Beyond Smart Cities: Privacy concerns and ways to protect yourself

For decades, migration to cities from rural areas has been on the high side. This migration trend that has been observed is astonishing. However, it pales in comparison to the future of smart cities.

Smart cities are contemporary cities that harness the power of information technology to improve several aspects of human life. Smart cities reduce environmental footprints because they encourage energy efficiency and renewable energy sources. This also benefits the health of residents through the reduction of air pollution.

Smart sensors in smart cities can also be used to reduce water wastage by spotting pipe leaks. In a smart city, there is bound to be better infrastructure since systems will detect regions that need fixing.

The Privacy Dangers of a Smart City

Despite this implementation of technological advancement, there is a catch: the collection of data. Smart cities are formed with sand, concrete, and most importantly, data. A humongous amount of data is recorded from home appliances, smartphones, refuse bins, vehicles, and so on. A city holding this kind of power is bound to get involved in the misuse of data.

Let’s look at the possibilities. A smart city is touted to contain autonomous vehicles with the benefit of lessened accidents. While facing the advantage, people fail to realize that before this can be achieved, vehicles in a smart city will have to be inter-connected. Will you feel comfortable with thousands of cars tracking your location and movements?

On the issue of smart appliances in the home, it sounds great on paper. But we’ve seen instances of these devices being hacked. For instance, Amazon’s Alexa speakers were used to listen in on customers’ conversations. Samsung’s Smart Fridge was reportedly hacked by the CIA.

Smart cities are also likely to use drones as a means of surveillance. Try to imagine hundreds of drones flying across your city, monitoring every step you take. The result would be an encroachment on human rights and massive breaches of privacy.

There have been instances where smart city project outlines were rejected. In 2017, Google’s smart city project in Toronto faced push back by privacy experts after a review by an independent panel. The panel cited privacy issues as the key antagonist in Google’s project. 

The Remedy to Smart Cities’ Privacy Issues

Before any smart city gets established, the planning of the city should include the residents. A body representing the people should also be consulted on privacy guidelines with the response of the residents upheld. In sections where the people feel they need change, it will have to be implemented.

After the creation of the smart city, the administration will also need to be transparent about data collection, storage, and usage. Besides, citizens can also do their part to protect their personal data. For instance, they should only give out information when necessary and use a VPN to stay private and anonymize their internet activities, especially when they are on public Wi-Fi provided by the government.

(The Big Disrupt) Are Airports Handing Out Your Information?

“Step aside please and take off your shoes.”

What’s not to like about airport security? Everything? That’s about right. As concern about terrorism and smuggling rises around the globe, so too do the security measures at airports. It started with the request to put your shoes on the conveyor for the x-ray machine. Then it stepped up to ‘random searches’ (which some might argue are not so random). Now we have automatic body scanners. In a world where trust is limited, how far can we trust the data collected by airport security?

These days airports and the transportation commissions that run them are catching more heat with each security measure they implement. Why? Mostly due to the fact that people are impatient, but the privacy piece is also very relevant. While the things that we may have in our luggage or carry-on may not be dangerous or illegal, in some cases they may not be things we want others to see. Private notes, embarrassing medical items, that gag gift Larry gave you during the company retreat; the list is long and everyone has a different definition of ‘private’.

How are airports countering these concerns? As an example, Canada is testing automated biometric stations at some of their airports in an attempt to streamline check-in and remove the human element while maintaining a high standard of security. These kiosks will use facial recognition technology to perform a quick check of certain criminal databases to make sure travellers are not a risk. While little information has been disclosed about how the kiosks will work, it has been mentioned that they are able to scan iris’ for comparison against NEXUS databases which exist to expedite entering the US and Canada (CBC).

Questions of both ethics and privacy have been raised in scenarios where this type of biometric technology has been deployed. Australia has announced a plan to implement biometric technology across all of their airports to address a concern around an increase in international travel to and from their country. Ethically, the biggest concern is economic. By implementing a machine to do the work of a person, you lose jobs (Guardian). Another angle is how that data may be used. During the Stanley Cup Riots in 2011, an insurance company defied FIPPA [Freedom of Information and Protection of Privacy Act] and offered to release its database of drivers license photos to Canadian authorities to help identify suspects (Canadian Underwriter). On top of that a machine needs to conform to certain security standards that are constantly changing and nebulous. It is easy for a creative hacker to find an opening nobody has thought to protect to exploit with a ‘Zero Day Attack’ that nobody will see coming.

Attacks like these prove how woefully inadequate digital security is and are a huge cause for concern when considering the sheer amount of data that would be collected at even a single airport. Tens or hundreds of thousands of people who will be forced to trust unproven systems with their personal data. ID numbers, age, address, fingerprints, the list goes on. In short, safety and privacy should not be sacrificed through unproven systems. Biometric programs should be tested through opt-in beta programs and monitored closely before being forced upon the public.

