From the U.S. Government Accountability Office, www.gao.gov Transcript for: Big Bite: The Internet of Things Description: The internet has gone well beyond computers to affect everything in our daily lives-from our cars to our baby monitors to our.toasters. We'll talk about what all this connectivity means for consumers, jobs, and the economy. Related GAO Work: GAO-17-75: Technology Assessment: Internet of Things: Status and implications of an increasingly connected world Released: May 2017 [ Background Music ] [ Sarah Kaczmarek: ] This is the Watchdog Report, Big Bite Edition, where we really sink our teeth into GAO's non-partisan reports on federal spending and ways to make the government work better. I'm Sarah Kaczmarek. What happens when everything in our homes and our offices is connected? Our toasters, our cars, even our baby monitors. What happens as we move from the internet of computers to the Internet of Things? Is it a good thing? What are the risks? In this edition, we're diving into GAO's technology assessment report to Congress on the Internet of Things. If you haven't heard the term before, the Internet of Things basically refers to how our devices and vehicles take our data and personal information, send it to the internet, and then help us make decisions. We'll talk today about how these devices might be impacting your information security, your privacy, your safety, and even the economy! [ Naba Barkakati: ] It's not exactly a thing that you can point to, but Internet of Things happen to be a concept for connecting all kinds of devices to the internet. There's a tremendous amount of interest on the Internet of Things, and as well as interest from Congress to find out, you know, what is going on in this area? [ Sarah Kaczmarek: ] So that was Naba Barkakati, GAO's Chief Technologist. He leads the agency's work in exploring new technologies. I met with Naba out on the national mall in Washington DC. There were plenty of people out jogging, biking, playing soccer, and some of them, of course, were wearing fitness trackers. [ Naba Barkakati: ] So fitness trackers are a perfect example. Because that's like a very consumer, personal product. So here, there are maybe sensors for like measuring your, you know, heart rate and it might have sensors to measure, you know, the movement and how intense the movement is. So these can help provide back to you some information about your activity throughout the day, and meeting your, you know, fitness goals or not. [ Sarah Kaczmarek: ] So that'll remind me to get up and be more active to meet my fitness goals. So what are some other kinds of Internet of Things devices? [ Naba Barkakati: ] So the types of Internet of Things devices can span such a wide spectrum. The best way, maybe, to give examples would be the home, is a good example. And you might hear the terms, like, smart home. And the word, smart, comes along because all the ways in the home you can connect, you can get some -- something out of it that's more than the device can provide on its own. It would be the home thermostat, for instance, the home alarm, security systems connected or video cameras for monitoring things. You could have like kitchen appliances connected too. So some of it is rather extreme, but some are truly useful for people who connect them to the internet. [ Sarah Kaczmarek: ] So they all sort of work the same way, where there's basically a device that's going to connect to the internet, and then help provide information back to the user or the owner, kind of to help them make a decision? [ Naba Barkakati: ] Yes, it can be a jet plane engine also, and it can be something completely different from home appliance, but all of them are connected to provide information to the internet somewhere, and that's usually the people who manufacture the device, their server systems, and there they run software to give you some value added. You know, maybe they tell you how much energy you use throughout the, you know, throughout the month or something, or it can be even to the point that thermostat learns what your pattern of activity is during the day, and then adjust itself, it's like a smart thermostat. [ Sarah Kaczmarek: ] You don't even have to put in a decision. [Naba Barkakati:] Yes. There might be -- you might be actually told not to do too much because it's learning. [ Sarah Kaczmarek: ] Okay, so in a nutshell, so far it sounds like the Internet of Things is about our devices in our homes, in our communities, even planes in the sky being connected to the internet, using our information, and helping us make decisions. Or even making decisions for us. But what are the risks that consumers are facing with all of these connected devices and connectivity? [ Naba Barkakati: ] As they connect more things to the internet, like any other system, you know that cyber security is going to be a problem. So, obviously, in this case too, the security and privacy I think becomes the number one issue, in this case, for acceptance of the device, and you know whether it'll be adopted by people or not. So, ultimately, that will be I think what I would say number one concern we have, among many others. [ Sarah Kaczmarek: ] So what about safety, for example? [ Naba Barkakati: ] Yes. Of course, you know, as you're connecting, for instance cars, to the internet, or making them more smarter, analyzing