0RIVACYANDTHE)NTERNETOF4HINGS)O4 ,EONIE(UANG %SQ (OLLAND+NIGHT-ODERATOR -ARK-ELODIA %SQ 0ARTNER (OLLAND+NIGHT *ESSICA,EE %SQ 0ARTNER ,OEB,OEB !NTHONY&ORD %SQ 3ENIOR$ATA0RIVACY#OUNSEL -EDIDATA3OLUTIONS )NC -ANAS-OHAPATRA %SQ #HIEF0RIVACY/FFICERAT6IACOM The Internet of Things (“IoT”) – Background Information Compiled by Leonie Huang, Holland & Knight I. What is the IoT? A. Where did the term come from?: Kevin Ashton is often credited with coining the term in 1999, while working as a brand manager at Proctor & Gamble and working on early RFID technology. (Kevin Ashton is a cofounder of the Auto-ID Center at Massachusetts Institute of Technology, a precursor to the Auto-ID Lab at MIT— which is part of an independent network of seven academic research labs conducting research and development of new technologies with a goal of creating new consumer benefits and revolutionizing global commerce.) 1. Sources: a. Internet of things (IoT) History, Postscapes (Aug. 20, 2018), https://www.postscapes.com/internet-of-things-history/ (“1999 - A big year for the IoT and MIT. The Internet of Things term is coined by Kevin Ashton executive director of the Auto-ID Center”). b. Kevin Ashton, “That “Internet of Things” Thing, RFID Journal (June 22, 2009), available at https://www.rfidjournal.com/articles/view?4986 (“I could be wrong, but I'm fairly sure the phrase "Internet of Things" started life as the title of a presentation I made at Procter & Gamble (P&G) in 1999.”) c. Arik Gabbai, Kevin Ashton Describes “the Internet of Things”, Smithsonian Magazine (January 2015), available at https://www.smithsonianmag.com/innovation/kevin-ashton-describes-the- internet-of-things-180953749/#i6DUCkEK2jE8yH6V.99 d. Kevin Maney and Alison Maney, Kevin Ashton, Father of the Internet of Things & Network Trailblazer, Cisco - The Network (Dec. 8, 2014), available at https://newsroom.cisco.com/feature- content?type=webcontent&articleId=1558161 (“It all started with lipstick. A particularly popular color of Oil of Olay lipstick that Kevin Ashton had been pushing as a brand manager at Procter & Gamble was perpetually out of stock. He decided to find out why, and found holes in data about the supply chain that eventually led him to drive the early deployment of RFID chips on inventory. Asked by the Massachusetts Institute of Technology to start a group -- the Auto-ID Center -- that would research RFID technology, he found a way to talk about RFID to a less-than- computer-savvy crowd – by coining the phrase the Internet of Things or IoT.”). i. RFID: “Radio Frequency IDentification is a technology that allows almost any object to be wirelessly identified using data transmitted via radio waves.” Suzanne Smiley, What is RFID, RFID Insider (Feb. 21, 2017), available at https://blog.atlasrfidstore.com/what-is-rfid?utm_source=Quick- Start&utm_medium=Link&utm_campaign=Content&utm_content =What-is-RFID B. How do people define IoT?: There are many definitions and descriptions. Commenters say there is no generally or universally agreed definition. Here are some recent definitions excerpted from the source documents noted at the end of each excerpt: 1. “Internet of Things” (IoT) refers to networks of objects that communicate with other objects and with computers through the Internet. The objects that are not themselves computers but have embedded components that connect to the Internet. a. Things” may include virtually any object for which remote communication, data collection, or control might be useful, such as smart meters, fitness trackers, smart clothing, vehicles, appliances, medical devices, electric grids, transportation infrastructure, manufacturing equipment, or building systems. i. In other words, the IoT potentially includes huge numbers and kinds of interconnected objects. b. Two features makes objects part of the IoT—a unique identifier and Internet connectivity. i. Such “smart” objects each have a unique Internet Protocol (IP) address to identify the object sending and receiving information. ii. Smart objects can form systems that communicate among themselves, usually in concert with computers, allowing automated and remote control of many independent processes and potentially transforming them into integrated systems. c. Source: Eric A. Fischer, The Internet of Things: Frequently Asked Questions, Congressional Research Service Report (October 13, 2015), available at https://crsreports.congress.gov/product/pdf/R/R44227 2. Although there is no single, universal definition for IoT, the term generally refers to a network of ordinary objects that are embedded with Internet- connected electronics, sensors, or software that can capture, exchange, and receive data. 2 a. These “things” include items sold to and used by consumers, as