Deloitte provides process for nuanced IoT strategy decisions

So much of the Internet of Things is still in the gee-whiz stage that we haven’t seen much in terms of nuanced IoT strategies. By that I mean ones that carefully weigh tradeoffs between companies and consumers to try to find strategies that are mutually beneficial and recognize there are new factors at play in IoT strategies, such as privacy and data mining, that may have positive or negative consequences for the customer/company interplay.

Deloitte’s “University” has made an important step in that direction with its “Power Struggle: Customers, companies and the Internet of Things” paper, co-authored by Brenna Sniderman and Michael E. Raynor.

In it, they explore how to create sustainable strategies that will be mutually beneficial to the customer and company — which are not always immediately apparent, especially when you explore the subtleties of how these strategies might play out in the new reality of the Internet of Things.

The study’s goal was to understand the factors that can distort IoT’s benefits, and instead create win-win IoT strategies.

Sniderman and Raynor suggest there are four quadrants into which a given strategy might fall:

  1. (the sweet spot!) “All’s well: Sufficient value is created, and that value is shared between customers and companies sufficiently equitably such that both parties are better off and feel fairly treated.
  2. “Hobson’s choice: A Hobson’s choice exists when you’re free to decide but only one option exists; thus, it is really no choice at all…. Even when customers come out ahead compared with their former options, their implied powerlessness can lead to feelings of unfairness.
  3. “Gridlock: In their quest for value capture, both sides are pulled in opposite directions, with neither able to move toward an optimal outcome. Here, both parties recognize IoT enablement as something that should lead to success, but neither party is able to reach it, since their competing interests or different value drivers are working at cross purposes.
  4. “Customer is king: Although particular IoT deployments might make economic sense for companies, customers end up capturing a disproportionate share of the new value created, pulling this outcome more in the customers’ favor; Craigslist is an obvious example.”

According to the authors, a key to finding the win-win, “all’s well” solution is the Information Value Loop (which I first discussed last Spring) that creates value out of the vast increase in information made possible by the IoT.

As I mentioned then, “This fits nicely with one of my IoT ‘Essential Truths,’ that we need to turn linear information flows into cyclical ones to fully capitalize on the IoT.” When you do that, it’s possible to design continuous improvement processes that feed back data from actual users to fine tune products and processes.  GE has found it leads to much shorter iterative loops to design improved versions of its products.

Here’s the gussied-up version of the cool hand-drawn visualization from the Deloitte brainstorming session that led to the Information Value Loop (print it & place it on your wall next to the one on privacy and security that I wrote about a while ago):

Deloitte Information Value Loop

The information no longer flows in linear fashion: it’s created from using sensors to record how things act in the real world, then goes through the various stages of the loop, each of which is made possible by one of the new technologies enabling the IoT.  The goal is either enhanced M2M integration among things, or improved actions by humans, and, to be sustainable over time:

“A value loop is sustainable when both parties capture sufficient value, in ways that respect important non-financial sensibilities. For example, retailer-specific and independent shopping apps can use past browsing and purchasing history—along with other behaviors—to suggest targeted products to particular customers, rather than showing everyone the same generic products, as on a store shelf. Customers get what they want, and companies sell more.

…  “The amount of value created by information passing through the loop is a function of the value drivers identified in the middle. Falling into three generic categories—magnitude, risk, and time—the specific drivers listed are not exhaustive but only illustrative. Different applications will benefit from an emphasis on different drivers.”

OK, so how does this theory play out?

Sniderman and Raynor picked a range of IoT-informed strategies to illustrate the concept, some of which may include unintended consequences that would harm/turn off customers or companies. For example, “An ill-considered push for competitive advantage could well overreach and drive away skittish customers. Alternatively, building too dominant an advantage may leave customers feeling exploited or coerced, a position unlikely to prove viable in the long term.”

Understanding the underlying structure of each type of loop is critical, because they naturally pull an IoT strategy in a particular, divergent way.

The example they pick to illustrate the “all’s well” quadrant of results is the dramatic increase in built-in diagnostic technology in cars.  This is of great personal interest: genetic testing has revealed that I am one of the approximately 10% of men who are missing the male car gene: I can’t stand the things, and view them as a big block of metal and plastic just waiting to develop problems (or, ahem, get hit by deer …), so I need all the help I can get. Sniderman and Raynor zero in on maintenance as one area for win-win benefits for drivers and dealers through the IoT:

“Customers often have little understanding of which repairs are necessary, feel inconvenienced by having to go without their car during maintenance periods, and are frustrated by potential overcharges. In response, automakers are embedding sensors that can run a wide range of reliable diagnostics, allowing a car to “self-identify” service issues, rather than relying on customers (“Where’s that squeaking coming from?”) or mechanics (“You might want to replace those brake pads, since I’ve already got the wheels off”). This creates a level of objectivity of obvious customer value and enables automakers to differentiate their products. Interactive features that work with customers’ information can further add value by, for example, potentially syncing with an owner’s calendar to schedule a dealership appointment at a convenient time and reserving a loaner vehicle for the customer, pre-programmed with his preferences to minimize the frustration of driving an unfamiliar car.

