyberphysical system security is needed if it is to be advisable for people to have faith that Internet of Things devices and objects are safe to use and can be relied upon. Fortunately, some of us have been working on such a model for 15 years. The Open Specifications Model for Wireless Grids in the Internet of Things version 0.4<\/a> was released in the fall of 2016, incorporating blockchain, military-grade, embedded system security mechanisms and role-based access control to make the Internet of Things safe. We hope :). The most likely damage is that which is present today, where malware and specifically ransomware takes over carelessly guarded or unprotected systems.\u201d<\/p>\n\n An anonymous professor of computing <\/strong>observed, \u201cDifferent devices can cause different damages (e.g., cars can crash, but a toaster cannot move). Since there is no universal technique for guaranteeing the safety of disconnected devices, it is unlikely that we will be able to develop such universal safety techniques for networked devices. Nevertheless, Underwriters Laboratories does a good job of certifying disconnected devices through experimental measurements. Perhaps a similar experimental approach could be used to certify networked devices as well.\u201d<\/p>\n\n Susan Price<\/strong>, digital architect at Continuum Analytics, wrote, \u201cI do hope that blockchain technologies and user-empowering identity and data management platforms will emerge to enable users to have a better understanding of the value of their data and give them opportunities to monetize it \u2013 or at a minimum, a much more sophisticated awareness of its existence, who has access to it, and its uses. Hacks, ransomware and so forth will continue to be a game that we play, but the market will generate fixes and provide services to continue to allow people to participate online. There\u2019s too much potential benefit for citizens and vendors for such activity to cease.\u201d<\/p>\n\n An anonymous respondent<\/strong> commented, \u201cWe need to throw a lot of engineers at it and perfect AI learning engines aimed at real-time safety systems when objects interface with humans.\u201d<\/p>\n\n Joan Noguera<\/strong>, a professor at the University of Valencia Institute for Local Development, replied, \u201cPrevention mechanisms (anti-hacker, anti-virus, etc.) will most probably be improved, thus diminishing the risks of connectivity.\u201d<\/p>\n\n Jeff Kaluski<\/strong>, who did not share additional identifying details, commented, \u201cTrust is going up as security vulnerabilities are being found and patched; hackers are having a harder time once the potential pitfalls are published. Open source will be the path that the IoT will be secured along.\u201d<\/p>\n\n An anonymous<\/strong> principal at a communications consultancy<\/strong> with previous top-level experience at several of the world\u2019s top technology companies said, \u201cGovernment must work with the tech sector on smart solutions for better security. And yes, it is possible to network objects that will generally remain safe for the vast majority. That\u2019s the case now.\u201d<\/p>\n\n [assuring]<\/p>\n\n\n The train cannot be stopped anymore. Technology providers need to be aware of their responsibility.\nThomas Keller<\/cite><\/p><\/blockquote>\n\n Ray Schroeder<\/strong>, associate vice chancellor for online learning at the University of Illinois, Springfield, commented, \u201cThe Internet of Things will continue to rapidly grow and become more reliable with time. Connectivity and networking will become the lifeblood of effective tools and technologies. Systems will be hardened against intrusion and disruption. While hacking battles may persist, effective technologies will continue to adapt and advance to remain one step ahead of the black hats.\u201d<\/p>\n\n David Morar<\/strong>, a doctoral student and Google policy fellow at George Mason University, replied, \u201cIf engineers and policymakers are able to create infrastructures and standards that prioritize privacy and security, the future will be slightly less dangerous. If one examines technological innovation, the most glaring thing that pops out is that path dependency plays an important part. If the initial steps are not guided by what can already be identified as potential future issues, then the work of mitigation and consolidation later on will be much more difficult. A total reliance on connected software for almost everything in our lives will lead to a significant dependence on technology. After a few generations of such dependence, a critical failure in the system would nearly cripple the world. Thus, another concern that should be addressed would be to prepare for a temporary shutdown of our connected systems, just like we do now for potential power outages.\u201d<\/p>\n\n Thomas Keller<\/strong>, head of domain services at 1&1 Internet SE, based in Germany, and active ICANN leader, wrote, \u201cThe train cannot be stopped anymore. Technology providers need to be aware of their responsibility.