Tuesday, June 2, 2009

The Privacy Challenges and Implications of a "Smart Grid"

I found a couple of excellent pieces, one an article, the other a very thorough scholarly paper from the Social Science Research Network, that examine the privacy consequences, implications and challenges of the diffusion of smart grid and smart metering technologies.

Transition to a "Smart Grid" system has been trumpeted by former Vice President Al Gore, and started gaining serious traction once President Obama announced his plan to overhaul U.S. infrastructure - including construction of a nationwide "smart grid" that promises to help address many of our current energy challenges. According to Obama (and other environmental experts), the plan offers the hope that it "will save us money, protect our power sources from blackout or attack, and deliver clean, alternative forms of energy to every corner of our nation."

What is especially interesting about this topic - to me anyway - stems from my past work as an environmental advocate versus my current work on privacy related issues. As some of you may have gathered, there are some issues in which these two interests - privacy and environment - clash (all be it more "gently" than other more typical oppositional interests).

Privacy is a concern when talking about a transition to a "smart grid" system because of the kinds of high resolution electricity usage information that it compiles and the intimate details of a consumer's daily life it monitors. This information in turn could then be used in ways potentially invasive to an individuals privacy.

On the other hand, the environmental benefits of such a system, specifically the reduction in energy usage and greenhouse gas emissions (among others), represent a critical step forward and an important component to any comprehensive global warming and sustainability strategy.

And therein lies the challenge with a "Smart Grid": How do we balance the privacy concerns of the individual with the important environmental and energy security benefits of a more efficient energy infrastructure? Clearly, this is a challenge that must be worked out, and soon.

While climate change threatens our species longterm survival, our right to privacy continues to be subverted by big business interests (esp. marketing and advertisers) and the government (esp. in the age of the phony 'war on terror'). The rapid advancement of technological innovation - without the requisite regulations to go along with them - only adds to this growing privacy protection challenge...which the development of a "Smart Grid" epitomizes.

Before I get to more on the Smart Grid, another example in which the interests of environmental and privacy advocates clash has been on the issue of insurance companies providing financial incentives (Pay as You Drive) for motorists who reduce their driving.

In the case of one bill in California - AB 2800 - insurance companies were given the authority to request, but not mandate, that customers comply with certain mileage verification requirements including the technological GPS devices. As amended, AB 2800 removes direct references to GPS monitors, however it would allow insurance companies to require drivers to use technological devices in their cars, or pay a higher rate if they refuse.

The mileage program is nominally “voluntary,” but its permissive language would result in mandatory GPS monitoring, since a driver would be forced to pay more if he or she did not participate. There is no language in the bill limiting the information that an insurer may collect from a GPS device. This raises significant privacy concerns regarding collection of data on consumers’ driving habits, destinations and other information that is not germane to the objective of verifying the total miles driven.

Before drivers sign off on the black box and earn incentives, they need to know what they are buying into. AB 2800 - according to privacy advocates - is too cloudy and lacks safeguards when it comes to potential invasion of privacy. Mileage "quality" also means insurance companies can be privy to information such as where drivers go and at what time, and potentially information can be used against people in court.

And as an editorial in the Contra Costa Times noted,

"How would we determine good driving habits and bad driving habits? If someone parked in a neighborhood that had a high crime rate, would they be penalized; what if drivers had some questionable behavior issues being the wheel; what if people drove more at night than day because they worked swing shift? Could the information go as far as knowing when a person saw a counselor, visited a bar at lunch or was cheating on a spouse in the afternoon? There's no way of knowing how this information can be used."

Once again, the possible environmental benefits of a system that encourages and rewards customers for driving less is clear, but in my mind, unless more stringent privacy protections are put in place, its just not worth the trade off.

Similarly, in the case of the "Smart Grid", the answer lies not in an "either or" scenario, but rather, in a thorough, thoughtful and deliberative public policy process that includes ironclad, "opt-in" privacy protections along with the kinds of smart, efficient, and sustainable environmental benefits nearly everyone agrees would also accompany such a system.