data, etc., while you're getting to the point where if somebody's now able to get that pathway, the connectivity goes both ways, if they're able to get to the car and take control, that becomes the issue of safety, and that has already happened in some cases, as you know from examples in the news, like someone taking over a connected car and maybe disabling the various parts of the car. So it is a concern, definitely. [ Sarah Kaczmarek: ] Let me also ask you to touch on the economic side of this as well. [ Naba Barkakati: ] So that's one idea, it has a great benefit, but there's of course always downside, you know, in the -- when there's automation, maybe there's a job has changed for people, or maybe there's a loss of job, so those go hand-in-hand, essentially. The great benefit economically, savings, etc., efficiency, but at the same time, potential for changing jobs and changing employment pictures, changing, maybe even a loss of jobs. [ Sarah Kaczmarek: ] Wow, that's a lot to download here. Naba talked about a lot of potential benefits, but he also touched on a lot of potential risks. I think the first thing I want to figure out is how secure is my private information when it's stored in these devices? What happens to all my data? Can it be hacked? To talk about this, I brought in GAO's Greg Wilshusen, a director in our Information Technology team, who also worked on this report to Congress. Alright, so watch your step here. So, Greg and I are out on top of GAO's roof, where we have our cell towers that provide some of our internet connections. The roof is on top of our seven story building, and there are no guard rails, so I won't be peeking over the edge. But we do have a nice view of the National Building Museum, and, not surprisingly, hundreds of rooftop cell towers all across Washington, DC and our sites, which has me concerned about information security and privacy. So I was hoping Greg could help me unpack some of Naba's concerns about what happens with the information we share with our devices, like fitness trackers? [ Greg Wilshusen: ] What happens is that the information that either is entered into the fitness tracker by you, for example your name, social security number, address, and also the information that the tracker itself senses about you, to include your heart rate, your location, perhaps, the number of steps you've taken, are loaded first into the fitness tracker, and then going through Bluetooth technology, is then connected, or transmitted to your phone, your mobile phone that you may be carrying. From there, it is then transmitted the -- either a WiFi network or cellular network, to servers up in the Cloud, right? And one of the things that should be a concern, or at least a consideration, for individuals, is where's that data going, how is it being protected? And the answer lies in the security safeguards at each of those phases of that transmission cycle. And so that typically in some of those phases, may not be all that secure. [ Sarah Kaczmarek: ] Okay, so, for consumers who want to beef up the security of their personal, identifiable information, how can they do that in those steps along the way? [ Greg Wilshusen: ] Well, the very first thing that I think a user needs to do is truly understand what its device, or his or her device, is doing. What information it is collecting, how it is collecting that information, and where -- how it processes and transmits that information to other sources. From there, it's important for users probably to read the manual, kind of, you know, of the device, to see what type of security controls or protections are available through that device, and how they can either change or revise those settings to make the transmission and their data more secure. [ Sarah Kaczmarek: ] What happens when so many of these different kinds of devices are connected, how do you then do that risk analysis? [ Greg Wilshusen: ] There's a give and take, as there always is with security and -- and some of the operational benefits. But there is a need for the individual to be able to assure that its -- his or her information, or the organization's information, is being adequately protected throughout each of those steps, from the devices, all the way to where they may be stored in the Cloud environment. And particularly with agencies and entities that have arrangements with Cloud service providers, they need to make sure that the responsibilities for securing the information are clearly laid out between what the Cloud service provider is responsible for and what the individual entity or individual is responsible for. Because it's not always the same for Cloud service provider to Cloud service provider, or even Cloud service environment to Cloud service environment. [ Sarah Kaczmarek: ] So we also have to broaden our perspective on information security from the individual consumer level to businesses and even the government. So this means it doesn't just impact me and those smart devices I have in my home, but it also impacts organizations where we work, and the government, and how they secure data. [ Greg Wilshusen: ] The federal government is migrating many of its applications to systems to Cloud service providers, and -- and Cloud environment, and it's important that the agencies and the Cloud service providers, together, understand what each role, each entity's