The IoT and the Law of Unintended Consequences

Let’s start by understanding two things: What is the IoT? And what is the Law of Unintended Consequences?

IoT: The "Internet of Things". This is the connecting of virtually any device to the Internet. Smartphones, dishwashers, refrigerators, headphones and earbuds, lamps, HVAC systems…you name it. “Alexa, please add milk to the shopping list.” That’s IoT. But IoT also includes the parts of machines, such as airplane engines and oil rigs. Critical components are equipped with sensors that signal the manufacturer when potential problems are on the horizon. Important stuff.

The Law of Unintended Consequences kicks in when the outcomes of an action are not those that were intended. These can be both positive and negative. Examples include the discovery that aspirin, intended for pain relief, can also prevent heart attacks. The setting aside of large tracts of land as hunting preserves for nobility in the middle ages has led to space now being available for large green areas, including public parks, throughout England.

On the other side of the coin, the passing of laws for the use of safety helmets for bicyclists in Australia did lead to a decrease in serious head injuries, but has also led to a reduction in bicycling and this overall decrease in exercise has had a net negative health effect.

The US Park Service eradicated wolves from Yellowstone Park to protect the other species. The unintended consequences included a rapid and huge increase in the deer population, which led to overgrazing, which led to an almost total elimination of new forestry growth, which led to riverbanks collapsing, which led to a decrease in fish population…you get the picture. In 1997, 10 wolves were reintroduced to Yellowstone. Since then, the deer population has been under control, new forest growth has abounded, fish populations have returned, etc., etc., etc.

Unintended consequence: When you use an app to turn your light bulbs on and off, you do not know how much information is being collected. Say you always turn your lights on by app when you get home at night, but not when you are away. Therefore, for three nights in a row your lights are not turned on. Or maybe your refrigerator door hasn’t been opened in a week. Is this information available to someone looking to break into homes in your neighborhood?

Unintended consequence: The one-way device that allows you to look in on your infant may also allow a cyber-intruder to do the same.

Alexa may be great at adding milk, butter and eggs to your shopping list, but is she also remembering private conversations that can be listened to real-time or later on? The answer to a lot of these questions is simply: we just don’t know. What we do know is that cyber-criminals have become incredibly adept at their craft and you can bet your last dollar that right now there are people working their tails off trying to figure out how to use this technology to steal identities, money and possessions.

How big is this problem? The truth is, again, we just don’t know, but consider this: right now there are approximately 11 billion IoT devices in the world. By 2025 it is expected there will be 80 billion. You may remember a massive cyber-attack that shut down servers across the east coast of the USA this past October. Without getting too technical, this was caused by an attack on millions of IP addresses associated with IoT devices. (Every IoT device is connected to the Internet with a unique IP address, and the Internet allows two-way communication.)

The other real truth is that the manufacturers of these IoT devices are way behind in developing the security measures that are needed for consumer/business protection, and that even when they have been brought to an acceptable level of security, the vast majority of the billions of devices out there can never be updated. Their technology does not allow for updates. They will be sitting out there for decades, possibly as easy targets for cyber-crime protocols of the future.

Protecting yourself requires more than just common sense. It requires vigilance, thinking like a criminal and always being aware of possible unintended consequences.