In this scenario, both parties collaborate to provide and act on data, in a mutual exchange of value. The customer captures value in multiple ways: He enjoys increased convenience and decreased frustration, improved vehicle performance and longer operating life, reduced maintenance charges, and—since almost everything about this interaction is automated—fewer occasions for perceived exploitation at the hands of unscrupulous service providers.

Value capture extends to companies in the form of ongoing customer interaction. Linking maintenance programming to the dealership encourages customers to return for tune-ups rather than go elsewhere, ideally leading to continued purchases in the long term. OEMs can also access data regarding vehicle maintenance issues and may be able to identify systematic malfunctions worthy of greater attention. Dealers also have an opportunity to make inroads into an untapped market: Currently, just 30 percent of drivers use the dealer for routine maintenance…”

Kumbaya! But then there’s the opposite extreme, according to Sniderman and Raynor, represented by smart home devices, which would lead to the lose-lose, gridlock scenario.  I think they seriously underestimate the understanding already by manufacturers in the field that they need to embrace open standards in order to avoid a range of competing standards (Zigbee, Bluetooth, etc.) that will force consumers to invest in a variety of proprietary, incompatible hubs, and therefore discourage them from buying anything at all.  All you have to do is look at new hubs, such as Amazon’s Echo, which can control devices from WeMo, Hue, Quirky, Wink — you name ’em, to realize that sharing data is already the norm with smart home devices.

Because this missive is getting long, I’ll leave it to you, dear reader, to investigate Sniderman & Raynor’s examples of the “customer is king” scenario, in which the customer grabs too much of the benefit (have to admit, a lot of the location-based IoT retail incentives still give me the creeps: I hate shopping under the best of circumstances, and having something pop up on my phone offering me an incentive based on my past purchases makes a bad experience even worse. How about you?); and the “Hobson’s choice” one, in which usage-based car insurance runs amok and insurers begin to charge unsafe drivers a surcharge — as documented by the devices such as Progressive’s “Snapshot” (I was dismayed to read in the article that Progressive is in fact doing that in Missouri, although I guess it’s a logical consequence of having objective evidence that someone consistently drives unsafely).

I can’t help thinking that the 800-pound gorilla in the room in many of these situations are the Scylla and Charybdis of the IoT, threats to privacy and security, and that makes it even more important that your IoT strategies are well thought out.

They conclude that, from my perspective, data isn’t just enough, you also need the decidedly non-technical tools of judgment and wisdom (aided by tools such as their Information Value Loop) to come up with a sustainable, mutually advantageous IoT strategy:

“Identifying where the bottlenecks lie (using the Information Value Loop), how each party is motivated to respond, and seeking to shape both incentives and the value loop itself puts companies more in control of their destinies.

“Second, taking a hard look at who benefits most from each IoT-enabled transaction, understanding when a lopsided value-capture outcome tips too far and becomes unsustainable, and taking steps to correct it may also lead to long-term success.

“Lastly, an honest assessment of where IoT investments may not have an appreciable benefit—or may decrease one’s potential for value capture—is just as crucial to a company’s IoT strategy as knowing the right places to invest.”

I may quibble with some of their findings, such as those about smart homes, but bravo to Sniderman and Raynor for beginning what I hope is a spirited and sustained dialogue about how to create sustainable, mutually-advantageous IoT strategies!  I’ve weighed in with my Essential Truths, but what are you thinking about this critical issue, often overlooked in our concentration on IoT technologies? 

Give It Up, People: Government Regulation of IoT Is Vital

Could this be the incident that finally gets everyone in the IoT industry to — as I’ve said repeatedly in the past — make privacy and security Job 1 — and to drop the lobbying groups’ argument that government regulation isn’t needed? 

I hope so, because the IoT’s future is at stake, and, frankly, not enough companies get it.

I’m referring to the Chrysler recall last week of 1.4 million Jeeps for a security patch after WIRED reported on an experiment in which two white-hat hackers remotely disabled a Jeep on an Interstate from miles away, exploiting a vulnerable link between its entertainment and control systems.  Put yourself in the place of reporter Andy Greenberg, then tell me with a straight face that you wouldn’t be out of your mind if this happened to you:

“As the two hackers remotely toyed with the air-conditioning, radio, and windshield wipers, I mentally congratulated myself on my courage under pressure. That’s when they cut the transmission.

Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed, then slowed to a crawl. This occurred just as I reached a long overpass, with no shoulder to offer an escape. The experiment had ceased to be fun.

At that point, the interstate began to slope upward, so the Jeep lost more momentum and barely crept forward. Cars lined up behind my bumper before passing me, honking. I could see an 18-wheeler approaching in my rearview mirror. I hoped its driver saw me, too, and could tell I was paralyzed on the highway.

