Race to the Future of American

Race to the Future of American Cities The Status of & Demand for Federal Smart Legislation

"We will neglect our cities to our peril, for in neglecting them we neglect the nation." – President John F. Kennedy

URBAN TECHNOLOGY SERIES: AUTHORS: An Independent Series Presented by the Kirstin Anderson-Hall Chaddick Institute for Metropolitan Development Brandon Bordenkircher, MPA at DePaul University Alexander Hall Brady Penn Race to the Future of American Cities

EXECUTIVE SUMMARY ...... 1 INTRODUCTION ...... 1 SMART CITY DEFINITION, BENEFITS & CONSIDERATIONS ...... 2 EXAMPLES OF SMART CITIES IN THE U.S...... 3 SMART CITY & IoT RELATED BILLS IN CONGRESS ...... 6 Federal Coordination, Investment & Innovation: “The Smart Cities and Communities Act” ...... 6 Security Requirements: “The Cybersecurity Improvement Act” ...... 7 Regulation & Cross-Sector Collaboration: “The Digit Act” ...... 8 : “The IoT Readiness Act” ...... 9 Setting International IoT Standards: “IoT Standards Leadership Act”...... 9 Value, Transparency & Privacy: “The Dashboard Act” ...... 10 States Passing Their Own Privacy Laws ...... 11 General Data Protection Regulation ...... 11 MOVING FORWARD ...... 12 AUTHOR INFORMATION ...... 14 ACKNOWLEDGEMENTS ...... 14

Race to the Future of American Cities

EXECUTIVE SUMMARY Smart cities may sound like an esoteric and futuristic idea, but a new wave of Smart cities and the Internet of Things leveraging available technology are already (IoT) are quietly becoming the most being implemented and utilized in cities influential tech trends in the United around the globe. , Spain is using States and has already revolutionized the data to dramatically reduce jams, way we live our lives. Some of the biggest , and energy usage, while Las Vegas, potential consumers for this technology Nevada is doing so to improve traffic flow. are cities and governments seeking to Birmingham, Alabama is working to reduce solve long standing problems in creative gun violence by using a high tech network to ways. These burgeoning smart cities face detect gunshots, and London, England is mounting pressure from their collecting data to solve pollution issues that constituents and relatively little direction cause 9,000 deaths annually. Further afield, from state and federal authorities. is gathering data to aid the impending labor gap due to its aging The purpose of this paper is to address population, and India is hoping to offer the implications of the lack of federal intelligent public services and connect action on issues pertaining to the billions of citizens to government services via Internet of Things (IoT) and smart cities information and communication technologies. and to educate audiences such as elected officials, tech industry professionals, and As the examples above demonstrate, smart the general public on the potential cities have the potential to improve the benefits of these innovations. for citizens. However, there are concerns about the implementation of smart city technology, particularly centering around INTRODUCTION privacy and security matters. As a result of According to a recent United Nations report, these complexities, the U.S. Congress has 55% of the world’s population currently lives introduced several bills in recent months that in urban areas. By 2050, that percentage is will help give companies and cities the forecasted to increase to 68%. This large freedom and support to innovate (via funding influx of people moving into urban areas will and coordination), while still laying down create many challenges for elected officials guardrails to mitigate potential negative (e.g. unemployment, crime, pollution), and it externalities. will likely increase strain on infrastructure and public services (e.g. public transit, energy Those bills include: grids). In short, public authorities will need to • The Smart Cities and Communities Act do more with less. The solution? Smart cities. of 2019 (S.1398, H.R.2636) • The Internet of Things Cybersecurity Anthony Townsend wrote an apt explanation Improvement Act 2019 (S.734, of smart cities in his book “Smart Cities” H.R.1668) [2013] writing that “smart cities are places • The DIGIT Act of 2019 (S.1611) where information technology is wielded to • The IoT Readiness Act of 2019 address problems old and new.” Cities use (H.R.3789) this information technology to adapt in real- • The IoT Standards Leadership Act time, pulling data from sensors, sending that 2019 (H.R.3811) data to that then gives us insight • The DASHBOARD Act of 2019 (S.1951) into how to fix a particular issue. The purpose of this white paper is to inform smart city leaders, technology sector workers, Race to the Future of American Cities

