If we wanted to be heretical, we could say: At last, IT specialists across the board have acknowledged that there are such things as volumes of data that will not fit into a standard database and are almost impossible to deal with using current tools. Only a few old favorites such as Google or Amazon dare – and have done so for a number of years – tackle these large, very large volumes of data. And they even manage to process them efficiently (we assume) and profitably (as we can see).
However, in addition to clicks and links, the internet of things and services will also give rise to new types of data, emerging for instance from the collection of sensor data and the control of actuators. And how these data are dealt with is similar and yet also radically different to what happens in today’s internet. Why? If we imagine the internet of things and services as a depiction of reality built up from all that sensor and actuator data, we can among others draw the following conclusion:
Not only will the model be influenced by reality, but – and this is the crux – the internet of things and services can also have a direct impact on reality, which is to say it will actively change aspects of the real world. This makes certain data, for instance on how things and services are used, extremely sensitive: Even more than today, unauthorized access will not only lead to potentially sensitive or confidential information being divulged, it might also result in owners or authorized users losing control of their things or services.
Let’s have a look at Carole and her two sons Chris and Luke to illustrate the above mentioned: While sitting on the bus on her way back from work, Carole browses her favorite food blogs and decides to prepare something special for dinner. She downloads a promising recipe, remotely checks the contents of their fridge and then compiles a shopping list.
Internet of Things Scenario
Back home, she takes the car to pick up her sons from the kindergarten, who want to watch “Löwenzahn” (a kids’ program) on their trip to the supermarket. Hence, Carole downloads an episode from their home entertainment system to the car multimedia system. She also remotely preheats the oven and switches on the water heating because Chris and Luke have obviously spent the whole afternoon in the sandpit and need to take a bath this evening. (By the way: If you are interested in more scenarios, have a look at these teaser videos provided by Digital Agenda EU on youtube.com: Teaser N° 1. Student or Internet of Things Europe.)
For the above scenario, let us now examine various thinkable types of access rights:
- In the most restrictive case, it is solely Carole and perhaps members of her family, e.g. her sons, who can check the contents of their fridge or switch on the water heating both remotely and for instance via smartphone app. Carole is the producer, the sole owner, and user of the data. No one else is allowed to either see her data or manipulate her devices. No one is allowed to, which – if you think of hackers – does not necessarily mean that no one can do so …
- In a slightly less restrictive case, Carole is again the producer and the sole owner as described above. However, her service providers are allowed to use her (somehow anonymized) data in order to compute statistical models about user groups etc. The provider is thus an additional user of the data. Let us, for reasons of simplicity, assume that data can be anonymized in such a way that Carole or her family cannot be traced although some experts do not believe this is possible.
- In the community-based case, Carole is part of several communities which define their own access rights and security measures. The data may be anonymized or not. For instance, Carole may share her recipes, the contents of her fridge, and her shopping list with the other members of one of this communities, e.g. a community that includes device data and bits of information that are related to cooking and shopping in a certain location. Thus, Carole is the producer and one user of the data. It is defined in the agreement of the community and checked by its members (a) if she is the (sole) owner, (b) who are the (other) users, and (c) what these are allowed to do with the data.
- In the least restrictive case, Carole’s data (anonymized or not) can be accessed and manipulated by everybody. In this case, she is the producer and may or may not be the owner – in any case, she is not the only user. Although, this seems to be completely unrealistic, there are scenarios that do not necessarily involve access restrictions. Let us assume for instance that Carole and her sons run a private weather station and share the data it produces with anybody interested.
Luckily, there are many people who give some thought to security and privacy in the Internet of Things: Some of them do this from a scientific point of view with a technical focus or a legal focus. Some are kind of afraid of the implications or make fun of them, and some call for greater awareness on the mentioned issues.
Now honestly, if you think of the data that you produce now or potentially in the future, what would you share with whom and under what conditions?