“You’re doomed!” Valasek [one of the hackers] shouted, but I couldn’t make out his heckling over the blast of the radio, now pumping Kanye West. The semi loomed in the mirror, bearing down on my immobilized Jeep.”

OK: calm down, get a cool drink, and, when your Apple Watch says your heart beat has returned to normal, read on….

But, dear reader, our industry’s leaders, assumedly knowing the well-publicized specifics of the Chrysler attack, had the hubris to still speak at a hearing of the Internet Subcommittee of the House of Representatives Judiciary Committee last week and claim (according to CIO) that that government regulation of the IoT industry wasn’t needed.

CEA CEO Gary Shapiro said in calling for government “restraint”:

“It’s up to manufacturers and service providers to make good decisions about privacy and security, or they will fail in the marketplace….. Industry-driven solutions are best to promote innovation while protecting consumers.”

Sorry, Gary: if someone dies because their Jeep got spoofed, the survivors’ attorneys won’t be content with the company’s failure in the marketplace.

There are some important collaborative efforts to create privacy and security standards for the IoT, such as the AllSeen Alliance. However, as I’ve written before, there are also too many startups who defer building in privacy and security protections until they’ve solved their technology needs, and others, most famously TRENDnet, who don’t do anything at all, resulting in a big FTC fine.  There are simply too many examples of hackers using the Shodan site to hack into devices, not to mention academics and others who’ve showed security flaws that might even kill you if exploited.

One local IoT leader, Paddy Srinivasan of LoMein, gets it, as reported today by the Boston Globe‘s Hiawatha Bray:

“‘I think it is a seminal moment…. These new devices need a fresh approach and a new way of thinking about security, and that is the missing piece.'”

But it’s too late to just talk about self-policing.

Massachusetts’ own Ed Markey and his Connecticut counterpart, Richard Blumenthal, have called the associations’ bluff, and filed legislation, The Security and Privacy in Your Car Act (AKA SPY Car, LOL)  that would require the National Highway Traffic Safety Administration (NHTSA) and the Federal Trade Commission (FTC) to establish federal standards to secure cars and protect drivers’ privacy. It would also create a rating system — or “cyber dashboard”— telling drivers about how well the vehicle protects drivers’ security and privacy beyond those minimum standards. This comes in the wake of the Markey study I reported on last Winter documenting car companies’ failure to build in adequate cyber-hacking protections.

Guess what, folks?  This is only the beginning.  Probably the only thing I’ve ever agreed with Dick Cheney on (ok, we agree it’s cool to have been born in Wyoming and that Lynne Cheney is a great writer), is that it wouldn’t be cool for the Veep to have his pacemaker hacked, so you can bet there will be legislation and regulations soon governing privacy and security for wearables as well.

As I’ve said before, I come at this issue differently from a lot of engineers, having earned my keep for many years doing crisis management for Fortune 100 companies that bet the farm by doing dumb things that could destroy public trust in them overnight. Once lost, that trust is difficult, if not impossible, to regain.  Even worse, in this case, cavalier attitudes by even one IoT company, if the shock value of the results is great enough, could make everyone in the industry suffer.

So, if you’re arguing for no regulation of the IoT industry, I have just one suggestion: shut up,clean up your act and take a positive role in shaping regulations that would be performance-based, not prescriptive: the horse has already left the barn.

Now I have to check my Apple Watch to see when my heart rate will get back to normal.


Every IoT office needs this graphic on privacy and security

Long-time readers know that I frequently rant that privacy and security are Job 1 when it comes to the IoT.  

No apologies: it’s because I spent many years in corporate crisis management, and I learned the hard way that public trust is hard to earn, easy to lose, and, once lost, difficult or impossible to regain.

That’s why I was so glad to see this really informative, attractive, and scary infographic from Zora Lopez at Computer Science Zone, because it lays everything out so vividly.  Among the key points:

  1. (seen this before, but it still astounds me) In 2011, 20 typical households generated as much data as the entire Internet did as recently as 2008.
  2. the number of really-large (on scale of e-Bay, Target, etc.) data thefts grow annually.
  3. the bad guys particularly go after extremely sensitive data such as health, identity and financial.

It concludes with a particularly sobering reminder (you may remember my comment on the enthusiastic guys who presented at Wearables + Things and cheerfully commented that they would eventually get around to privacy and security — NOT!):

The barrier to entry in tech has never been lower, leaving many new organizations to later grapple with unsatisfactory security.” (my emphasis)

So: print a copy of the following for every employee and new hire, and put it on the cube’s wall immediately (here’s the original URL:

IoT Privacy and Security, from Computer Science Zone

Smart Cities: opportunity … and danger if security isn’t a priority

Smart cities are one of the Internet of Things’ most promising areas — as well as one of the most potentially dangerous.

As this list of smart city initiatives shows, The IoT can reduce energy consumption, cut operating costs, and improve the quality of life. However, if hacked, it could also potentially paralyze an entire city and plunge it into darkness and/or create traffic gridlock.

As in so many other IoT areas, which scenario wins out will rest increasingly on making security and privacy in smart cities an absolute priority from Day 1, not an afterthought.

