The Internet of Things — where all of our devices talk to each other, to you and to the cloud — has long been a security concern. We have written about fridges sending spam and smart TVs eavesdropping on your conversations.
Now the Washington Post and the Guardian are shocked (shocked!) to learn from Director of National Intelligence James Clapper that these devices might pose both a security risk and an intelligence opportunity. In a long and scary report to the Senate Armed Services Committee (PDF here), there's exactly one paragraph about the subject, copied and pasted here in its entirety:
Internet of Things (IoT). “Smart” devices incorporated into the electric grid, vehicles — including autonomous vehicles — and household appliances are improving efficiency, energy conservation, and convenience. However, security industry analysts have demonstrated that many of these new systems can threaten data privacy, data integrity, or continuity of services. In the future, intelligence services might use the IoT for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials.
The authors of the Post article suggest that “For the nation’s spy chief to place those threats so high on his list is a big deal.” They go on to suggest that “you can expect America’s intelligence community to use driverless cars, smart thermostats and automated networks for spying purposes.”
The Guardian also goes into full scary mode:
Intelligence officials are not the only ones interested in cracking our hi-tech homes. Knowing when you are in and out, what you have and where you keep it is invaluable information for thieves. And just think what tales your devices could tell divorce lawyers.
There's no question that there's a security problem with our new interconnected devices; just read how the whole world can watch your baby monitor. But the problem doesn’t start with the Internet of Things. Wide-ranging groups from the intelligence community to divorce lawyers have been doing this for years.
For instance, it's kind of silly to worry about them bugging your Nest thermostat when you're carrying around a smartphone. Just today The New York Times revealed that the police department has been using StingRays, which pretend to be cellphone towers and soak up all the information in your phone including your location, since 2008, to collect all kinds of data without a warrant. It’s been very hush-hush. According to the Times:
The devices have been used by police departments across the nation, even as their new owners went to striking lengths to keep them secret. Law enforcement agencies frequently pledged to Harris Corporation, which manufactures many of the devices, or even directly to the Federal Bureau of Investigation that they would not divulge any details about the devices.
And then there's the worry about the intelligence community following driverless cars. In fact, they have been tracking cars with GPS systems like OnStar for years, even in cars for which owners think the service has been cancelled.
As for visual surveillance, there's nothing new about that either. So while I personally draw the line at the Nest Cam, which puts perhaps too much information out there in the cloud, I accept that if someone in the intelligence community wants to know where I am and what I'm doing, they already can, and having them cross-examine my fridge is not going to make a great deal of difference.
Reading James Clapper’s report, I'm far more concerned about another paragraph in which he speaks truth to power, to a congress that refuses to acknowledge that climate change exists:
Extreme weather, climate change, environmental degradation, related rising demand for food and water, poor policy responses, and inadequate critical infrastructure will probably exacerbate — and potentially spark — political instability, adverse health conditions, and humanitarian crises in 2016.
Now that’s something we should be worrying about.