role is in protecting that information. [ Sarah Kaczmarek: ] I guess this means it's time for me to break out my fitness tracker's manual, and see if I can encrypt my data. After the break, we'll be talking about what the Internet of Things means for our cars. [ Background Music ] [ Commercial: ] Interested in learning more from the U.S. Government Accountability Office? Be our friend and like us on Facebook. Our Facebook page has the latest information on our reports, blog posts, podcasts, videos, photos, interactive graphics, and much, much more. That's Facebook.com/USGAO. That's Facebook.com/USGAO. [ Background Music ] [ Sarah Kaczmarek: ] Well I have a long commute, and I use the navigation in my car just about every day. And I've got apps that I use to listen to music or podcasts, okay, mostly podcasts, in my car. Does this mean I have a connected car? And, what do connected cars mean for the community? To find out, I spoke with a couple of directors in GAO's Physical Infrastructure team. First, here's Dave Wise, who leads our work on cars and cybersecurity. Dave and I are talking, in my car, in GAO's basement parking garage. He's going to answer my new burning question, did I buy a smart car without even knowing it? [ Dave Wise: ] Well, to some degree, almost all cars today are smart cars. They're transferring information to the internet, they have WiFi, they have global positioning systems, they have Bluetooth, so, yes, maybe you did know it or didn't know it, but it's -- it's what you could consider a smart car. [ Sarah Kaczmarek: ] So it turns out I did buy a smart car. I'm guessing this means my car is even part of the Internet of Things. [ Dave Wise: ] Yes, because the Internet of Things is something that will take information from the vehicle and transfer it to the internet, and sometimes the vehicle will act upon the information it has, based on what it's transmitting, and an example of that would be some of the very sophisticated cars will have things like parking applications which assist you when you're trying to back up a car. [ Sarah Kaczmarek: ] This car doesn't have it, but the minivan that I have does, and it's very helpful with the parking in that big car. [ Dave Wise: ] Sure, yeah. [ Sarah Kaczmarek: ] So how do you see the Internet of Things changing the future of cars? Are they going to become more connected? [ Dave Wise: ] Yes, I think that's the trend. You're already beginning to see that with things like vehicle-to-vehicle connections, where cars can talk to each other and provide warnings of vehicle infrastructure, where it's receiving information from standing internet connected facility, basically, these are all things that are aimed at trying to improve safety. [ Sarah Kaczmarek: ] So it sounds like there are a lot of positives when it comes to driving smart cars for safety, and I can definitely attest to how helpful it is to have some of these features when driving around my enormous minivan. But what about some of the risks that Naba mentioned earlier? [ Naba Barkakati: ] Like someone taking over a connected car and maybe disabling the various parts of the car. [ Sarah Kaczmarek: ] That definitely doesn't sound like an experience I want to have while driving my kids around in our minivan. So I asked Dave more about this. [ Dave Wise: ] The issues that are most concerning to the automobile industry is the possibility of hacking into the systems through the Bluetooth or through the GPS, so the concern there, that someone could hack in, and even from afar, be able to affect the vehicle's performance. Now, some of the ideas that have been promulgated are taking a look at dividing up the systems, like having the steering and the braking on a system that's separate from the entertainment portal would help mitigate the possibility of hacking. I should add that there have not been any documented cases of that happening yet, but the possibility certainly exists, and I think we've seen hackers become much more sophisticated and more innovative when it comes to hacking the various systems. So, yes, it's a concern. [ Sarah Kaczmarek: ] Okay, so now I know what the Internet of Things means for my car and even some possible safety risks, but what about the bigger picture of what it means for where I can park my car, and what are smart parking lots? Enter Mark Goldstein, our second director from GAO's Physical Infrastructure team. Mark leads GAO's work on all things connected communities, and the Internet of Things, so I know he can answer my questions here. Mark and I talked in GAO's basement parking garage about what the Internet of Things means for finding a bigger parking spot. [ Mark Goldstein: ] So smart parking lots are really good for both consumers and communities, because they use the technology available through the Internet of Things. The first thing that it does is it helps consumers find a parking spot. So they're not going round and round and round, and so that helps deal with congestion, and helps deal with time issues. It also helps if you have an app on your phone so you can find parking on the street, which you might not know is available, or you would stay out of a certain area. So this not only, once again, helps you, as a consumer, to improve, you know, your own efficiency in your day, but it helps the community in improving the effectiveness of the community