maanantai 5. kesäkuuta 2017

Human rights and IOT

This week I'm at the EuroDIG conference, discussing policy issues related to the Internet. I will be on a panel focusing human rights and the Internet of Things (IOT).

And that's an interesting topic! At the IETF, we've had plenty of debates about the general topic of whether human rights should be a consideration when designing Internet technology. If you are interested, read the Human Rights Research Group's draft on the topic.

But back the more specific question of IOT. The panel is hosted by the Dynamic Coalition on IOT. This is a group of people who have looked at the role of ethics in IOT systems. I've been an occasional contributor in that group as well, and their document also makes good reading: it covers things like meaningful transparency and user control.

But, to be honest, I'm not the human rights or ethics expert. I know a few things about the tech though. Amidst various IOT discussions I find that it is useful to set of few things straight, so that we at least have a good basis for understanding the technology. And then we can have a more accurate discussion of the ethics or human rights.

Done right, the Internet of Things can bring great benefit and support our societies and human rights: the environment, energy efficiency, quantity and quality of food production, safety and many other things stand to benefit. But it takes effort to ensure that we can enjoy these benefits, and to avoid side effects. And it takes education for all of us to understand how IT is shaping our lives, and how it can be managed and used.

I wanted to highlight four issues:

1. It is not about the gadgets, dammit!
Many IOT discussions focus on the efficiency, security issues or other characteristics of the devices. While that's important, that is far from the full picture. We'd be far better off to consider cloud servers as an even more important component in most systems; that's where the most of the interesting functionality usually resides. And that's what you also want to be under the user's control. 
Similarly, we are often focused on the gadgets and servers, but from my perspective the true value of IOT systems in the data produced or consumed by them. Having user control of the data is very important. How that data is used and by whom is important. It needs to be put to good use by or with the consent of those whose data is being used. It should not be used to violate privacy or in a discriminatory manner.
Also, the architecture of IOT systems as a whole matters a lot. The IRTF Thing-to-Thing Research Group, for instance, is looking at various designs where the devices are talking to each other, rather than (for instance) connecting through a centralised cloud entity. A classic example of where this is the right way to design the system are light control systems; you don't want your ability to turn on lights be dependent on your Internet connection :-) 
 2. Collateral damage
When we talk about security of the IOT systems, we need to understand that security is not merely about protecting the devices or even the data. 
The attacks that caused some common Internet services to fail last year were launched from compromised IOT devices, but the target of the attack was not the devices themselves. It was the other parties, this time the Internet naming infrastructure. (For a discussion of this incident, see the video from IETF-97 technical plenary.) 
The friendly neighbour principle: You cannot design Internet-connected systems without having to consider the effect of your systems to others in the Internet. 
 3. Interoperability
Interoperability is a key issue in creating a large market of useful applications and enabling user control. With more and more Internet-based smart devices, I believe we are on a good path with regards to interoperable devices being able to use the same networks and run over Internet protocols. However, this not enough. We also need applications that are interoperable. Otherwise it will not be possible to plug light switches from one manufacturer to light bulbs from another. 
We also need interoperability for the sake of driving competition, and to ensure that the market supports these systems on a long-term basis regardless of individual manufacturer's decisions. Application level interoperability was discussed in the 2016 IAB workshop on semantic interoperability
 4. Rights of the user
The ability of the user to be in the driver's seat with regards to information concerning him or her is important. I wanted to highlight one additional issue that is important: the right to tinker
This isn't just an issue for hobbyists, it also important for our ability to update products that may be used for decades after they have been manufactured and long after support for them has ceased. I also believe the ability to build new things and modify various consumer systems is important for a healthy, innovative ecosystem.
And as for the opening picture above, that was the message waiting for me this morning on my Inbox. My IOT devices, such as the weight scale, telling how I'm doing. I think the machines have something to learn still from instilling confidence and positive attitude! ūüėÄ Then again, maybe the weight scale would be more efficient, if it slapped me on the face for my failure to have a more healthy diet. Would the positive attitude or the slapping IOT be more ethical?

Jari Arkko

Screenshot (c) 2017 by Jari Arkko. I'd like to acknowledge Ari Keränen, Anna Larmo and Francisco Alcoba for interesting discussions in this problem space.

Have an idea, buy components at midnight

Have an idea, fetch parts at midnight to implement ❤️

Photos (c) 2017 by Jari Arkko

torstai 25. toukokuuta 2017

Access point recommendations?

With some upgrade of my Internet connection, it seems that my trusty WRT-54GL wireless network is now a bottleneck. I would love to get a recommendation for 802.11ac etc access points. I'll be operating them strictly in access point bridged mode, and I'll need several so cost is a factor. But the WRT-54GLs have been spectacularly reliable and did not get confused and need reboots like many other products. That is something that I absolutely need.

lauantai 20. toukokuuta 2017

More disk!

I am in Canada, and have bought once again more hard drives! C-Ordinateurs Canada, the local Fry's equivalent, supplied the goods!

tiistai 16. toukokuuta 2017

If you think about IOT security, think broad enough!

Internet of Things security issues are serious, and are often the focus of discussions. The discussion is much needed. How can we make our IOT devices safe?

How can we prevent attacks similar to those that last year caused many popular Internet services to be unavailable, with badly secured IOT devices being used as a part of the attack?

This is a very important topic.