A recent New York Times article brings the issue to the foreground again, through the work of Cesar Cerrudo, an Argentine security researcher and chief technology officer at IOActive Labs, who showed what happens when idiots (so sue me…) decide not to make security a priority:

” (he) demonstrated how 200,000 traffic control sensors installed in major hubs like Washington; New York; New Jersey; San Francisco; Seattle; Lyon, France; and Melbourne, Australia, were vulnerable to attack. Mr. Cerrudo showed how information coming from these sensors could be intercepted from 1,500 feet away — or even by drone — because one company had failed to encrypt its traffic.

“Just last Saturday, Mr. Cerrudo tested the same traffic sensors in San Francisco and found that, one year later, they were still not encrypted.”

Even worse, Cerrudo found the same failure to bake in obvious security measures such as encryption in a wide range of other smart city devices and software.

The article goes on to cite a variety of very real cybersecurity threats to cities and critical infrastructure (don’t forget that about 85% of the nation’s critical infrastructure is in private ownership) including a break-in at a utility’s control network by a “sophisticated threat actor” that just guessed a password.

Among the measures Cerrudo suggests that cities take to reduce their vulnerability:

  • think of cities “as vast attack surfaces that require security protection just as a corporate network might.”
  • encrypt data, use strong passwords, and patch security holes
  • create computer emergency response teams (CERTs), for rapid response
  • restrict data access and monitor who does have it.
  • “Finally, he suggests that cities prepare for the worst, as they would for a natural disaster.”

He concluded:

“When we see that the data that feeds smart city systems is blindly trusted and can be easily manipulated — that the systems can be easily hacked and there are security problems everywhere — that is when smart cities become dumb cities.” (my emphasis)

Let me be blunt about it: whether in smart cities or any other aspect of the Internet of Things, if your attitude is “we’ll get around to security” after concentrating on product development, you’re irresponsible and deserve to fail — before your irresponsibility harms others.

BTW, here’s a great way for you to have a role in shaping tomorrow’s smart cities. IBM (who would have thunk it?  I suspect this is reflects Ginni Rometty’s change in direction and attitude at the top) has created People for Smarter Cities, a new site to crowdsource ideas for how to make cities smarter. It’s a great example of democratizing innovation, one of my IoT Essential Truths. I plan to contribute and hope you will as well!

Virtual Sensor Networks: a key #IoT tool?

I was once again honored to be a guest on Coffee Break With Game Changers Radio today with David Jonker and Ira Berk of SAP — it’s always a delight to have a dialogue on the Internet of Things with these two brainy guys (and hats off as well to moderator/host Bonnie Graham!).

Toward the end of the show, Ira brought up a concept that was new to me: virtual sensor networks.

I’ve got sensors on the brain right now, because I’m frankly worried that sensors that don’t have adequate baked-in security and privacy protections and which can’t be ungraded as new opportunities and threats present themselves may be a threat to the IoT because they typically remain in use for so many years. Ah, but that’s a topic for another post.

According to Wikipedia, Virtual sensor networks are an:

“… emerging form of collaborative wireless sensor networks. In contrast to early wireless sensor networks that were dedicated to a specific application (e.g., target tracking), VSNs enable multi-purpose, collaborative, and resource efficient WSNs. The key idea difference of VSNs is the collaboration and resource sharing….
“… A VSN can be formed by providing logical connectivity among collaborative sensors. Nodes can be grouped into different VSNs based on the phenomenon they track (e.g., rock slides vs. animal crossing) or the task they perform. VSNs are expected to provide the protocol support for formation, usage, adaptation, and maintenance of subset of sensors collaborating on a specific task(s). Even the nodes that do not sense the particular event/phenomenon could be part of a VSN as far as they are willing to allow sensing nodes to communicate through them. Thus, VSNs make use of intermediate nodes, networks, or other VSNs to efficiently deliver messages across members of a VSN.”

Makes sense to me: collaboration is a critical basic component of the human aspect of the IoT (one of my IoT “Essential Truths), so why shouldn’t that extend to the mechanics as well?). If you have a variety of sensors already deployed in a given area, why should you have to deploy a whole new set of single-purpose ones to monitor a different condition if data could be synthesized from the existing sensors to effectively yield the same needed information?

2008 article on the concept said the virtual sensor networks are particularly relevant to three categories where data is* needed:

“Firstly, VSNs are useful in geographically overlapped applications, e.g., monitoring rockslides and animal crossing within a mountainous terrain. Different types of devices that detect these phenomena can relay each other for data transfer without having to deploy separate networks (Fig. 1). Secondly, VSNs are useful in logically separating multipurpose sensor networks, e.g., smart neighborhood systems with multifunctional sensor nodes. Thirdly, VSNs can be used to enhance efficiency of systems that track dynamic phenomena such as subsurface chemical plumes that migrate, split, or merge. Such networks may involve dynamically varying subsets of sensors.”