\u201d<\/p>\n\n John B. Keller<\/strong>, a director of eLearning, said, \u201cWe need override capabilities and firewalls that will keep contamination from spreading virally. This is especially important in any system that could be directly or indirectly associated with human safety (e.g., navigation, air quality, water quality, food safety). We must have ways to minimize the opportunity that such systems would be compromised and should insist on designs that allow for quarantining to mitigate the effect of malicious or inadvertent corruption.\u201d<\/p>\n\n [only in]<\/p>\n\n\n LT Wilson<\/strong>, who did not provide other identifying details, said, \u201cWe\u2019ll collectively learn as we go. Advances and vulnerabilities and fixes will successively ladder up.\u201d<\/p>\n\n An anonymous executive director at a major provider of open source software<\/strong> observed, \u201cMost of us will become more connected \u2013 and we won\u2019t see the trade-offs \u2013 privacy, security, personal agency, risk of failed systems. At some point, market actors will emerge to give people a connected life with fewer trade-offs and more control. But this will take a long time.\u201d<\/p>\n\n An anonymous managing director<\/strong> replied, \u201cBetter underlying infrastructure \u2013 in hardware and software \u2013 will be developed (two steps forward, one step backward, but progress will be made). Better systems will be developed to limit the damage. It will remain a cat-and-mouse game. If populist governments are able to use the internet (via Facebook, Google, etc.) for their hideous purposes, things will change and people will become far more careful.\u201d<\/p>\n\n An anonymous professor at a major university<\/strong> commented, \u201cTechnology companies will respond to threats by making connected devices more secure. They will tout this security as a competitive feature of their products.\u201d<\/p>\n\n Michael Dyer<\/strong>, computer science professor at the University of California, Los Angeles, said, \u201cI am not a networking expert, but researchers in networking are developing distributed systems that produce quality of service while remaining robust under a wide variety of perturbations.\u201d<\/p>\n\n An anonymous executive producer and creative director<\/strong> commented, \u201cTheft of money, data and identity. Attacks on the government by other nations and organizations. The solution is to create the best super-intelligent AI at any cost and have its interests aligned with ours.\u201d<\/p>\n\n Ed Dodds<\/strong>, a digital strategist, wrote, \u201cMost \u2018hacks\u2019 are still a case where a database administrator is on two payrolls at once (i.e., thumb drives walk). Government IT contractors will continue to classify unnecessary amounts of materials at a \u2018top secret\u2019 level so as to make their services appear indispensable and un-auditable. Private software-defined networks are likely to proliferate as a means to limit some outsider access to the connected sensor grids.\u201d<\/p>\n\n Dariusz Jemielniak<\/strong>, professor of management at Kozminski University and Wikimedia Foundation trustee, said, \u201cCurrent technology already offers much higher levels of security than the market actually uses; there is a scope for radical improvement if people demand it.\u201d<\/p>\n\n Malcolm Pell<\/strong>, an IT consultant, observed, \u201cToo many manufacturers, OEMs, developers see effective security as a cost burden. Also, how do we maintain the security of legacy and unsupported and obsolete devices?\u201d<\/p>\n\n [MIT professor and]<\/p>\n\n\n Adrian Hope-Bailie<\/strong>, standards officer at Ripple, said, \u201cThe vendors who provide Internet of Things services to users will be measured in some way on how well they protect their users, so market pressure will force them to continue to try and stay ahead of the curve with respect to security.\u201d<\/p>\n\n David Williams<\/strong>, who did not share additional identifying details, said, \u201cWe are in for a rocky ride. There are sure to be many very high-profile cases of that connectivity being abused. One of the bigger challenges we\u2019re faced with is how to ensure all those new connected \u2018things\u2019 are connected securely and yet able to be safely updated as new bugs and vulnerabilities are found. Things like Wi-Fi access points and cable modems are cautionary tales as they often are tuned on, connected and never patched. That security patching has to be built-in, bulletproof and secure. Manufacturers need to have the cost of patching and maintaining those \u2018things\u2019 built into their costs, perhaps covered by a \u2018thing\u2019 annuity that would ensure funding for maintenance over the long haul and across mergers and acquisitions.\u201d<\/p>\n\n Ryan Hayes<\/strong>, owner of Fit to Tweet, commented, \u201cIt\u2019s true that our attack surface will just keep increasing as we surround ourselves with devices, but defenses are getting more capable as well (analogous to how people used to leave their houses unlocked when communities were more simple but today they have elaborate security systems and cameras, etc.). What I hope and expect to see coming into the market soon are more tools that use AI to study home network activity and identify anomalies instantly (so if your toothbrush suddenly starts sending large data files to some server overseas it flags and stops that quickly). Protecting home networks needs to be more of the focus as that\u2019s the big weak point right now.