(The Big Disrupt) IoT Security: Security of Internet of Things by @jameslyne

Check out this short but interesting talk with security expert James Lyne as he talks about the security of the Internet of things.

(The Big Disrupt) Bad Security, Big Bucks: Why Enterprise Security Is Going To Be a 150 Billion Market By 2020

As the last few years have proved, bad IT security can be costly and with the recent news that security may become a 170 billion market by 2020, improving IT security more robust isn't going to be any cheaper either 1. 

Organizations have paid the price for a relatively lax approach to IT security and have subsequently created a growing market for cybersecurity products as organizations become more dependent on connected devices expanding significantly the remit of CIO's and CISO'S have keep secure from threats.      

CIO's and CISO's have since been armed with increased security budgets which has also meant that IT security vendors have a bigger market to exploit which explains why the already massive $1o6.3 billion cybersecurity market is going to get even bigger 2. However, with most CIO's and CISO's struggling to source new talent, communicate security threats to the business at board level, and secure the growing number of devices on their organization's network, the $63.7 billion market size increase seems a little conservative to say the least. 

The press release by |MarketandMarkets noted a number of factors including the use of BOYD but what the press release didn't point to is that the cybercrime market has exploded as barriers to entry are low, the tools of the trade are cheap and effective, and the chances of getting caught are remote. These factors leaves CIO's and CISO's at a distinct disadvantage as they can end up spending a king's ransom on integrated security solutions and have their work undone by malware slightly more expensive than an iPhone 6 bought on the dark web. 

When hackers can compromise expensive security systems with such a low overhead, it's only a matter of time before MarketsandMarkets revise their projections. The advent of the internet of things and the increasing use of connected devices in healthcare facilities for example will make organizations more prone to attacks they've proved themselves unable to against with high profile and expensive data breaches throughout 2015 with Anthem health's data breach affecting an incredible 80 million individuals 3.  

In sum, the cyber security market is set for a period of steady growth fuelled by the increased data breaches and the expansion of networks CIO's and CISO's have to protect from attacks but with the market for cybercrime booming and the large chasm between what CIO's and CISO's spend to bolster their security systems and what hackers spend to compromise them, MarketsandMarkets may have to review their  projections as organizations may find themselves under threat in the future than they imagine. 

1. Markets and Markets, 2016, Cyber Security Market worth $170.21 billion by 2020, http://www.marketsandmarkets.com/PressReleases/cyber-security.asp 
2.  Ibid
3.  E. Snell, 2015, Anthem Health Data Breach Could Compromise PII of 80m

(the big disrupt) IT Security: Why do so many organizations still suck at data security?

It has become axiomatic to say that no organization is the same as the other but when it comes to data security, the differences between organizations are few and far between to say the least. 

Back in late 2014, we wrote an article appropriately titled "why so many companies suck at data security" in response to the Sony hack debacle and pointed to number of factors as to why data security was so bad and costly data breaches were on the up and, unfortunately, we can still write the same article with a few updates as not much has changed except the widespread acknowledgement in both public and private sector organizations that data security must become a top priority. 

This acknowledgement of the importance of data security has partly been fuelled by the post Snowden fallout resulting in consumers taking the badly attributed "the price of liberty is eternal vigilance" quote to heart and the endless horror stories of governments and corporations suffering humiliating and costly data breaches which has seen a strong rise in demand for secure product and services. 

Increased demand for secured products and services has had a severe knock on effect on organizations who have astronomically increased their security budgets and created new roles such as CISO's and CSO's and given them the responsibility to keep their data secure.   

However, what we've seen is that CISO's and CSO's have become targets when organizations look for someone to blame for breaches which accounts for why the role has an abnormally high turnover. While it can argued that CISO's and CSO's should be held responsible because they have ultimate responsibility regarding security matters, this mindset almost guarantees that companies will be no more safe from breaches as constant change indicates to attackers as well as potential replacements that their security posture is vulnerable to attack and that they won't be given much time to fix problems. 

In this environment, breaches are bound to occur and even proliferate as organizations collect and store more data. This causes headaches for CISO's and CSO's as the sheer volume of data they're asked to secure expands almost in lockstep with the proliferation of technologies such as the internet of things (IoT) . CISO's and CSO's are already feeling the pressure of securing an ever growing IT infrastructure and with many organizations adopting or planning to adopt the IoT, the pressure on CISO's and CSO's to secure notoriously vulnerable IoT networks as well as the vast reams of data they'll collect is going to be ludicrously high. 

In sum, after years of outright underinvestment and costly failure to take data security seriously, organizations across the board have must come to terms with the fact the IT security is irreducibly complex and with the future growth of connected devices, the irreducible complexity poses a challenge that CISO's and CSO's at the time of writing are not in any sense prepared to tackle with an adequate degree of competency which almost guarantees the headline grabbing data breaches that haunt organizations continue.