That article went on to propose a flexible, self-organizing “cluster-tree” approach to create the VSN, using tracking of a pollution plume as an example:

“…  a subset of nodes organizes themselves to form a VSN to track a specific plume. Whenever a node detects a relevant event for the first time it sends a message towards the root of the cluster tree indicating that it is aware of the phenomenon and wants to collaborate with similar nodes. The node may join an existing VSN or makes it possible for other nodes that wish to form a VSN, to find it. Use of a cluster tree or a similar structure guarantees that two or more nodes observing the same phenomenon will discover each other. Simulation based results show that our approach is more efficient and reliable than Rumor Routing and is able to combine all the nodes that collaborate on a specific task into a VSN.”

I suspect the virtual sensor network concept will become particularly widespread as part of “smart city” deployments: cash-strapped municipalities will want to get as much bang for the buck possible from already-deployed sensors, without having to install new ones. Bet my friends in Spain at Libellium will be in the forefront of this movement!

Thanks, Ira!

*BTW: if any members of the Grammar Police are lurking out there (I’m a retired lt. colonel of the Mass. State Grammar Police myself), you may take umbrage at “data is.”  Strictly speaking, the proper usage in the past has been “data are,” but the alternative is becoming so widespread that it’s becoming acceptable usage. So sue me…


The Internet of Things’ Essential Truths

I’ve been writing about what I call the Internet of Things’ “Essential Truths” for three years now, and decided the time was long overview to codify them and present them in a single post to make them easy to refer to.

As I’ve said, the IoT really will bring about a total paradigm shift, because, for the the first time, it will be possible for everyone who needs it to share real-time information instantly. That really does change everything, obliterating the “Collective Blindness” that has hampered both daily operations and long-term strategy in the past. As a result, we must rethink a wide range of management shibboleths (OK, OK, that was gratuitous, but I’ve always wanted to use the word, and it seemed relevant here, LOL):

  1. First, we must share data. Tesla leads the way with its patent sharing. In the past, proprietary knowledge led to wealth: your win was my loss. Now, we must automatically ask “who else can use this information?” and, even in the case of competitors, “can we mutually profit from sharing this information?” Closed systems and proprietary standards are the biggest obstacle to the IoT.
  2. Second, we must use the Internet of Things to empower workers. With the IoT, it is technically possible for everyone who could do their job better because of access to real-time information to share it instantly, so management must begin with a new premise: information should be shared with the entire workforce. Limiting access must be justified.
  3. Third, we must close the loop. We must redesign our data management processes to capitalize on new information, creating continuous feedback loops.
  4. Fourth, we must rethink products’ roles. Rolls-Royce jet engines feed back a constant stream of real-time data on their operations. Real-time field data lets companies have a sustained dialogue with products and their customers, increasingly allowing them to market products as services, with benefits including new revenue streams.
  5. Fifth, we must develop new skills to listen to products and understand their signals. IBM scientists and medical experts jointly analyzed data from sick preemies’ bassinettes & realized they could diagnose infections a day before there was any visible sign. It’s not enough to have vast data streams: we need to understand them.
  6. Sixth, we must democratize innovation. The wildly-popular IFTTT web site allows anyone to create new “recipes” to exploit unforeseen aspects of IoT products – and doesn’t require any tech skills to use. By sharing IoT data, we empower everyone who has access to develop new ways to capitalize on that data, speading the IoT’s development.
  7. Seventh, and perhaps most important, we must take privacy and security seriously. What responsible parent would put an IoT baby monitor in their baby’s room after the highly-publicized incident when a hacker exploited the manufacturer’s disregard for privacy and spewed a string of obscenities at the baby? Unless everyone in the field takes privacy and security seriously, the public may lose faith in the IoT.

There you have ’em: my best analysis of how the Internet of Things will require a revolution not just in technology, but also management strategy and practices. What do you think?

Apple ResearchKit will launch medical research paradigm shift to crowd-sourcing

Amidst the hoopla about the new MacBook and much-anticipated Apple Watch, Apple snuck something into Monday’s event that blew me away (obligatory disclaimer: I work part-time at The Apple Store, but the opinions expressed here are mine).

My Heart Counts app

Four years after I proselytized about the virtues of democratizing data in my Data Dynamite: how liberating data will transform our world book (BTW: pardon the hubris, but I still think it’s the best thing out there about the attitudinal shift needed to capitalize on sharing data), I was so excited to learn about the new ResearchKit.

Tag line? “Now everybody can do their part to advance medical research.”

The other new announcements might improve your quality of life. This one might save it!

As Senior VP of Operations Jeff Williams said in announcing the kit,  the process of medical research ” ..hasn’t changed in decades.” That’s not really true: as I wrote in my book, the Quantified Self movement has been sharing data for several years, as well as groups such as CureTogether and PatientsLikeMe. However, what is definitely true is that no one has harnessed the incredible power of the smartphone for this common goal until now, and that’s really incredible. It’s a great example of my IoT Essential Truth of asking “who else could use this data?