\u201d<\/p>\n\n David Krieger<\/strong>, director of the Institute for Communication & Leadership, based in Switzerland, commented, \u201cSystem crashes pose a greater threat than cyber warfare or criminality. Much more work has to be done on data security, AI security, etc., which must be based on global governance structures beyond nationalistic self-interest. Techno-socially, engineering will become a question of \u2018design,\u2019 that is, accounting for all possibilities in the most efficient and aesthetically acceptable way.\u201d<\/p>\n\n Transparency will emerge regarding who has the best interests of global citizens at heart, and who is a manipulating mercenary.\nAnonymous president of\na consulting firm<\/cite><\/p><\/blockquote>\n\n An anonymous director of human rights <\/strong>replied, \u201cPeople will likely have to actively choose to disconnect, meaning that many will automatically become more connected. Governments and companies should consider connectedness by consent instead of by default as a guiding principle, along with articulating clear and effective privacy protections and safeguards \u2013 including greater liability for private actors involved in serious privacy breeches.\u201d<\/p>\n\n Several respondents expressed the hope or expectation that global technology companies will become more willing to be transparent about their processes, security and other aspects of connectedness important to the individuals they serve.<\/p>\n\n An anonymous president of a consulting firm <\/strong>replied, \u201cTransparency will emerge regarding who has the best interests of global citizens at heart, and who is a manipulating mercenary. The politics of control and the politics of appearances will give way to the politics of transparency, which will force corporations to do the right thing for humanity regardless of whether they want to, or not. The sheer volume of discounts made possible when hundreds of millions participate creates a whole new set of global dynamics ripe for innovation. The battle between good and evil will continue online. At issue is which side the majority of the global population makes the choice to join based on personal values. The dire need is for everyone to understand how to achieve a win-win for all citizens globally to actively participate in the interconnected global economy.\u201d<\/p>\n\n Chris Zwemke<\/strong>, a web developer, said, \u201cThe Internet of Things is but a giant playground. As people become more and more aware of security and algorithm dangers, the bar for what is a useful \u2018thing\u2019 will continue to rise. \u2026 What we connect to will shift. People will realize the safety perils of cameras and interconnected cars. The age of having dozens of devices on Wi-Fi will come to an end before the decade and a superior, secure wireless format will emerge. First from a consortium of the typical large industrial players (Google, Apple, Microsoft, Verizon, AT&T, GE, etc.) but it will morph into a regulated space, much like television and radio. I have no idea what the answer will be, but there will be one. Once the secure and trustworthy communication is found and proven, the rise of smart cars and appliances will start in earnest. However that rise is more than a decade away. In the same time span, culture will realize some of our connected things are in fact dumb \u2013 the smart toothbrush \u2013 and the utility of connected things will rise. Perhaps a hurdle of regulation and openness will force the lesser-quality actors out of the field and into the black market where they won\u2019t have anything more than a pestering impact.\u201d<\/p>\n\n Some respondents speculated on ways in which individuals might handle taking some control of personal safety.<\/p>\n\n Crist<\/strong>\u00f3<\/strong>bal Palmer<\/strong>, technical director at ibiblio.org, commented, \u201cPeople are likely to get more sophisticated about segmenting networks, using distinct personas for different devices, and other steps to mitigate the risks associated with what some call \u2018The Internet of Unpatchable Crap.\u2019\u201d<\/p>\n\n An anonymous <\/strong>respondent wrote, \u201cSome sort of \u2018airplane mode\u2019 will become more common, and a sizable minority of people will use it regularly, but most will not disconnect entirely.\u201d<\/p>\n\n An anonymous system analyst<\/strong> commented, \u201cI think that, in fact, people will choose to create some kind of \u2018disconnection sanctum,\u2019 maybe a corner in their house, or an office, or even going into a cafeteria, time after time, where they\u2019ll give away their connections and stay offline for a while, so they can ‘breathe in.’\u201d<\/p>\n\n An anonymous respondent <\/strong>replied, \u201cPeople who see their only option as being exploited will disconnect from whatever is exploiting them, once they learn what\u2019s really going on. \u2026 Everything depends on the quality of mentorship, training, and ongoing support within a trusted support network working to limit online risks and maximize online benefits requiring the least investment in time, energy, cost and prerequisite literacy.