elected officials, and the average citizen on disaster management and notification, snow the importance of this maturing technological removal monitoring, public wifi, electric space and the key aspects of the bills listed vehicle charging, and microgrids. above and what they are designed to do. Before delving further into the bills, however, we first provide some additional background information about the promise and potential The purpose of this white paper is to perils of smart cities. educate smart city leaders, technology sector workers, elected officials, and the average citizen on why this SMART CITY DEFINITION, maturing technology is important and why these bills are necessary to the BENEFITS & CONSIDERATIONS future of our country. It’s hard to define exactly what a “smart city” is. Every city leader has a different understanding of what it means. Some For the purposes of this paper, we define leaders prefer to say, “connected smart cities as localities that utilize communities,” while other leaders don’t think information technology by gathering data tech needs to be included in the definition at from the physical world via the Internet of all, as many smart city efforts (involving Things (i.e. any device that connects to the internet; which consists of sensors, beacons, affordable housing, improved infrastructure, cameras, applications, and ). The increased bikeshare, etc.) don’t necessarily data collected by these devices would rely on internet of things tech. It is likely that traditionally be stored and utilized within the definition will continue to evolve as a industry value chains (i.e. Product Systems). background paper from the UK Department For example, an air-condition is equipped for Business, Innovation and Skills stated in with sensors to let the manufacturer and user 2013: "The concept is not static, there is no know when the product is in need of repair. absolute definition of a Smart city, no end point, but rather a process, or series of steps, FIGURE 1: Bronzeville Community of the Future Illustration by which cities become more 'liveable' and resilient and, hence, able to respond more quickly to new challenges." Another description put forward by consulting firm Frost and Sullivan listed eight key factors necessary for a city to be considered “smart”; they included smart , smart energy, smart building, smart mobility, smart infrastructure, smart technology, smart healthcare and smart citizen. The illustration from Bronzeville Community of the Future [Figure 1] lists smart city components as air quality monitoring, home energy portals, smart street lights, traffic management, smart Source: Commonwealth Edison Company, 2017. All Rights Reserved. Reproduced with permission. meters, intelligent ,

2 Race to the Future of American Cities

With advances in storage, computation, and several cities have already launched their artificial , the data from the air- own smart city initiatives, despite the fact conditioned will now have the ability to be that the federal government has yet to take shared outside of its traditional value chain by substantial action and pass any IoT bills. sending and receiving information to balance the flow of electricity based on electric grid use. The smart electric grid would then send information to the air-condition by turning it In fact, several cities have already down or off to avoid a citywide blackout due launched their own smart city initiatives, to equipment overload. despite the fact that the federal

government has yet to take substantial Utilizing this information outside of its industry value chain creates new action and pass any IoT bills. opportunities by forming a customer focused ecosystem called a Human-Centric System of Systems. The data is shared (via cloud infrastructure) and analyzed (via ) to create value by looking beyond EXAMPLES OF SMART CITIES IN existing product-based business models in THE U.S. order to solve problems, create new products, The number of IoT-connected devices is and generate best practices that result in expected to grow from 6.6 million in 2016 to more efficient government services and a 22.5 billion by 2021 as the prices for IoT better quality of life for all citizens. devices, storage, and computing continues to

fall. This growing accessibility of IoT-devices Data has become the ultimate control point to means the number of smart city initiatives help organizations (i.e. cities and companies) and the amount of cyber-physical data will leverage their resources in the most effective increase. According to the Smart America way. With all this data in motion, there are Challenge, city governments are projected to several important areas of consideration for spend upwards of $41 trillion over the next policymakers: namely, how to best legislate 20 years on smart technology to upgrade cyber-physical security, IoT industry their infrastructure. Already, many U.S. cities standards (both in the U.S. and are utilizing various smart city solutions and internationally), privacy issues and data optimizing data from the cyber-physical rights. world in order to fix a wide variety of

problems and ultimately make their cities Cities, states, and the federal government more efficient and livable. Please refer to the have different views on how to regulate these map [Figure 2] on page 4. issues and this has often caused a push and pull between their differing interests. Cities Chicago, IL have traditionally been the arbiters of urban Chicago’s Array of Things (AoT) is an IoT design and improvement while federal and project featuring 200 nodes (i.e. sensors and state dollars have served to encourage certain cameras) that collect real-time data on initiatives or allow for more equitable environmental, infrastructure, and physical development between different sized activity in order to measure livability factors communities. While cities often solve these in Chicago (e.g. climate, air quality and noise). problems in a piecemeal fashion, federal This information is published as for attention can lead to massive increases in the public use and research purposes with the speed of change. Similarly, smart city ultimate goal of helping engineers, scientists, strategies and policies look likely to be policymakers and residents make decisions decided primarily at the local level. In fact,

3

FIGURE 2: Examples of U.S. Smart Cities and State Privacy Legislation

Race to the Future of American Cities

that help Chicago become healthier, more single vision. This move hopes to help the city livable, efficient, and equitable. evaluate technology options and find cost- effective tools. There will be a large focus on Columbus, OH the city’s greenhouse gas reduction goals and The City of Columbus’ Smart Columbus promoting more efficient mobility initiative is funding nine projects funded by a alternatives. $40 million grant from the U.S. DOT and $10 million from Vulcan Inc. The initiative seeks Philadelphia, PA to create a (MaaS) Philadelphia entered into the smart cities platform that allows residents to pay for all space in 2017 with their SmartCityPHL modes of transportation (public transit, program. The city developed a smart city , bike-sharing, car-sharing, and ride- advisory committee prior to leaping into hailing) through one app to improve mobility. larger projects, but instead of investing in A second project looks to allow semi- typical "smart" technologies, the city hosted autonomous freight trucks to communicate in community workshops to brainstorm ideas to real time so they can closely follow one help form their roadmap. Data will play a another, resulting in saved fuel, increased large role in overall strategy, and will focus vehicle safety, and improved traffic flow. on the city’s litter conditions, vacant properties, utility bill management, and other Dallas, TX topics. The City of Dallas has launched the Dallas Innovation Alliance, a 501c(3) public-private Pittsburgh, PA partnership powered by AT&T. The project The City of Pittsburgh has launched Smart consists of a four-block corridor PGH which seeks to use technology to featuring nine integrated smart city projects develop safe, reliable transit to reconnect and is hailed as the fastest-to- smart displaced communities to jobs, education and cities initiative in the country. The project essential services. Areas of focus include: utilizes digital infrastructure nodes, mobility optimization to reduce emissions, pedestrian sensors, public wifi, smart smart street lights (equipped with sensors), parking, environmental sensors, smart water autonomous shuttles, and data metering, and interactive digital kiosks to collection/platforms/process framework. improve the use of data in city planning. The following are examples of U.S. smart cities San Francisco, CA and not a definitive list. San Francisco is focused on a mode shift from single-occupancy vehicle (SOV) trips to public Denver, CO transit; lowering emissions via electrification The City of Denver has formed a public- and demand management; and solving private partnership with to use transportation equity. The city is looking to data and modeling alongside identified accomplish these goals by implementing residents pain points. The partnership shared, autonomous, connected, electric, focuses on traffic issues like decreasing Single transportation to streamline and synchronize Occupancy Vehicles (SOVs) and reducing traffic and eliminate parking to create room traffic accidents (Vision Zero Initiative) by for green spaces and affordable housing. integrating intelligent transportation systems and public safety systems. Washington, D.C. The Smarter DC initiative aims to help define Orlando, FL smart city governance frameworks, Orlando announced that it is seeking a interoperability standards, and models for consultant to create a comprehensive smart replication, scalability, and . city strategy to coordinate efforts and shape a Problems it seeks to solve include Smart

5 Race to the Future of American Cities

Waste Management by adding sensor Federal Coordination, Investment & technology to waste cans to provide data on Innovation: “The Smart Cities and fill levels allowing the DPW to identify waste Communities Act” collection inefficiencies, and movement Introduced initially by Senator Maria using video sensors to classify and Cantwell [D-WA], the Smart Cities and count city movement (people, bikes, cars, Communities Act of 2019 seeks to promote etc.) to measure traffic volume and flows in the use of smart technologies and systems via key economic development corridors. federal support for local technology