through less air pollution, and through less congestion, can increase foot traffic in an area, and -- and reduce wait times. [ Sarah Kaczmarek: ] So I want to ask you about the term, connected communities, itself. What does that term mean, and how do you define that? [ Mark Goldstein: ] Sure, so connected communities is how the Internet of Things literally connects a community. It takes objects, regular objects, and embeds smart components in them, everything from utilities in your home, to literally a light on a street corner, and it allows the community to be able to connect those various devices so they can see, for instance, if you are walking or driving down the street, those lights might come on at a higher level than they would otherwise when the street doesn't have any traffic on it. It can also reduce the number of times that maintenance has to come out, because they'll know when lights are out. So it's much more targeted and directed toward what a community needs, and, once again, can reduce congestion, can reduce the amount of resources that a community needs, and improves the quality of life for consumers. [ Sarah Kaczmarek: ] So are some communities more ahead of the game here than others? Are these technologies in place or things that you see coming down in the future? [ Mark Goldstein: ] They are still evolving to a large part. We are still experimenting. The federal government has just been providing grants to a number of communities in the last 6 or 8 months, to help experiments, to find out what is the best way to deploy a lot of these activities, and so we still have a ways to go, but down the road, we're going to be able to use the Internet of Things to cut waste, cut taxes. [ Sarah Kaczmarek: ] So, it sounds like there's so many great potential benefits here. On the flip side of that, are there risks? The risks that we were talking about before, potentially, like my car could get hacked with this technology? [ Mark Goldstein: ] Yes, there are potential risks as well. There is both the risk related to privacy. There is a risk related to cybersecurity as well. And the larger the interconnections and number of people that are involved, the higher the risk of more people having a problem if someone is able to hack into a system or -- or if a system fails, in one way or another. So there are -- there are definitely risks, as well, and the communities, as well as the government, and consumers are going to have to decide what level of risk they're willing to accept for themselves. [ Sarah Kaczmarek: ] What will the Internet of Things mean for our businesses, the economy, and our workforce? What about the impact on jobs? After the break, I'll talk with Oliver Richard, GAO's Chief Economist. [ Background Music ] [ Commercial: ] Follow us on Twitter @usgao for real-time information on our reports, testimonies, press releases, podcasts, blog posts, and infographics. Our Twitter feed keeps you apprised of our audit findings and recommendations as soon as they're released. Stay informed and follow us @usgao on Twitter. Again, that's @usgao on Twitter. [ Background Music ] [ Sarah Kaczmarek: ] I met with GAO's Chief Economist, Oliver Richard, out in front of the Department of Labor's headquarters building in Washington, DC. So, the Department of Labor works to promote the welfare of our workers and job seekers. So it is the perfect backdrop to talk about what the Internet of Things is going to mean for our workforce. What I learned from Oliver is that the Internet of Things may have a really big impact on the way we do our work, and even the types of jobs we have in the future. [ Oliver Richard: ] So from the point of view of a sales manager or a software engineer, what the Internet of Things is about is about access to data, it's about access to real-time information, just-in-time manufacturing, I get a sense of what's happening in my factory floor, I can control my assembly line from my computer, I can access data, or people call in and have the data be handled through some automation services. So, as a sales, you know, as a manager, as a workforce specialist there, my productivity may be enhanced. I'm able to do my job having access to more data in real-time, and so I'm better able to make decisions and be efficient in that regard. So my productivity may go up, the demand for my services may go up, and, for all I know, my wages may go up because I can command a better salary. [ Sarah Kaczmarek: ] So those are some of the upsides. I imagine there's got to be some potential downsides to the workforce as well, maybe people even losing their jobs. [ Oliver Richard: ] Sure. So, look, the downside here is you have a lot of activities that used to be done by workers that are getting automated-that are being done by computers. That can then be controlled through the network that's the Internet of Things. So that means that, for instance, when you were a person working a warehouse, checking on inventory, robots may replace you. You're losing your job. Or you were someone working a data call center, the job may be replaced because now you have a computer, or automation that's handling it, and that's being controlled at distance. Or you were, essentially, somebody working in an assembly line, a worker, that may be replaced, because robots may come into play and they are being controlled by someone in a