\u201d<\/p>\n\n Will Kent<\/strong>, an e-resources staff member at Loyola University-Chicago, used a historical reference to early mail service to introduce more-modern measures needed today, writing, \u201cTwo hundred years ago we were able to make mail safe enough to become the relied upon technology for all sorts of information (health care, social, civic, economic, etc.) so it seems like there should be a safe digital analogue in the technology somehow. It may take business embracing privacy in order to do it (like the government respecting privacy with physical mail). It will also take coordination and de-centralization to preserve balance, back-up and adaptive support to ongoing threats with developing technologies. Lastly, and most problematically, it will take the vigilance of users to demand protection, oversight and transparency. This is the only way we will be able to fix damaged devices in networks or reconfigure things on the fly or call out attackers. As it stands, this conversation is over and things will become more connected. Authoritative bodies must advocate for user education and safety. Even if this is a priority for some, it is not a common practice for all.\u201d<\/p>\n\n Edward Friedman<\/strong>, emeritus professor of technology management at the Stevens Institute of Technology, replied, \u201cThese new technologies will not emerge overnight. As they evolve, people will have an opportunity to evaluate them and adapt to new connections in a judicious fashion. The technology of safeguards will also be evolving and becoming more effective.\u201d<\/p>\n\n Additional anonymous respondents<\/strong> chimed in on risk mitigation:<\/p>\n\n Many respondents called upon government to do a better job holding both the IoT companies that are building the systems and devices and those who perpetrate crimes accountable for their actions. Some said profit considerations are generally prioritized above security in the research, development and rollout of IoT-connected devices and services, and bad actors are often not penalized, from companies that are negligent in the creation of IoT products to criminals or crackers who take negative actions.<\/p>\n\n The issue of how much trust will exist in the face of heightened vulnerabilities likely will be decided on how effective government regulation is and how quickly it goes into effect.\nEvan Selinger<\/cite><\/p><\/blockquote>\n\n M.E. Kabay<\/strong>, professor of computer information systems at Norwich University, wrote, \u201cThe IoT will result in even greater numbers of systems compromised by criminals to create ever-larger botnets (networks of \u2018zombie\u2019 computers responding to instructions from \u2018master\u2019 systems). Botnets are used for generating spam (unsolicited commercial email), and especially for fraud. Use the search string < refrigerator used for botnet<\/a> > for example. Distribution of malware such as ransomware is also facilitated by botnets. Botnets are also used for distributed denial-of-service (DDoS) attacks, in which targets are flooded with overwhelming traffic that can slow response time or even crash the targets. Some of the IoT includes controllers for critical infrastructure. The Stuxnet<\/a> attack on Siemens centrifuges in Iran and other countries demonstrated the long-standing view of information warfare specialists that unprotected or under-protected supervisory control and data acquisition (SCADA) systems could be subverted to cause significant real-world damage, not just effects on information alone. Medical IoT devices are particularly significant when considering possible damage to people; so are connected automobiles, which have become computers with wheels. There are already many examples of how cars can be hacked at a distance; use the search string < car hacked crash<\/a> > for reports. The fundamental issue is that security is an afterthought for much of the IoT; the manufacturers bear few consequences for misuse of their poorly engineered systems, so some managers elect to shift costs away from their development process and simply let consumers bear the brunt of the damages. The calculation is that they can pay less in fines than for better security. The notorious Ford Pinto exploding gasoline tanks is the classic example of this cost-shifting approach. There is no reason<\/em> that IoT security cannot be improved; however, under the current economic system it is largely free from independent regulation. When IoT devices are subject to the same stringent requirements that pharmaceuticals must meet, we will see some reduction of risk.\u201d<\/p>\n\n An anonymous respondent<\/strong> said, \u201cThe IoT will increase the pervasiveness of \u2018transactional overhead\u2019 problems (e.g., adver-surveillance). The desire by IoT providers to preserve the supplemental commercial opportunities afforded by such unwanted side channels will make the IoT less secure, and thus contribute to more frequent and severe incidents over time, but these are unlikely to deter the vast majority of consumers from embracing the IoT more and more unless\/until some profoundly disruptive and unavoidably high-profile incident interrupts the trend.