initiatives. Ensuring smart city technology is

understood and accessible to governments of SMART CITY & IoT RELATED all sizes will help policy makers create well BILLS IN CONGRESS informed and effective investments which While countries like India and Singapore will draw new businesses, create jobs, and invest $7.4 billion and $7.5 billion, enhance critical infrastructure. respectively, into their smart city initiatives, the U.S. federal government lags behind with The Smart Cities and Communities Act of a total of $240 million invested for two smart 2019 would authorize $220 million for smart city initiatives back in 2016. In addition, the city investments each year for the next five Congressional Caucus on the Internet of years. It would focus on improving Things, and the House-based Smart City coordination of smart city programs and Caucus, were created in 2017 to educate expanding their benefits to smaller under members of Congress on smart city issues, resourced communities. Among its many IoT use cases, potential issues with the impacts the bill would foster a structure of growing number of IoT devices and systems, reporting; help develop IoT sector jobs in and the policy issues surrounding the cities big and small; improve smart city collection of consumer data by IoT devices. technology's quality, performance and safety; These are great first steps; however, as more and foster international collaboration and cities start to implement their own smart city trade of smart city technologies. initiatives, it’s important that IoT technology be funded and implemented properly as well The bill also seeks to increase cross-city as regulated in a thoughtful and coordinated coordination around the U.S., create unified manner. oversight, and consolidate the individual smart city elements the federal government is Several of these bills are most likely to be already working on (i.e. electric vehicles, passed piecemeal as additions to a larger autonomous vehicles, , infrastructure bill that may be the best internet of things (IoT) devices, broadband chance at bipartisan policy making in the near access, smart grids, and data privacy). future. The bills discussed in this paper include: The Smart Cities and Communities Act The oversight and interagency collaboration of 2019; the Internet of Things Cybersecurity required within the bill is substantial. Among Improvement Act 2019; the DIGIT Act of 2019; other things, the proposal would require the IoT Readiness Act of 2019; the IoT reports on the bill’s implementation to the Standards Leadership Act 2019; and the Committees on Commerce, Science, and DASHBOARD Act of 2019. Transportation and Energy, and Natural Resources in the Senate. It would also require reports to the Committees on Energy and Commerce, Transportation, and Infrastructure in the House. These measures are unlikely to be implemented anytime soon

6 Race to the Future of American Cities

as political differences have caused a massive Communities Act. Among the numerous slowdown in comprehensive lawmaking. The businesses interested in this field, Reinvently, funds for the proposal have also led it to Vates, Fusion Informatics and others flounder with Democrats and Republicans represent the startups banking on the disagreeing on where funds would be drawn massive upside potential of IoT and smart from according to those close to the issue. In cities. spite of the Bill’s long shot at passing, smart city funding is already flowing from agencies The Senate bill (S.1398) was referred to the at every level of government. Committee on Commerce, Science, and Transportation in on 5/9/2019 and appears Some of the most vehement supporters of likely to die there. As of now, the chair of this smart cities foresee a future federal committee refuses to bring it to a vote. On government agency which would focus solely 5/9/2019 the House bill (H.R.2636) was on IoT and smart city management. Until this referred to: the Energy and Commerce; type of policy is consolidated and streamlined Science, Space, and Technology; Education in such a way, however, we are likely to see and Labor; Foreign Affairs. In order to move funds coming from a plethora of government on, the bill will need to be referred out by the agencies. Speaker.

Some of the programs already under development and application through various Security Requirements: “The Internet federal organizations include BroadbandUSA, of Things Cybersecurity Improvement Boulder Wireless Testbed, Regional Act” Innovation Hubs, All of Us Research Program, In 2016, the Mirai botnet attack took down Advanced Grid Modeling, Array of Things, several popular websites by scanning the Advanced Distribution Management Systems Internet for IoT devices, logging into those and Accelerate R2 Network Challenge. The devices where the default username-and- sheer number of initiatives and programs password combo were not changed, and illustrates the impact that a federal bill may infecting them. The Mirai botnet attack have in encouraging information sharing and involved a hundred thousand hijacked IoT collaboration. devices to bring down Dyn (an internet

performance management and web The Smart Cities and Communities Act was application security company). developed in collaboration with cities across the country, as well as telecommunications Since this attack, Congress has made attempts and information technology companies. In to pass legislation around IoT security, fact, many cities around the country have including a failed attempt in 2017 that looked extensive smart city initiatives underway to prevent the government from buying (per earlier examples). connected devices that had blatant security Businesses and organizations, like the BSA - weaknesses. The Internet of Things The Software Alliance, have shown support Cybersecurity Improvement Act of 2019, for this bill as they are eager to get a piece of introduced by Sen. Mark R. Warner [D-VA] in this fast growing field. A recent survey by the Senate and Rep. Robin Kelly [D-IL] in the TechRepublic found that over 90% of House, aims to build a framework to institute businesses favor federal legislation including a list of requirements for secure connected 62% of public safety technology firms and devices, federal agencies, contractors, and 50% of communication firms. Among these vendors. firms, Qualcomm has put federal efforts into creating the Smart Cities Caucus and pushing for legislation such as the Smart Cities and