However, I would like to argue that people often think about this in a too narrow manner. First off, we  have a tendency to focus on visible, concrete things. However, there's more to IOT than the gadgets, and I think the other parts deserve equal scrutiny.

The IOT is not in the gadget, it is in the cloud.

We have to secure the gadgets, but we also have to secure the rest of the system. And more broadly, it benefits the consumers and users to have secure, interoperable, and open solutions for both the gadgets and other parts of the IOT ecosystem. We need data that is in well-specified format, we need data that is under user control, we need systems that you and I can compose from components. But we do not need closed ecosystems.

torstai 11. toukokuuta 2017

Internet and Societies

Today we have an interesting panel discussion organised by ISOC and Chatham House on the effect of the Internet on societies. Is the Internet helping bring societies together, or creating more divisions? With the increased criticism against globalisation, fake news, and the emergence of closed social circles for like minded (and often misguided) fragments of society, it is easy to be worried about this.

But, it is also easy to focus on the most visible issues. When looking at the Internet and societies, one needs to consider the full scope of human interaction, andconsider human, technical and commercial aspects together.

What issues are affecting our ability to connect together? I want to start with five points:

Human interaction is broad, and we need to look at the whole picture. It is easy to focus on the most publicly visible forms of media, and see how the news media for instance has, to put it kindly, become more diverse.

But whole picture is broader and more nuanced, and the concepts of togetherness and divisions may not be so applicable. For instance, the Internet has made it much easier for various smaller groups to connect where they perhaps had no ability to do so before. Communities working on Wikipedia, people with special interests being able to connect, minorities connecting to their culture, and so on.

Human interaction is both about tech and human abilities. It would be a mistake to think about solely technical solutions for problems involving, say news or social media.  Our technical capabilities advance at an incredible speed, but humans are also very good at learning new skills in new environments.

But, clearly critical media reading and communication skills are needed even more in today's world. These topics need to become even more central in our schools and continuing education programs.

Division vs. unification goes beyond people discussions. The Internet continues to be embedded in the fabric of our societies. We need to consider not just the people's discussions, but how well the Internet supports all the other interactions from personal gadgets to managing cities' traffic to running businesses.

Technical and commercial considerations. TCP/IP and the web provide a platform where we have almost universal interconnectivity and lack of technical barriers.

Still, as the IAB's IOT semantic interoperability workshop pointed out last year, interoperability at the level of applications can still be a problem. Can you buy Apple lightbulbs for a house that has Microsoft light switches?

And more broadly, are commonly used Internet services such as social networks erecting borders that restrict efficient connection, for instance due to their deployment patterns as is shown in the image further down?

And, is our increasingly centralised "winner takes it all" Internet economy driving a model where it becomes difficult to switch social network/search/video/mail/application store providers?

Finding broader consensus is hard, but rewarding. As those of us who work in standards or open source realise, finding agreements in broad, diverse communities is hard and time-consuming. Yet, we find the motivation to do so because if we succeed, the benefits are much greater than with everyone running their own things. We've obviously done this not just with technical developments like the Internet, but also to a large extent with our societies, building their infrastructure and rules. And I believe we will continue to be able to do that.

And where does all this leave us? Clearly, there is a lot of work ahead of us. But that work is not merely about the public sphere of news media or social media discussions, it is also about our ability to offer communications tools for all groups, regardless of their size. Our continuing education of the human parts of the system. Our drive to improve standards so that the technology allows connections. Our drive to ensure that the business system provides the possibilities for evolution and connection.

I would also like to point to my other article for a discussion of why IOT security is a much broader topic (inline with the thoughts in this article) than people usually focus on.

What do you think? Leave a comment below! You can also follow our panel discussion online.

Jari Arkko

Acknowledgments: I would like to thank all my friends and colleagues at the Ericsson, IAB, ISOC, and Chatham House for interesting discussions in this problem space.

Picture credits: 1/ Jari Arkko 2/ Evi Nemeth for the original picture, edits by Jari Arkko 3/ World Map of Social Networks from Vincos.It. How divided is this world, even at this level? And I was surprised to find out that there are places in the world where the most popular social media application is LinkedIn :-)

lauantai 29. huhtikuuta 2017

More 10G cards

Received my 2nd 10G Ethernet card, and successfully inserted it to the router. 3rd card is on order...

I've started testing the cards, and can get 9.3 Gbits/s speed! That does feel fast. This number is from iperf. Using SSH to copy files I get a smaller number, however, around 1.2 Gbits/s to 1.8 Gbit/s depending on which crypto is being used. The smaller number is on chacha20, the faster on aes128-ctr. Still investigating what the bottlenecks here are, trying to understand what iperf measures, for instance. Preliminary results seem to indicate that a CPU core is operating at a high load when it is doing encryption for SSH, but that disks are not the source of the delay.

More research needed... but this is already a 12-18 fold increase from my earlier servers who were only able to do about 100 Mbit/s while using SSH. In this case that speed was very clearly due to the CPU being unable to do crypto at a faster speed.

With regards to getting these cards to work, my only complaint is that it is difficult to manage Linux devices when the number of type of interfaces change. The interface names change... and for some reason I don't get accurate information about link status from ethtool, and some of my interfaces seem to not work well with a /etc/network/interfaces-based definition, but rather need explicit commands to be brought up. Odd. Maybe I've misconfigured something, or maybe there's some issue with these specific cards.

Photos (c) 2017 by Jari Arkko