\u201d Another anonymous respondent<\/strong> wrote, \u201cThe necessary incentives to employ and upgrade and maintain the highest security levels of the IoT, may not be able to be driven by market forces \u2013 it remains to be seen.\u201d And another said, \u201cOnline security breaches are going to be a pervasive part of life from here out.\u201d<\/p>\n\n Matt Hamblen<\/strong>, senior editor at Computerworld, wrote, \u201cGovernments in some countries seem on top of the dangers, but the U.S. government is clearly not up to the task and doesn\u2019t seem aware of the dangers or equipped to deal with them as there is a very small consumer protection establishment in place.\u201d<\/p>\n\n [an article published in the North Carolina Journal of Law and Technology]<\/p>\n\n\n An anonymous emeritus professor at a large state university<\/strong> observed, \u201cI see no signs that governments, as presently oriented and influenced, will even attempt to limit the harms that result from a connected Internet of Things. \u2026 Catastrophic failures will occur, and our responses will be inadequate, in part because a population that has become dependent upon this network will not be willing to shut it down.\u201d<\/p>\n\n An anonymous<\/strong> respondent<\/strong> commented, \u201cGovernments won\u2019t be able to do anything as long as they remain willfully ignorant about how these systems work, and they continue to attack security researchers, encryption manufacturers, etc. If they actually worked to create knowledgeable groups within government about technology\/networks they might be able to create some headway by requiring security audits and strongly encouraging (or even requiring) FOSS software on network-critical points that might be able to interrupt some attacks. Technologists would need to critically assess what is going on, instead of assuming that there will be some sort of technological breakthrough (quantum computing for example) that will wave a magic wand to fix everything. Air gapping is possible but would require a complete reversal of the present course. This simply won\u2019t happen in 99%+ of situations.\u201d<\/p>\n\n George McKee<\/strong>, a retired research scientist who began online in 1974, replied, \u201cGovernments will be compelled to step in with regulations regarding \u2018fail-safe\u2019 modes and for \u2018living will\u2019 provisions for security updates and continued operation of backend systems supporting internet-connected devices. This is unfortunately likely to happen only after serious injuries and lost lives occur.\u201d<\/p>\n\n Christine (Malina) Maxwell<\/strong>, entrepreneur and program manager of learning technologies at the University of Texas, Dallas, replied, \u201cCyberwarfare is real \u2013 major breakdowns are more likely to occur as the IoT goes \u2018mainstream.\u2019 There will need to be far more collaboration among governments and technologists to thwart ever-more-sophisticated cyberattacks. The public should be educated on the impact of the Semantic Web \u2013 and it should learn swiftly why it should be pushing for IPv6!\u201d<\/p>\n\n An anonymous vice president of product at a new startup<\/strong> observed, \u201cThe big threat is the deplorable level of security in the Internet of Things ecosystem. \u2026 A combination of an industry standards certification approach like Underwriters Laboratory and regulatory oversight like the Consumer Product Safety Commission could help.\u201d<\/p>\n\n An anonymous principal architect at Microsoft<\/strong> wrote, \u201cIncreased use of IoT devices is inevitable \u2013 but many of these devices are negligently designed. Their designers will need to face civil and criminal liability before they clean up their act.\u201d<\/p>\n\n An anonymous software engineer<\/strong> wrote, \u201cMore people will be more deeply connected despite potential dangers. The system is not closed and will iterate to a balanced trade-off between benefit and risk. It\u2019s not possible to be generally safe with any technology and the benefits will not be worth either the risk or the cost of security, so use will be more limited than the hype suggests. Government intervention will be late to the party and mostly ineffective other than to assign liability. Technologists will have solutions but will be mostly ignored by management until there is liability risk to them. Naturally evolving standards in the marketplace can have a mitigating effect on security risks.\u201d<\/p>\n\n An anonymous<\/strong> respondent<\/strong> observed, \u201cFrom my own experience, I have moved more into networking because it simply has become too much of a nuisance not to. I don\u2019t like it, though, and I don\u2019t believe it is very safe. A government approach to safety might involve a complex physical token that must be read along with a password. The Japanese \u2018inkan\u2019 seal might be the basis of such a system. However, could it be easily replicated by a 3D scanner\/printer? It seems to me that flaws and insecurity are inherent in digital computer technology and will get worse when physical systems are more inter-networked.\u201d<\/p>\n\n\n
Governments should be doing more to regulate negligent companies, punish bad actors<\/h4>\n\n