7 Race to the Future of American Cities

The bill designates the responsibility of all types of technology, while the House bill setting the requirements for secure just covers disclosures for IoT devices. development, , patching, and configuration management for IoT devices to the National Institute of Standards Regulation & Cross-Sector and Technology (NIST). From there it will be Collaboration: “The Digit Act” the responsibility of Office of Management On 5/22/2019, Sen. Deb Fischer [R-NE] and Budget (OMB) to issue guidelines for reintroduced a stalled 2017 bill that would each federal agency that are consistent with promote the Internet of Things industry in the NIST requirements and require OMB to the U.S. which includes several provisions review those policies every five years (at a that encourage lawmakers to nurture minimum). It will also require any IoT device connected technology instead of stifling its purchased by the federal government to development. The DIGIT Act (Developing comply with the NIST requirements. Innovation and Growing the Internet of Things Act) would create a working group, NIST will also be required to cooperate with including federal and private-sector Department of Homeland Security (DHS), individuals, that will work to identify policies cybersecurity researchers, and industry in relation to the IoT, such as spectrum needs, experts to write reports advising on IoT consumer protection, privacy and security, device weaknesses to guarantee any and regulatory environment. vulnerabilities are rectified. It will also demand U.S. government information Moreover, The DIGIT Act would help ensure systems vendors sign disclosure policies, so if the nation’s preparedness for communication a weakness in an IoT device or information technologies of the future as Congress system is uncovered, it can be fixed. estimates that 125 trillion devices will be connected to the internet by 2030, with IoT It is a serious issue when a single person’s having the potential to generate trillions in bank account is hacked; IoT technology opens new economic activity worldwide. The up society to the even greater threat of an working group would also identify policies entire cyber-physical infrastructure being that would improve coordination among hacked (i.e. the energy grid of an entire region federal agencies with jurisdiction over the of a country). The implications of the latter IoT. If passed, oversight of the IoT would fall could cause cacophony and potentially result under many regulatory bodies; for example, in deaths. These implications make an IoT the Food and Drug Administration would cybersecurity bill crucial to our nation's regulate medical wearables, while the safety. National Highway Traffic Security Administration’s jurisdiction would manage The Congressional Budget Office (CBO) connected cars. estimates the bill would cost $35 million over the 2019-2024 period, assuming The Department of Commerce, in particular, appropriation of the necessary amounts. would have its own steering committee to Senate bill S.734 and House bill H.R.1668 are advise the working group (along with its currently in conference, awaiting a subset of agencies). The committee’s compromise. The language causing the recommendations would be under the holdup: the House bill defines what an IoT purview of identifying federal regulations and device is, while the Senate removed the statutes, grant practices, programs, and definition of what an IoT device is. One other budgetary and jurisdictional practices and to difference between the bills: the Senate bill identify situations in which the use of IoT covers coordinated security disclosures for could deliver stable economic and societal