Susan L. Lyon, who has an has extensive background representing multinational companies on privacy, data security, online safety and Internet laws, wrote the following in a recent Reuters article entitled "Privacy Challenges Could Stall Smart Grid":

Those not concerned by the tracking of mere energy usage may become more concerned as devices in our home become increasingly "smarter." One can easily envision a not too distant state of technology convergence where such devices could be used to track more sensitive information. For example, security technology already exists to monitor presence in homes to detect break-ins. Could that same technology be applied in a smart-grid environment to monitor when residents are home?

What else will smart appliances "tell" others about households? Will a smart refrigerator be able to determine and disclose the types and quantities of RFID-chipped food products and pharmaceuticals stored on shelves? Who will get this information? Will retailers be able to access this information and use it for marketing and services? Will law enforcement? Concerns such as these are already top of mind for academics and consumer privacy rights advocates as these technologies develop.

These privacy concerns in relation to the smart grid were heightened recently with the introduction of a federal cybersecurity bill earlier this year. The Cybersecurity Act aims to protect our nation's infrastructure, including our energy grid, from threats by malicious hackers, terrorists and foreign intelligence. Privacy advocates and some industry associations have expressed concern about a provision in the bill that would allow access to "relevant data" of private sector information systems and preempt all other laws.

...

In addition to taking into account existing laws, companies that develop smart grid technology would be wise to anticipate consumer reaction to privacy impacting systems and features and the policies and laws that continue to develop in this area. Fair information practice principles such as those recommended by the FTC provide a good roadmap for developing practices and process that address emerging privacy concerns and laws. The main principles to consider will be in the areas of notice and choice.

...

The nature of the smart grid requires ubiquitous deployment of monitoring technology in every home it touches. The impact of this is significant considering that privacy of the home is such an important value in our society that its protection is guaranteed in the U.S. Bill of Rights, "The right of the people to be secure in their ... houses ... shall not be violated." So while the benefits of a unified national smart grid system are very clear to most, as with any technology, the systems that provide these societal benefits and the policies that shape them should be designed to account for the privacy concerns of the individuals they serve.

Click here to read more from Ms. Lyons.

As luck would have it, I found a paper in an academic journal that tackled this very subject today too entitled "Privacy and the New Energy Infrastructure", by Elias Leake Quinn CEES, Uni. Colo. Law School.

The paper is extensive, so let me just point you to some of it's key conclusions:

...policies that set limitations on the collection or dissemination of potentially private information by either restricting the resale of data or inhibiting access to collection at the meter (say, if meter access was restricted technologically to ensure only the utility could get the sensitive information) in effect determine the scope of possible data services. The process is thus back where it started. All of this, of course, takes place within the context of existing privacy jurisprudence and positive law, which itself may shift with the new technological pressures.

Here—as with all attempts at anticipating problems—the solution must involve, first and foremost, drawing attention to the potential privacy problem posed by the massive deployment of smart metering technologies and the collection of detailed information about the electricity consumption habits of millions of individuals. From there, efforts to devise potential solutions must progress in parallel paths, the first in search of a regulatory fix, the second a technological one. The first protects against the systematic misuse of collected information by utilities, despite new pressures on their profitability, by ensuring the databases are used only for their principle purposes: informing efficient electricity generation, distribution, and management. Such regulatory fixes are not difficult.

Indeed, Connecticut’s relevant regulations may already provide adequate protection against many of the “troubling implications” of this growing data set. Opt-in regulations are appropriate—at least in the short term—to protect consumers while the market for smart metering data develops and the full capabilities of those with access to that data are laid bare. As many states are taking a fresh look at their relevant regulations in connection with the restructuring of billing rates, swift action on this issue is both possible and easy.

The technological fix is a bit larger an obstacle, and solutions, on my part, more covered in lint. However, some recommendations are apparent even from this discussion. Specifically, the technological answer to these concerns must come in two parts: one addressing the security of the database as aggregated and kept by the utility, and the other addressing the security of transmitted data.

The former part does not differ in any meaningful way dealing with database security of any other sort of information. The second part poses more subtle problems, though. Most notably, the structure of just what is being secured is not quite established – standards have yet to be finalized, creating the potential that solutions here would have to be tailored to individual smart meter deployment efforts. One possible approach might be to aggregate and encrypt the data being sent from smart meters back to the utility by putting additional hardware on each transformer. This would basically anonymize an individual’s information to roughly the scale of a city block.

