This fall, the
SU iSchool has begun to offer Graduate Immersion Milestone Seminars. The
first one is on the topic of "You and the Internet of Things." Graduate students across the iSchool's graduate programs are in attendance, including MSLIS students.
From my perspective, the the pros, cons and pitfalls of
Internet of Things (IoT) is not a topic that is widely discussed in library circles. Yes, we recognize that devices are capturing information, but:
- Do we think deeply about what data is being captured by or in the library?
- Have we thought about how the Internet of Things can make libraries better?
- Have we thought about how the collected data is being stored and secured in the cloud?
- Have we thought about what could happen if our data is hacked?
The speakers this morning were not focused on libraries, but that doesn't mean we can't apply their topics to our library environment. Below you'll see I've inserted some "library thinking" into my notes. Please add comments if you have information to add or questions to ask.
Concerns:
"Things" can live long, software does not.
- New vulnerabilities are addressed with new software
- While you might replace your phone, for example, every two years, it
will receive several software updates during that period. Of course,
people might not apply all of the updates, which could leave a security
gap.
- Imagine people being able to hack into a car or other things, which could be used to do harm
Things with sensitive data are connected
- While you immediately think of banks, there are low tech devices which can capture sensitive data
- Securing sensitive data
- proactive ethical data stewardship
- end to end security processes
- innovate with new technologies
Things are making decisions
- Think about smart locks, smart homes, and smart grids
- need built-in monitoring and then identifying of risks
- There have been attacks on infrastructure worldwide, which was done by attacking the software
The future of securing IoT
- Both customers and businesses need to focus on this
- Need to look at the entire supply chain
While
Snyder did not talk about libraries, consider that libraries are using
software which is stored in the cloud or software as a service (SaaS).
That software could be storing information on library users/patrons,
including private information such as books borrowed. A security breach
could make that information public. Or a security breach could be used
o alter the user data or alter the information on the library's
collection.
Is the personal data stored in libraries a vulnerability that needs more attention?
- Imagine a child changing his/her personal information so the person can check out adult books.
- Imagine someone hacking an library system and wiping out fines.
- Imagine a library's collection information being altered or deleted.
- Imagine the software being delivered as SaaS being altered at the source, rendering all of its implementations useless.
Snyder
noted that the U.S. Is behind in passing laws which would cause
non-for-profits to pay attention to their cyber security concerns.
Are the implications that we as consumers are not aware of, in terms of cyber security?
IoT
is not a single technology, it is a combination of sensors, devices,
networks, and software that work together to unlock valuable, actionable
data. If you are interacting with any part of that ecosystem, you
should be concerned with cyber security.
Garg
asked if people use Dropbox and then asked if people know where the data
is actually stored. We use Dropbox to store a variety of different
data, but we have no idea where that data really is and how it is being
secured.
Data in the cloud can be used by the
cloud service to learn about you, and then use that data, for example,
to send you advertisements.
IoT dilemma - the
information collected by sensors can be used for services that benefit
and simplify people's lives, or it can be used for data mining and other
use cases that raise security and privacy concerns.
Imagine the habits that your sensors know about you.
Garg
noted that a sensor may only collect data, but then transmit the data
to the cloud where it can be analyzed, shared, used, and abused. Once
the data is in the cloud, you have no idea what third parties that data
might be shared with.
Although we do anonymize
data, data gathered on a person from different sources may contain
enough information to de-anonymize all of the data.
Can we collect less data? Is there a minimal amount of data that is needed for a specific function?
While
Garg talked about sensors, it occurred to me that video cameras in our
cities and buildings are collecting our images. Software can be used to
identify people in those videos and it can be done automatically.
Software can also then track where people are traveling and when.
Imagine combining that information with sensor data, which could
disclose more about your state/health when you were traveling through
and between locations.
Garg noted that
companies assume that people do not read privacy policies. She also
asked how are we expected to read the privacy policy on sensors, if
sensors do not have screens?
Both Garg and
Snyder noted that the privacy rules in the EU are better than in the
U.S. The EU rules do affect U.S. residents because of U.S. companies
doing business in Europe and needing to comply with EU policies.
In
the U.S., state and federal laws are not harmonized on what is personal
data. We need to harmonize our laws in the U.S. and then harmonize our
laws with the EU.
Next steps for organization in IoT ecosystem include:
- privacy by design
- privacy notice and transparency
Garg ended by talking about the right to be forgotten, which has been written into EU law.
Kim Rose -
How hospitals are embracing IoT
Rose talked about privacy legislation related to healthcare, such as the
HITECH Act.
Medical devices inside the hospital
- vital sign monitor
- surgical procedures
- intelligent bed
- medical imaging
Outside the hospital
- home sleep study
- CPAP machine
- cardiac monitor
- diabetes blood sugar monitor
IoT has changed how medicine is being practiced.
Rose
didn't connect her talk to libraries, but I can imagine a patient
opting in to having their medical data shared with the hospital's
medical library. That would allow the library to deliver information to
a patient which relates to the person's reason for being in the
hospitals. Yes, that would raise huge privacy concerns. Would the
benefits outweigh the risks?
The talks this
morning have made we wonder about cyber security, the Internet of Things
(IoT), and libraries. Is this an area that we're really talking about?
Who are the library leaders in this space? What conferences are
talking about this?
On Twitter (
#IoTSUiSchool),
Jason Griffey said he is writing a library tech report right now on
sensors. It should be available late 2017 or early 2018.