A range of factors cast a pall over traditional medical research.

Researchers have had to cast a broad net even to get 50-100 volunteers for a clinical trial (and may have to pay them, to boot, placing the results validity when applied to the general population in doubt).  The data has often been subjective (in the example Williams mentioned, Parkinson’s patients are classified by a doctor simply on the basis of walking a few feet). Also, communication about the project has been almost exclusively one way, from the researcher to the patient, and limited, at best.

What if, instead, you just had to turn on your phone and open a simple app to participate? As the website says, “Each one [smartphone] is equipped with powerful processors and advanced sensors that can track movement, take measurements, and record information — functions that are perfect for medical studies.” Suddenly research can be worldwide, and involve millions of diverse participants, increasing the data’s amount and validity (There’s a crowdsourcing research precedent: lot of us have been participating in scientific crowdsourcing for almost 20 years, by installing the SETI@Home software that runs in the background on our computers, analyzing data from deep space to see if ET is trying to check in)!

Polymath/medical data guru John Halamka, MD wrote me that:

“Enabling patients to donate data for clinical research will accelerate the ‘learning healthcare system’ envisioned by the Institute of Medicine.   I look forward to testing out Research Kit myself!”

The new apps developed using ResearchKit harvest information from the Health app that Apple introduced as part of iOS8. According to Apple:

“When granted permission by the user, apps can access data from the Health app such as weight, blood pressure, glucose levels and asthma inhaler use, which are measured by third-party devices and apps…. ResearchKit can also request from a user, access to the accelerometer, microphone, gyroscope and GPS sensors in iPhone to gain insight into a patient’s gait, motor impairment, fitness, speech and memory.

Apple announced that it has already collaborated with some of the world’s most prestigious medical institutions, including Mass General, Dana-Farber, Stanford Medical, Cornell and many others, to develop apps using ResearchKit. The first five apps target asthma, breast cancer, cardiovascular disease, diabetes and Parkinson’s disease.  My favorite, because it affects the largest number of people, is the My Heart Counts one. It uses the iPhone’s built-in motion sensors to track participants’ activity, collecting data during a 6-minute walk test from those who are able to walk that long. If participants also have a wearable activity device connecting with the Health app (aside: still don’t know why my Jawbone UP data doesn’t flow to the Health app, even though I made the link) , they are encouraged to use that as well. Participants will also enter data about their heart disease risk factors and their lab tests readings to get feedback on their chances of developing heart disease and their “heart age.” Imagine the treasure trove of cardiac data it will yield!

 A critical aspect of why I think ResearchKit will be have a significant impact is that Apple decided t0 make it open source, so that anyone can tinker with the code and improve it (aside: has Apple EVER made ANYTHING open source? Doubt it! That alone is noteworthy).  Also, it’s important to note, in light of the extreme sensitivity of any personal health data, that Apple guarantees that it will not have access to any of the personal data.

Because of my preoccupation with “Smart Aging,” I’m really interested in whether any researchers will specifically target seniors with ResearchKit apps. I’ll be watching carefully when the Apple Watch comes out April 24th to see if seniors buy them (not terribly optimistic, I must admit, because of both the cost and the large number of seniors I help at The Apple Store who are befuddled by even Apple’s user-friendly technology) because the watch is a familiar form factor for them (I haven’t worn a watch since I got my first cell phone, and most young people I know have never had one) and might be willing to use them to participate in these projects.

N0w, if you’ll excuse me, I just downloaded the My Heart Counts app, and must find out my “heart age!”


Doh!  Just after I posted this, I saw a really important post on Ars Technica pointing out that this brave new world of medical research won’t go anywhere unless the FDA approves:

“As much as Silicon Valley likes to think of itself as a force for good, disrupting this and pivoting that, it sometimes forgets that there’s a wider world out there. And when it comes to using devices in the practice of medicine, that world contains three very important letters: FDA. That’s right, the US Food and Drug Administration, which Congress has empowered to regulate the marketing and research uses of medical devices.

“Oddly, not once in any of the announcement of ResearchKit did we see mention of premarket approval, 510k submission, or even investigational device exemptions. Which is odd, because several of the uses touted in the announcement aren’t going to be possible without getting the FDA to say yes.”

I remember reading that Apple had reached out to the FDA during development of the Apple Watch, so I’m sure none of this comes as a surprise to them, and any medical researcher worth his or her salt is also aware of that factor. However, the FDA is definitely going to have a role in this issue going forward, and that’s as it should be — as I’ve said before, with any aspect of the IoT, privacy and security is Job One.



FTC report provides good checklist to design in IoT security and privacy

FTC report on IoT

FTC report on IoT

SEC Chair Edith Ramirez has been pretty clear that the FTC plans to look closely at the IoT and takes IoT security and privacy seriously: most famously by fining IoT marketer TrendNet for non-existent security with its nanny cam.

Companies that want to avoid such actions — and avoid undermining fragile public trust in their products and the IoT as a whole — would do well to clip and refer to this checklist that I’ve prepared based on the recent FTC Report, Privacy and Security in a Connected World, compiled based on a workshop they held in 2013, and highlighting best practices that were shared at the workshop.

