Re: [perpass] US intelligence chief says we might use the IoT to spy on you

[Robin Wilton <[e-mail]>]

Thanks all - really interesting discussion on these points. I’m going to kind of apologise for top-posting, but really wanted to draw out 3 themes which I think stand out from several of the preceding threads… so there wasn’t really a good “in-line” way to do this.

I don’t think my thoughts here are original by the way, I’m just trying to recap the good ideas of others (I’m not proud…)

1 - this isn’t a tech-only or standardisation-only problem: whatever we try and do through IETF will be in the context of the massive economic forces that (currently) favour a model based on cloud, aggregation, and monetization of personal data.

2 - there’s a tech element in that "walled garden” IoT implementations make it much harder for users to see/control what devices are doing “on their behalf”, whereas open source/open standard implementations are more likely to make that possible. Again, the economic factors in (1) currently act in favour of walled gardens.

3 - technically, whatever system component gives effect to users’ wishes and preferences can reside in the home, at the service provider, or somewhere else. Commercially, the question is whether there’s any incentive at all for IoT vendors to include such a component… let alone whether (as per (2) ) they do so on the basis of open interfaces.

I hope this helps tease out some of the issues. I think this is another classic example where it would take the co-operative action of multiple stakeholders in order for users to get a better deal...

Yrs.,
Robin

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [e-mail]
Phone: [phone]
Twitter: @futureidentity

On 12 Feb 2016, at 14:32, Dave Crocker <[e-mail]> wrote:

> 
> 
> On 2/11/2016 10:57 AM, Ted Lemon wrote:
>> To be fair, there is really no way at present for IoT vendors to
>> deliver service without running the data collection end, unless they
>> sell you a workstation to do it at home.   If there were a place at
>> home where data collection apps could run...
> 
> I do not know of any reason the model for IoT needs to be different from email.  That is, yes, servers are needed.  They might reside with end-users, but they do not have to.
> 
> The essential point is to have an open interconnection specification that permits mixing different vendors' products together.  (This is true for mixing IoT end devices, not just IoT data servers.)
> 
> I think the real issue here is that the vendors have a strong incentive to /retain/ their data acquisition role.  So they won't give it up unless and until there is a strong consumer-driven pressure for it.
> 
> 
>> The IETF has the technological basis for working on this problem, but
>> it would be completely speculative at this point, and probably we'd
>> get it wrong.
> 
> Well, you are more optimistic than I.  Absent involvement of folk with subject matter expertise, the likelihood of getting the design right is zero, IMO...  That is, 'certainly' rather than 'probably'...
> 
> d/
> 
> _______________________________________________
> perpass mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/perpass