8 Race to the Future of American Cities

benefits to the United States in the form of inevitably interfere with each other and fail, smart transit and transit technologies, making the entire idea of smart cities moot. augmented logistics and supply chains, healthcare and public safety to name a few. In countries like China and South Korea, 5G Furthermore, the DIGIT Act would require the networks and IoT devices are being deployed Federal Communications Commission (FCC) at a breakneck speed due to a lack of restraint to complete a report that assesses the and concern for privacy/use cases (i.e. spectrum needs required to support the IoT. surveillance). Meanwhile, citizens in the U.S. have been bombarded with a Russian According to the CBO, it will cost an estimated disinformation campaign, care of RT (a $3 million to fund the necessary working television network funded by the Russian groups proposed by the DIGIT Act. Costs government), claiming 5G causes “brain would be distributed among the respective cancer, infertility, autism, heart tumors and participating agencies and would be subject Alzheimer’s disease.” These unsubstantiated to the availability of appropriated funds. concerns have already attempted to stunt the Supporters of the DIGIT Act include: The App rollout of 5G across the U.S. with a coalition of Association, the U.S. Chamber of Commerce, 52 grassroots organizations calling on the CTIA, the Competitive Carriers Association, Federal Communications Commission (FCC) the Computing Research Association, the to delay deployment of 5G infrastructure Consumer Technology Association, the citing health claims that lack scientific Information Technology Industry Council, the support. Information Technology and Innovation Foundation, the Semiconductor Industry China's current IoT policy could potentially Association, the Telecommunications add $196 billion US dollars to its cumulative Industry Association and VMware. The bill GDP in manufacturing industries over the (S.1611) is currently in the Committee on next 15 years. Considering IoT’s far-reaching Commerce, Science, and Transportation impact on the future of the U.S. economy, it is awaiting amendments. crucial that our country build out its own 5G infrastructure to support the growing spectrum demand for IoT devices. The IoT Wireless Infrastructure: “The IoT Readiness Act (H.R.3789) was referred to the Readiness Act” House Committee on Energy and Commerce The United States needs to ensure our on 7/17/2019. country’s wireless infrastructure is ready for the surge of IoT devices. The IoT Readiness Act of 2019 is a House bill that mandates that Setting International IoT Standards: the Federal Communications Commission “IoT Standards Leadership Act” (FCC) create a biennial report for Congress on The IoT Standards Leadership Act was the growing use of the IoT devices and introduced by Rep. Doris Matsui [D-CA] & gadgets that utilize 5G mobile networks. Mike McCaul [R-TX] in 2019 with a focus on fostering U.S. leadership and participation for Wireless signals (i.e. TV broadcast, radio setting international IoT standards. The bill stations, GPS devices, and cell phone service) would require the U.S. Department of travel over airwaves via a finite radio Commerce to study the U.S. involvement in frequency called spectrum. No two devices the international IoT standards-setting can transmit over the same processes and foreign countries’ IoT spectrum/frequency at the same time in the standards, with a focus on cybersecurity and same area – if they did, they would cause risk management. interference. If the available spectrum cannot sustain the number of devices, the signals will

9 Race to the Future of American Cities

Being leaders in setting IoT standards not not yet been able to turn these criticisms into only affects U.S. manufacturers – it will also a bill. shape global competitors who want access to the U.S. market. According to Abraham Both Congress and President Trump have Newman & Daniel Nexon, “to really affect the shown interest in a national consumer data global economy through such standard- privacy law to protect people’s online privacy, setting, a government requires the necessary but lawmakers continue to disagree on regulatory expertise to identify and enforce various components of the bill (i.e. market rules.” The U.S. is a true “market great enforcement, giving consumers the ability to power” not only due to our extensive sue companies that violate the federal law, regulatory experience, but also because we allowing the FTC more authority to create are one of the largest markets in the world. rules on privacy, and whether or not the However, the U.S. isn’t the only leader in federal law will preempt the state laws). international standard-setting. U.S. companies have to abide by an array of laws However these concerns did not stop in the when it comes to Senators Mark Warner [D-VA] and Josh trust-busting, environmental protections, and Hawley [R-MO] from introducing the digital privacy. These regulations affect the DASHBOARD Act (Designing Accounting practices of U.S. companies looking to operate Safeguards to Help Broaden Oversight and in the EU and beyond which leads to global Regulations on Data) (S.1951) in the Senate in standardization of their operations. June 2019. This bill would require tech companies to determine the value of the data The harmonizing of regulatory standards of they collect and provide easy options for the U.S. and EU would put immense pressure users to opt out of companies sharing and/or on other markets and will help prevent selling their personal data. The bill would country-specific standards from hindering require platforms with over 100 the progress of American innovation. million monthly active users to send their H.R.3811 was referred to the House users reports laying out the economic value Committee on Foreign Affairs on of their data, the types of data points 07/17/2019. collected, supply a list of the third parties utilizing the data, and compile an annual report on the aggregate value of user data. Data Value, Transparency & Privacy: It would also authorize the Securities and “The Dashboard Act” Exchange Commission (SEC) to create a Smart cities, by function, deal with a deluge of methodology for calculating a value for user data, which means there is greater potential data. In addition, it gives users the ability to for data privacy issues. Many tech companies delete any of their data, either completely or including Facebook, and Twitter have via specific type. This increase in built lucrative businesses off their users’ transparency and disclosure has the potential personal information by offering a “free” to provide antitrust regulators additional product by allowing advertisers to target ads insight into potentially anti-competitive based on user habits. Several CEO’s, including practices. Facebook CEO Mark Zuckerberg, have been called to Capitol Hill and criticized for their Several leaders in the tech space have said companies’ data practices; in fact, Facebook this bill is inherently flawed due to the was forced to pay a $5 billion fine as a result potential burden it places on social media of a settlement with the Federal Trade companies, the fact that most users forgo Commission (FTC). However, Congress has monetary rewards to avoid even thinking

10 Race to the Future of American Cities

about privacy, and that our data might not be (i.e. not securely storing biometric data, not worth very much when it stands alone. obtaining consent for data collection and not destroying biometric identifiers in a timely manner). States Passing Their Own Privacy Laws Maine As we wait for a federal data privacy law, a “An Act to Protect the Privacy of Online few states (see below) have decided to take Customer Information” bans all internet up the mantle themselves. Although these service providers (ISPs) that operate within state laws are a step in the right direction, the state from selling any personal data industry groups, like the Internet Association without consent from the individual. This can (whose members include Google, Facebook include browsing history and application and Amazon), have launched an ad campaign usage information. warning about 50 individual state privacy laws, and flooded D.C. to pressure Congress to Nebraska pass a national privacy law (which would Legislative bill 757 offers consumer include a provision to supersede all state protections to it the residents of the state by privacy legislation). In addition to the ordering companies to possess adequate Internet Association, the chairman of the FTC, security procedures around personal data the top privacy regulator in the country, has and ensure that third parties who access the also urged Congress to pass a national law. data also have security measures in place. Please refer to the map [Figure 2] on page 4. Nevada California Nevada’s “Act relating to Internet Privacy" “The California Consumer Privacy Act” (CCPA) updates the existing internet privacy law to will give consumers the ability to know what order companies to implement a way for personal information of theirs has been residents to opt-out of the trading of their collected by for-profit companies, how their private data. Businesses must give either a data is used, and know to whom it has been way to opt-out online or a toll-free telephone sold or disclosed. It also gives consumers the number. ability to access and control their own information and to whom the data is sold. Vermont “The Data Broker Statute” regulates how data Colorado brokers buy and sell personal information of House bill 18-1128 mandates that companies Vermont citizens. Additionally, it requires all who manage user data destroy or dispose of firms that sell or license data to register data when it is no longer in use. It also annually with the Vermont Attorney General, requires data breaches to be reported within disclose operational information and report 30 days. Additionally, if said breach impacts data breaches. more than 500 Colorado residents, the Attorney General of the state must be notified General Data Protection Regulation within that same time period. As the United States defers on passing a comprehensive federal data privacy law, the Illinois European Union was able to successfully pass “The Biometric Privacy Act (BIPA)” governs its own in 2016, which went into effect May the collection of biometric information (i.e. 2018. Like the DASHBOARD Act, one of the fingerprints, retina and facial geometry core focuses of the General Data Protection scans). The law allows individuals to file a Regulation (GDPR) is the strengthening of lawsuit for damages if a violation transpires consent; however, GDPR offers greater protection by requiring that companies use

11 Race to the Future of American Cities simple language, that consent for data be MOVING FORWARD applied individually, and that a protection for This report serves as a reflection of our children be available (in the form of parents current predicament, as Congress considers being able to opt in to data collection on their smart city and IoT legislation and struggles to child’s behalf). Companies are also required come to consensus. It is important that to notify the authorities and consumers of a Congress continues to work closely with IoT data breach within 72 hours of becoming device makers, cloud infrastructure aware of it. GDPR offers citizens more control companies, data rights groups, and local in accessing their personal data stored by both big and small. Smart cities companies, the ability to have their data – and the IoT technology that drives them – erased and bar third parties from processing have the potential to solve big problems and it, and the opportunity to take their data and improve the quality of life for all citizens. It is transfer it to a different service provider. imperative that the right legislation is