The cost of such an endeavor would likely be huge if attempted as an independent project, but if done in parallel with the deployment of smart meters, the added cost is likely far less. However, this would require the rapid development of such technology, as the deployment of smart meters has already begun.

In the final analysis, the privacy problem posed by smart metering is only a difficult one if the data gets unleashed before consequences are fully considered, or ignored once unfortunate consequences are realized. But to ignore the potential for privacy invasion embodied by the collection of this information is an invitation to tragedy.

Once again, smart public policy, particularly in the case of a "Smart Grid", will likely begin and end with the state legislature and public utility commission. Let's hope, as this article also argues, they "examine the codes of conduct governing utility disclosure of consumer information in their various jurisdictions to address this new privacy threat."

Click here to read the piece in its entirety.

3 comments:

Anonymous said...

My opinion of smart meters:

I not trust any form of conservation program that comes from electrical producers/sellers.

If coming from them, I don't think it's about conservation.

It is about driving down the bottom line, electric sales thus corporate profits.

Once that is achieved, they have ammo to hike prices on electric customers.

If a conservation program stems from a person or group who does not derive profit from the sales of electricity then their motives really aren't in question.

If it comes from the power company, that draws attention to their motives and points directly to driving down revenue because that is what the conservation would accomplish thus leading one to believe that it exists for the purpose of raising prices later because do you really think they are just going to sit there and let their bottom line go down and down and down?

NO WAY! They are in the business of generating revenue, not losses and that mans rate hikes to compensate.

Look at how much money they would put out to have that on the meter of every customer, that in itself needs to be compensated for plus the thoughts put into the minds of customers that they can use the information derived from such technology to lower their power bills and you will see that in the end the customer not only has to cover the amount that it cost to do this they will also have to pay higher rates because they were duped by the company into driving down the company's revenue.

So not only do I hear that any monies borrowed for smart grid will be backed by rate payers but rate payers drive down their power bills with the technology so again it takes a rate hike to cover the loan.

Plus the carbon tax will be passed along right down to the customer who in the end will be the only entity that actually pays a carbon tax.

So that is 4 legitimate reasons for rate hikes in the near future.

As for the privacy issue, this is an astronomical invasion of the customers home and life. Give me an anonymous 1 month graph from that smart grid attached to a meter and I can identify every thing that person did in their home on a daily basis from going to work, coming home, going to bed, getting up, laundry, talking on a powered phone, TV time on/off, computer time on/off, I would even know what times per day they urinated and have a bowel movement and how long it takes because of the spike and its duration created on the graph by the bathroom light, yes, I would even know how many times per day that they opened the refrigerator door, whether they prefer a microwave or stove top, have a home security system, blah blah and all by correlating spikes to personal habits and movements through the home.

24 hours per day, you are literally tracked from room to room in your own home with smart grid on your meter and WITHOUT A WARRANT to conduct such an act of SURVEILLANCE on you and your family or to possess such data on you.

That is why smart grid attached to a meter should be the option of the customer and not a mandatory function placed on the customer by the power company because it is illegal surveillance and invasion of privacy.

All that will be aggregated to assist rate hikes.

That leads to time of day price changes. I hear the price of electricity will no longer be uniform but will vary across a 24 hour period which to me is nothing more than grabbing all the data that they can in order to gouge electric prices during peak times.

This type of billing should be illegal.

I also believe that info on the home derived from smart grid will be provided to law enforcement upon request or there may be certain flags in the software that requires the power company to call the cops.

No honest and intelligent person should be in favor of smart meters because of what it renders and that would only interest scheming profiteers and police state interests.

Smart grid is only green in the color of money and not our environment.

Anonymous said...

The first guy said EVERYTHING!!!! I wanted to say. I cant believe nobody really cares. I do not want this 1 bite. Ill even pay more not to have this honestly. Although I should have too.

CFC said...

I think a lot of valid concerns have been raised here, and I urge you to keep coming back here for future posts on Smart Grid and its implementation (because it will be whether you like it or not...that's why I'll be working to make sure as many of our concerns are addressed as possible). Some pretty important decisions in this respect are coming in California, and we (Consumer Federation of California) have just joined TURN (The Utility Reform Network) in requesting that the Public Utilities Commission set aside a separate hearing solely for the purpose of addressing privacy concerns. Stay tuned...