well as broader cloud-enabled machine-to-machine communications that enable businesses and organizations to track energy use, functionality, or efficiency. b. IoT technology enables the creation, transmission, communication, and analysis of data generated by embedded sensors. c. See Table ES-1 at page 2 for an overview of technologies facilitating IoT information exchange. d. Source: Federal Transit Administration, Report to Congress on Internet of Things, FTA Report No. 0099 (Feb. 2017), available at https://www.transit.dot.gov/sites/fta.dot.gov/files/docs/research- innovation/60436/ftareportno0099.pdf II. When did the IoT really take off? A. According to Cisco Internet Business Solutions Group, there came a point in time (sometime between 2008 and 2009) when more things than people were connected to the internet, and the IoT was “born.” Source: Dave Evans, The Internet of Things, How the Next Evolution of the Internet Is Changing Everything, Cisco White Paper 3 (April 2011), available at https://www.cisco.com/c/dam/en_us/about/ac79/docs/innov/IoT_IBSG_0411FINAL.pdf B. More recently, with 5G wireless capability people are again talking about a takeoff of IoT. Examples: • Hatem Zeine, What The Future Of IoT And 5G May Look Like, Forbes.com (Nov. 1, 2018), available at https://www.forbes.com/sites/forbestechcouncil/2018/11/01/what-the-future-of- iot-and-5g-may-look-like/#48341af0629b • Corrine Reichert, CES 2019: Sprint pairs Curiosity IoT with 5G to power smart cities, autonomous vehicles, ZDNet (Jan. 9, 2019), available at https://www.zdnet.com/article/ces-2019-sprint-pairs-curiosity-iot-with-5g-to- power-smart-cities-autonomous-vehicles/ III. How many things or devices are we talking about now? A. Estimates vary widely, for example, ranging from 8.4 billion to 18 billion connected things in 2017 and projections of around 20 to 50 billion by 2020. 1. Sources: 3 a. Cisco: https://www.cisco.com/c/en/us/solutions/collateral/service- provider/visual-networking-index-vni/white-paper-c11- 741490.html#_Toc529314172 b. Ericsson: https://www.ericsson.com/en/mobility-report/internet- of-things-forecast c. Gartner: https://www.gartner.com/en/newsroom/press- releases/2017-02-07-gartner-says-8-billion-connected-things-will-be-in- use-in-2017-up-31-percent-from-2016 IV. IoT in the News – For some recent headlines detailing public concern with privacy and security issues related to the IoT see these examples: • Laura Hautala, Blackberry Wants to Make the Internet of Things Safe for You, CNet (Jan. 6, 2019), available at https://www.cnet.com/news/blackberry-wants- to-make-the-internet-of-things-safe-for-you/ • Jennifer Valentino-Devries, Natasha Singer, Michael H. Keller and Aaron Krolik, Your Apps Know Where You Were Last Night, and They’re Not Keeping It Secret, N.Y. Times (Dec. 10, 2018), available at https://www.nytimes.com/interactive/2018/12/10/business/location-data-privacy- apps.html • Farhad Manjoo, A Future Where Everything Becomes a Computer Is as Creepy as You Feared, N.Y. Times (Oct. 10, 2018), available at https://www.nytimes.com/2018/10/10/technology/future-internet-of-things.html • Derek Hawkins, The Cybersecurity 202: California’s New Internet of Things Law Only Protects Against a Small Portion of Cyberthreats, Washington Post (Oct. 8, 2018) available at https://www.washingtonpost.com/news/powerpost/paloma/the- cybersecurity-202/2018/10/08/the-cybersecurity-202-california-s-new-internet-of- things-law-only-protects-against-a-small-portion-of- cyberthreats/5bba75781b326b7c8a8d1885/?utm_term=.5c55aec4735e • Lily Hay Newman, The Sensors that Power Smart Cities are Aa Hacker’s Dream, Wired (Aug. 9, 2018), available at https://www.wired.com/story/sensor-hubs- smart-cities-vulnerabilities-hacks/ 4 Senate Bill No. 327 CHAPTER 886 An act to add Title 1.81.26 (commencing with Section 1798.91.04) to Part 4 of Division 3 of the Civil Code, relating to information privacy. [Approved by Governor September 28, 2018. Filed with Secretary of State September 28, 2018.] legislative counsel’s digest SB 327, Jackson. Information privacy: connected devices. Existing law requires a business to take all reasonable steps to dispose of customer records within its custody or control containing personal information when the records are no longer to be retained by the business by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable. Existing law also requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Existing law authorizes a customer injured by a violation of these provisions to institute a civil action to recover damages. This bill, beginning on January 1, 2020, would require a manufacturer of a connected device, as those terms are defined, to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified.