Kevin Ashton, an MIT researcher, first used the term “Internet of Things” in 1999 to describe the use of radio frequency identification (RFID) in supply chain management.i There were big expectations then that RFID data would revolutionize business. That didn’t happen. It may be that the time was not ripe. Others think that when just a few companies were pushing RFID—notably Walmart—there was resistance to its adoption.ii The new IoT—small sensors + big data + actuators—looks like it’s the real thing. And it is a much bigger thing than RFID deployments alone could ever have been. The IoT is the emergence of a network connecting things, all with unique identifiers, all generating data, with many subject to remote control. It is a network with huge ambitions, to connect all things. This is what Bruce Sterling calls “the Manifest Destiny of silicon.”

As grand as the ambition, the implementation is made possible by some very mundane things that did not exist in the early days of RFID. The first is the continuing transition to Internet Protocol version 6 (IPv6), which creates enough Internet addresses to associate with a virtually infinite number of things. The second is cheap data storage. If there will be 50 billion connected things by 2020 (and in all likelihood, more), all the resulting data will have to be held somewhere.iii The first task for the Conference was to map the IoT, to define its terrain. That begins with demarking the boundaries between the IoT and the Internet, while recognizing that in many ways the IoT is an extension of the Internet.

The IoT Explosion

Hype. The 2014 Gartner Hype Cycle identified the IoT as one of the 10 technology trends with the greatest potential.iv Cisco estimates that by the year 2020 there will be over 50 billion connected devices.v McKinsey estimates that the IoT could have an economic impact of $6.2 trillion by 2025.vi What are the implications of this massive expansion of connectivity? From one perspective, as much as 99 percent of the world—those things not connected to the Internet—has been sleeping; the IoT will awaken it, enabling everything to be more responsive to the needs of users. From another perspective, more connectivity will exacerbate the security and privacy concerns already pronounced in a world of big data collection and analytics. As the ACLU has said, “Your home will know your secrets, and chances are it will have loose lips.”vii

What is not in doubt is that the IoT is becoming commercially attractive, as borne out by the tech world’s recent large investments in hooking up the home. Cable started the connected home movement years ago, but the pace picked up recently when Google purchased Nest, Samsung bought SmartThings, and Apple launched its HomeKit strategy all in an effort to provide the platform over which people will control their home environments and feed their information into a network of connected devices. These companies are betting on transforming home appliances and systems into networked communicators that will track customer habits and better respond to inchoate customer desires. Others, like IBM and Cisco, have staked futures on doing the same in industrial and municipal contexts. They count on widely deployed sensor networks to exploit the ambient intelligence of chattering things.

These networks build on the Internet, but their features differ in some important ways from the Internet itself.

Heterogeneity. The IoT takes advantage of the Internet for long-distance communications, but there are important architectural differences between the Internet and other parts of the IoT infrastructure. Whereas the Internet was designed as a network of networks to be a general purpose utility, the IoT involves specialized technology and varied architectures. Some devices, such as traffic lights, communicate continuously, while others send information in bursts, such as a pill that tells the nurse when it’s been swallowed. While some applications require big pipes for continuous video, most need fractional bits of bandwidth. Some will have a user interface, subject to individual control, while others will contain connectivity deeply embedded in appliances. Users can opt-out of or control connectivity in some cases, but in many others, they will not know whether or how sensors are working.

The heterogeneity of the IoT complicates policy discussions. What might be a very serious concern for some applications, such as consumer privacy, might be irrelevant for others. So too, issues of interoperability, standards and network access might play out very differently in different kinds of component IoT networks. This report will try to be sensitive to variations in IoT deployment, while at the same time positing that the IoT as a whole is a coherent subject for consideration and distinct from the Internet.

A map of the Internet of Things would include the following components:

• Low-power integrated circuits and wireless communications that enable miniature devices to sense their environments and generate data.
• Middleware that runs these sensor networks.
• Cloud and other data storage, including the “fog” of more proximate shared storage among devices.viii
• Analytics that make sense of the data and then trigger either autonomous or human-mediated decisions.
• Schemas that uniquely identify objects and also allow for their remote control through the network.ix
• Visualization and presentation tools that enable interaction between the user and sensor network data.x
• Actuators.

Of all these components, the most significant and new capabilities are: (1) vast webs of cheap and low-powered sensors gathering data from their environments and (2) actuators making autonomous decisions based on this data.xi The sensors and actuators run on top of communications infrastructure to make key connections. The data they collect or act upon may be stored or acted upon locally, remotely in a cloud system or both.

Diagram 1. IoT Data Flows

Benefits and Risks. With the IoT, as with the Internet, its features are sometimes its bugs. IoT applications create a smarter world that is better able to align resource use with need, where cities and citizens, consumers and companies all benefit from having more data to make better consumption and resource deployment choices. At the same time, efficiencies and innovation obtained through data sharing could increase security breaches, data discrimination, digital exclusion and threats to civil liberties. These negative outcomes may be the result of either intended or unintended IoT features.

An intended feature of the IoT world is more efficient decision making. For example, the insurance company refines its premiums based on the eating habits of individuals who are now trackable through personal monitoring systems and a smart refrigerator. What is an efficiency-gain for the company can be experienced by the individual as discrimination and an invasion of privacy. In the online world, sellers tailor prices and offerings based on consumer data. That kind of “smart selling” will migrate to the offline world. Critics of the IoT warn that integrating our things into digital networks creates a “digital feudalism” in which an ever-larger range of human activity is surveilled and monetized by platform operators.xii

Then there are the unintended consequences. We worry about and seek to mitigate the cyber-security vulnerabilities of the online world. These risks already implicate the physical plant when it comes to critical infrastructure.xiii A diffuse IoT introduces greater vulnerabilities to a broader array of atomic things, where hacking can interfere with the operation of devices from cars to pacemakers.

To some extent, the IoT merely enlarges—vastly—the existing Internet. It dramatically increases the number of inputs into the systems of data collection and analytics that drive the digital world. In other ways, the IoT is something entirely new. It empowers our physical world to make decisions about how it interacts with us, without any direct human intervention.

The Territory of the IoT
Peak buzz on the Gartner Hype Curve does not necessarily produce peak clarity on whether the IoT is just Internet sprawl or new territory. What changes qualitatively when we increase by an order of magnitude the nodes on the Internet (or other networks)? What does it mean when information generation migrates from people to things? The Conference participants wrestled with how to talk about and define the IoT.

Scale. One of the distinguishing features of the IoT is its sheer scale. The amount of data that can be gathered from ubiquitous sensor networks dwarfs even the most aggressive mining of the Internet of People. Consumer Internet applications give people free stuff and services in exchange for data. The same dynamic will fuel consumer IoT applications, only on a much bigger scale. In exchange for data, manufacturers will offer consumers cheaper durable goods, food, deliveries, etc.

Kevin Werbach, Associate Professor of Legal Studies at the University of Pennsylvania’s Wharton School, made the point that what the IoT does is turn “data at rest into data in motion.” Data that was once latent in objects or residing in devices is suddenly moving, findable and usable. The sheer volume of these flows raises new questions about who controls the information; who benefits from it; and how the information changes business, civic and personal relationships.

User Control. The territory of the IoT is defined not just by differences in scale from the Internet but also differences in kind. One of the most significant differences is user control. The ability of users to meaningfully opt out of data collection has long been subject to debate. We know that it is difficult to forego data collection when the collecting apps are a virtual necessity. The mobile phone itself—a sensor that we all carry with us—must be put to sleep or clothed in a Faraday case in order to avoid tracking. The IoT further reduces, and in many cases eliminates, user control over data collection.

People also cannot control the environments into which they walk. Nicol Turner-Lee, Vice President and Chief Research & Policy Officer of the Minority Media and Telecommunications Council, said she fears that the idea of consent and autonomy in the IoT world is mere fantasy. There will be times when the mere act of entering a physical space “submits you to the Internet of Things.” The same kind of involuntary submission may follow you home if you are a renter who may not know about smart-home choices. Turner-Lee questioned, “If I walk into an apartment that's fully equipped with IoT devices, do I have a right to say to my landlord that ‘I'm going to disconnect’?”

Privacy and the right to disconnect are of course implicated in a big way when people and their things are connected in such an automatic and uncontrolled way. People may want rights over the resulting data, whether personally identifiable or anonymized, but it is not clear how Fair Information Practice Principles developed for the digital world apply when so many IoT applications will have no user interface or meaningful opt-out features.xiv

Actuators. Stefaan Verhuls, Co-Founder of The Governance Laboratory (GovLab) at NYU, said that what’s really different about the IoT is that it allows things to act, not just to speak. This can be as banal as a refrigerator ordering milk. Or it can be as consequential as an autonomous car making decisions about where to brake. According to Verhulst, “This level of agency that you create through the IoT has hugely different policy implications” from the ordinary Internet.

Data Analytics. Robert Atkinson, Founder and President of The Information Technology and Innovation Foundation (ITIF), said that the territory of the IoT is defined by analytics. “The Internet has largely been a platform for communications and transactions,” Atkinson observed. The data analytics built atop these activities have been crucial in funding the development of the Internet. Analytics will become vastly more important for the IoT. To be sure, IOT technologies will provide information (e.g., Fitbit giving you the number of calories burned) and enable controls (e.g., the Nest thermostat adjusting the temperature), but “a lot of the value will come from analytics.” As part of the evolving world of big data, the massive amounts of data that IoT sensor networks collect will become useful through big data analytics.xv

The data analytics will drive the actuators, changing the behavior of things based on algorithmic prediction. Advertising, too, the lifeblood of the consumer Internet, will morph in response to the data analytics the vast number of IoT sensors support. The IoT creates an ambient layer of intelligence throughout the physical world and advertising will be part of this layer. According to Advertising Age, the IoT will require advertisers to “buy people at a moment in time—buying micro-moments to serve hyper-relevant personal ads” based on intimate data and analytics that can “promote routes in our cars” and respond to stress indicators on wearables and smartphones.xvi

Not Made in America. Bob Pepper, Vice President, Global Technology Policy for Cisco Systems, notes that whereas the Internet was invented in the United States and moved outwards, the IoT is global from the start. Different approaches in different parts of the world mean that we may see many regulatory strategies, and we can expect power struggles over technology standards, data location and management. “The players are global. The device makers are global. Where the data is and how it’s being used is global, and there are broader global questions about data transfer and data localization.”

Data as Infrastructure. The insights that the Internet is principally about communications and that the IoT is principally about data analytics lead to another distinguishing feature of the IoT: It turns data into infrastructure. Like the Internet, the IoT depends on a physical infrastructure of routers, servers, IP protocols, telecommunications networks and distributed storage and processing systems associated with long-distance communication, cloud-based storage and processing for big-data analytics. Data is infrastructural as well. The collection of data and data analytics drive the behavior of actuators and the purpose of sensor networks. The data collected from these sensor networks becomes a new infrastructure, access to which may be critical for the provision of certain services.

Types of IoT
Once within the territory of the IoT, there are different ways to visualize its topography.

Diagram 2. Conceptualizing IoT Applications

One is according to user and associated kinds of applications.

Personal → smart homes, health and wellness monitoring, driving.
Enterprise (cities, industries) → industrial automation, municipal or other public resource management, agricultural productivity.
Utilities → water monitoring, electrical grid.

Another cut is according to possibilities for user control. Some IoT applications have no user interface. Once the connectivity is installed in a thing, a human being plays no role at all, except possibly to disable it. Censors woven into fabric, or dropped into paint, would be examples of this.

User interface (e.g., Fitbit).
No user interface (e.g., environmental sensors).

A third way to categorize the IoT is by technology. Some applications transmit data but require human intervention for subsequent action. Others lay actuators on top of sensor networks and data analytics so that the data can direct action autonomously, without the need for human decision making after the software is written. Examples might be found in the smart house that tailors energy supplies based on usage data. The autonomous car is another.