enacted promptly, in an intentional manner, This law not only affects organizations with the given flexibility to amend bills as located within the EU, but it also applies to technology advances. institutions outside of the region that offer goods or services, or that monitor the behavior of users. Smart cities – and the IoT technology Breaching GDPR carries a hefty fine equating that drives them – have the potential to to 4% of annual global turnover or €20 solve big problems and improve the million euros (roughly $23 million). As big quality of life for all citizens. It is technology firms update their respective data imperative that the right legislation is standards to adhere to GDPR law, data enacted promptly, in an intentional privacy advocates in the EU continue to manner, with the given flexibility to question whether these organizations are in full compliance. Earlier this year, Google was amend bills as technology advances. issued a fine of $50 million by the French based data protection organizations The National Commission of Informatics and Civil Liberties (CNIL), which claimed that Google Anger at tech companies has only resulted in had failed to comply with GDPR standards a single new law in recent years – a bill to when new Android users set up their phones prevent sex trafficking online. Although tech to follow onboarding processes. A handful of issues do not drive most voters to the polls, other large firms such as Amazon, Apple, and these innovations will have a significant Netflix have been subject to complaints from impact on the U.S. economy, including jobs data privacy organizations and activists based and , which is why there in the EU. needs to be more IoT and smart city education for both elected officials and Creating a national data privacy law is citizens. Cities are already using IoT necessary in order to maintain transparency, technology to reduce traffic jams and energy safety, and ownership of consumer data and usage; to help prevent gun violence; to reduce privacy. Unlike the E.U.’s GDPR, the U.S.’s pollution; to solve the aging labor gap; and to DASHBOARD Act which would act as a connect billions of citizens to government standard and foundation for national data services. Citizens need a basic understanding management was referred to the Committee of why this technology is beneficial, this on Banking Housing and Urban Affairs on increased awareness could help ensure the 10/24/2019 and has been read on the floor continued funding and implementation of but is likely to die in committee.

12 Race to the Future of American Cities

smart city solutions that will make our American government remains sidelined. In country and our world a better place. order for us to lead this race, we need to make sure that we are participating. Studies, In a 1962 speech, President John F. Kennedy funding, and proactively setting thoughtful asserted, "we will neglect our cities to our IoT standards, both in the U.S. and peril, for in neglecting them we neglect the internationally, will help secure more nation." This quote is more relevant than ever efficient government services, cleaner cities, at this point in our world history as and a more equitable future for all U.S. populations continue to move to urban areas. citizens.

As the President and Congress weigh The starting gun has been fired. It is time for infrastructure spending, the neglect of the U.S. to pick up the pace. IoT/smart city innovation and regulation puts our nation’s security, economy, and future in peril. Other nations will be quick to take up the baton and cross the finish line if the

13 Race to the Future of American Cities

AUTHOR INFORMATION Kirstin Anderson-Hall Principal at 12 Tone Consulting A Southern California native residing in Washington D.C. Her interests focus on utilizing social impact, civic engagement, and technology for the greater good. An American University masters graduate that has written several white papers spanning a wide range of tech policy issues.

Brandon Bordenkircher, MPA CEO at 12 Tone Consulting Chicago based tech policy leader with years of policy, government affairs, and research experience. His expertise focuses on local governments’ response to disruptive technologies. He has worked for SHARE NOW (car2go), Airbnb, SmartStubs, and DePaul University’s Chaddick Institute.

Alexander Hall Independent Researcher Alexander has a passion for studying the intersection between new technologies and communities. He has led local community engagement initiatives for billion-dollar tech companies as a Los Angeles resident.

Brady Penn CEO at Telegraph Hill Solutions A technology and public policy expert based in San Francisco. His work spans US and Australian politics and has included some of the biggest names in technology and government.

ACKNOWLEDGEMENTS The writing of this report was a collaborative effort that was edited and formatted by Mallory Livingston, with additional research provided by Ali Fendrick, and title image created by Kristiana Mitacek. This paper was published by The Chaddick Institute on 1/31/2020.

The writers are especially grateful to the many congressional staffers that took the time to answer our questions. In addition, the following people were indispensable for providing their support and insights:

• Chelsea (McCullough) Collier: Founder at Digi.City • Jessica Kupets: Program Manager at DePaul University's Chaddick Institute • Jochen Renz: Advisor, New Mobility at Rocket Wagon Venture Studios • Joe Schweiterman: Director at DePaul University's Chaddick Institute • Julia Kanouse: CEO at Illinois Technology Association • Ken Hejduk: COO at Sway Mobility • Kristin Musulin: Senior Editor at Smart Cities Dive • Olivia Pantoja: Consultant at the Concensus Group • Paula Robinson: President at Bronzeville’s Community Development Partnership • Rajesh Sankaran: Research and Development Lead at the Array of Things • Ron Rumack: Executive Director at Wisconsin IoT Council • Sasha Bernhard: Senior Policy Advisor at Congresswoman Suzan K. DelBene • Scott Smith: Assistant Director at DePaul University's Chaddick Institute • Skip Newberry: President and CEO at Technology Association of Oregon

14