  1. Most important, “companies should build security into their devices at the outset, rather than as an afterthought.” I’ve referred before to the bright young things at the Wearables + Things conference who used their startup status as an excuse for deferring security and privacy until a later date. WRONG: both must be a priority from Day One.

  2. Conduct a privacy or security risk assessment during design phase.

  3. Minimize the data you collect and retain.  This is a tough one, because there’s always that chance that some retained data may be mashed up with some other data in future, yielding a dazzling insight that could help company and customer alike, BUT the more data just floating out there in “data lake” the more chance it will be misused.

  4. Test your security measures before launching your products. … then test them again…

  5. “..train all employees about good security, and ensure that security issues are addressed at the appropriate level of responsibility within the organization.” This one is sooo important and so often overlooked: how many times have we found that someone far down the corporate ladder has been at fault in a data breach because s/he wasn’t adequately trained and/or empowered?  Privacy and security are everyone’s job.

  6. “.. retain service providers that are capable of maintaining reasonable security and provide reasonable oversight for these service providers.”

  7. ‘… when companies identify significant risks within their systems, they should implement a defense-in -depth approach, in which they consider implementing security measures at several levels.”

  8. “… consider implementing reasonable access control measures to limit the ability of an unauthorized person to access a consumer’s device, data, or even the consumer’s network.” Don’t forget: with the Target data breach, the bad guys got access to the corporate data through a local HVAC dealer. Everything’s linked — for better or worse!

  9. “.. companies should continue to monitor products throughout the life cycle and, to the extent feasible, patch known vulnerabilities.”  Privacy and security are moving targets, and require constant vigilance.

  10. Avoid enabling unauthorized access and misuse of personal information.

  11. Don’t facilitate attacks on other systems. The very strength of the IoT in creating linkages and synergies between various data sources can also allow backdoor attacks if one source has poor security.

  12. Don’t create risks to personal safety. If you doubt that’s an issue, look at Ed Markey’s recent report on connected car safety.

  13. Avoid creating a situation where companies might use this data to make credit, insurance, and employment decisions.  That’s the downside of cool tools like Progressive’s “Snapshot,” which can save us safe drivers on premiums: the same data on your actual driving behavior might some day be used become compulsory, and might be used to deny you coverage or increase your premium).

  14. Realize that FTC Fair Information Practice Principles will be extended to IoT. These “FIPPs, ” including “notice, choice, access, accuracy, data minimization, security, and accountability,” have been around for a long time, so it’s understandable the FTC will apply them to the IoT.  Most important ones?  Security, data minimization, notice, and choice.

Not all of these issues will apply to all companies, but it’s better to keep all of them in mind, because your situation may change. I hope you’ll share these guidelines with your entire workforce: they’re all part of the solution — or the problem.

IBM picks for IoT trends to watch this year emphasize privacy & security

Last month Bill Chamberlin, the principal analyst for Emerging Tech Trends and Horizon Watch Community Leader for IBM Market Development (hmmm, must have an oversized biz card..) published a list of 20 IoT trends to watch this year that I think provide a pretty good checklist for evaluating what promises to be an important period in which the IoT becomes more mainstream.

It’s interesting to me, especially in light of my recent focus on the topics (and I’ll blog on the recent FTC report on the issue in several days), that he put privacy and security number one on the list, commenting that “Trust and authentication become critical across all elements of the IoT, including devices, the networks, the cloud and software apps.” Amen.

Most of the rest of the list was no surprise, with standards, hardware, software, and edge analytics rounding out the top five (even though it hasn’t gotten a lot of attention, I agree edge analytics are going to be crucial as the volume of sensor data increases dramatically: why pass along the vast majority of data, that is probably redundant, to the cloud, vs. just what’s a deviation from the norm and probably more important?).

Two dealing with sensors did strike my eye:

9.  Sensor fusion: Combining data from different sources can improve accuracy. Data from two sensors is better than data from one. Data from lots of sensors is even better.

10.  Sensor hubs: Developers will increasingly experiment with sensor hubs for IoT devices, which will be used to offload tasks from the application processor, cutting down on power consumption and improving battery life in the devices”

Both make a lot of sense.

One was particularly noteworthy in light of my last post, about the Gartner survey showing most companies were ill-prepared to plan and launch IoT strategies: “14.  Chief IoT Officer: Expect more senior level execs to be put in place to build the enterprise-wide IoT strategy.” Couldn’t agree more that this is vital!

Check out the whole list: I think you’ll find it helpful in tracking this year’s major IoT developments.

The #IoT Can Kill You! Got Your Attention? Car Security a Must

The Internet of Things can kill you.

Got your attention? OK, maybe this is the wake-up call the IoT world needs to make certain that privacy and security are baked in, not just afterthoughts.

Markey_IoT_car_reportI’ve blogged before about how privacy and security must be Job 1, but now it’s in the headlines because of a new report by our Mass. Senator, Ed Markey (Political aside: thanks, Ed, for more than 30 years of leadership — frequently as a voice crying in the wilderness — on the policy implications of telecomm!), “Tracking & Hacking: Security & Privacy Gaps Put American Drivers at Risk,” about the dangers of not taking the issues seriously when it comes to smart cars.

I first became concerned about this issue when reading “Look Out, He’s Got an Phone,!” (my personal nominee for all-time most wry IoT headline…), a litany of all sorts of horrific things, such as spoofing the low air-pressure light on your car so you’ll pull over and the Bad Guys can get it would stop dead at 70 mph,  that are proven risks of un-encrypted automotive data.  All too typical was the reaction of Schrader Electronics, which makes the tire sensors:

“Schrader Electronics, the biggest T.P.M.S. manufacturer, publicly scoffed at the Rutgers–South Carolina report. Tracking cars by tire, it said, is ‘not only impractical but nearly impossible.’ T.P.M.S. systems, it maintained, are reliable and safe.

“This is the kind of statement that security analysts regard as an invitation. A year after Schrader’s sneering response, researchers from the University of Washington and the University of California–San Diego were able to ‘spoof’ (fake) the signals from a tire-pressure E.C.U. by hacking an adjacent but entirely different system—the OnStar-type network that monitors the T.P.M.S. for roadside assistance. In a scenario from a techno-thriller, the researchers called the cell phone built into the car network with a message supposedly sent from the tires. ‘It told the car that the tires had 10 p.s.i. when they in fact had 30 p.s.i.,’ team co-leader Tadayoshi Kohno told me—a message equivalent to ‘Stop the car immediately.’ He added, ‘In theory, you could reprogram the car while it is parked, then initiate the program with a transmitter by the freeway. The car drives by, you call the transmitter with your smartphone, it sends the initiation code—bang! The car locks up at 70 miles per hour. You’ve crashed their car without touching it.’”

Hubris: it’ll get you every time….

So now Senator Markey lays out the full scope of this issue, and it should scare the daylights out of you — and, hopefully, Detroit! The report is compiled on responses by 16 car companies (BMW, Chrysler, Ford, General Motors, Honda, Hyundai, Jaguar Land Rover, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Porsche, Subaru, Toyota, Volkswagen (with Audi), and Volvo — hmm: one that didn’t respond was Tesla, which I suspect [just a hunch] really has paid attention to this issue because of its techno leadership) to letters Markey sent in late 2013. Here are the damning highlights from his report:

“1. Nearly 100% of cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions.

2. Most automobile manufacturers were unaware of or unable to report on past hacking incidents.

3. Security measures to prevent remote access to vehicle electronics are inconsistent and haphazard across all automobile manufacturers, and many manufacturers did not seem to understand the questions posed by Senator Markey.

4. Only two automobile manufacturers were able to describe any capabilities to diagnose or meaningfully respond to an infiltration in real-time, and most say they rely on technologies that cannot be used for this purpose at all. (my emphasis)

5. Automobile manufacturers collect large amounts of data on driving history and vehicle performance.

6. A majority of automakers offer technologies that collect and wirelessly transmit driving history data to data centers, including third-party data centers, and most do not describe effective means to secure the data.

7. Manufacturers use personal vehicle data in various ways, often vaguely to “improve the customer experience” and usually involving third parties, and retention policies – how long they store information about drivers – vary considerably among manufacturers.

8. Customers are often not explicitly made aware of data collection and, when they are, they often cannot opt out without disabling valuable features, such as navigation.”

In short, the auto industry collects a lot of information about us, and doesn’t have a clue how to manage or protect it.

I’ve repeatedly warned before that one of the issues technologists don’t really understand and/or scoff at, is public fears about privacy and security. Based on my prior work in crisis management, that can be costly — or fatal.

This report should serve as a bit of electroshock therapy to get them (and here I’m referring not just to auto makers but all IoT technologists: it’s called guilt by association, and most people tend to confabulate fears, not discriminate between them. Unless everyone in IoT takes privacy and security seriously, everyone may suffer the result [see below]) to realize that it’s not OK, as one of the speakers at the Wearables + Things conference said, that “we’ll get to privacy and security later.” It’s got to be a priority from the get-go (more about this in a forthcoming post, where I’ll discuss the recent FTC report on the issue).

I’ve got enough to worry about behind the wheel, since the North American Deer Alliance is out to get me. Don’t make me worry about false tire pressure readings.

PS: there’s another important issue here that may be obscured: the very connectedness that is such an important aspect of the IoT. Remember that the researchers spoofed the T.P.M.S. system not through a frontal assault, but by attacking the roadside assistance system? It’s like the way Target’s computers were hacked via a small company doing HVAC maintenance. Moral of the story? No IoT system is safe unless all the ones linking to it are safe.  For want of a nail … the kingdom was lost!">Stephenson blogs on Internet of Things Internet of Things strategy, breakthroughs and management