computer room somewhere. So you've lost your job. What happens to you? Well, it used to be in the past that when you lost your job, you could just maybe turn to another factory in town and maybe get a job with them. Well, the problem here is with the Internet of Things, it's affecting all sectors of the economy together, that have been manufacturing, that have been services, so this factory A is going to be equally affected as factory B. So here you are, you've lost your job, what do you do? [ Sarah Kaczmarek: ] Well, so that's a really good question. What can workers do? Do they need to retool their skillsets? Look at other sectors? That's got to be kind of a hard question when you're saying the Internet of Things really impacts all parts of the economy at the same time. [ Oliver Richard: ] Sure. So, look, we have a couple of situations here. One is some -- some people go back to school to try to get some other skills. They borrow, they get student loan debt, hopefully they get skills that they need or can use, there is some mixed evidence on that because a lot of people end up saddled with very heavy, you know, large student loan debt. But, you know, that's one -- that's one thing, that's one thing you can do, if you can afford it. If you can afford to essentially go to school at night, pay the tuitions and the like, you can go back and get some skills and hopefully you get skills that you can use. The alternative is, you know, look, I mean, you need a job, there are jobs being created, these are typically low-paid jobs, you know, low-skilled jobs, so maybe instead of working in the assembly line, you know, driving your car and doing ridesharing. You know, you're being displaced in the sense that you have to get used to a different work environment, working under different conditions with different people, and that affects morale and that affects, essentially, your prospects of, where do I go? You know, how long until I have to move on from my ride sharing job because driverless cars are now in place? [ Sarah Kaczmarek: ] Well, and so, does the government have a role here? [ Oliver Richard: ] There's probably a role for us to play, that it be in education, that it be in terms of job training programs, where, you know, what are some of the issues there, re-evaluating limited-time programs we have in place, and the extent to which they are training or getting people the right set of skills, the right set of job training opportunities for the future. That's a difficult situation. [ Sarah Kaczmarek: ] The implications for the Internet of Things can be pretty far-reaching. We've covered fitness trackers, self-driving cars, data privacy, security, the economy, and our job security. To help me put it all in perspective, I think it's time to think about the bottom line when it comes to the Internet of Things. One thing our Chief Technologist, Naba Barkakati, told me early on I think has run really true for me throughout all of these discussions. It's something he said at the end of our first interview that I've saved for now. [ Naba Barkakati: ] The Internet of Things has a great potential, but at the same time, there's a lot of unknowns and a lot of things that have to be looked into and taken care of before it truly becomes a success. [ Sarah Kaczmarek: ] You hear this theme run throughout all of our interviews. Oliver Richard, our Chief Economist, talked about how the Internet of Things is going to impact and reshape all parts of our economy at the same time, but he also left us with thoughts of robots taking over our jobs. [ Oliver Richard: ] So, look, on the one hand, we have an economy that's being increasingly driven by technology, by, you know, access to data, information, quicker, you know, more easily than in the past. So, to the extent that you're a worker, who's able to capitalize on that information and use it to essentially improve your work conditions or improve your productivity, you may be better off. But then we also have a whole set of people who, you know, the last time they used a computer in this context or software may have been years ago. They're not used to this, they have to get used to a new environment, new working conditions, and the question is, what do we do to bring those people along and give them the skills to be successful in this new economy? [ Sarah Kaczmarek: ] Greg Wilshusen, our expert on all things data privacy, talked about the possible benefits of the Internet of Things for consumers, businesses, and the government, but he also warned of some inherent security risks. [ Greg Wilshusen: ] Well, the Internet of Things can provide great benefits to a number of users and organizations, but those users and organizations need to understand the risks of using the Internet of Things, and developers of Internet of Things devices need to implement appropriate safeguards to assure wider adoption of safe computing within the Internet of Things environment. [ Sarah Kaczmarek: ] Dave Wise, our guru on all things smart cars, saw the bottom line of the Internet of Things in terms of making it safer when we drive our cars. But he also talked about the need to plan in case those cars get hacked. [ Dave Wise: ] With safety enhancements that are being researched right now, there's great possibilities of really improving the -- the overall safety of driving in a passenger vehicle. [ Sarah Kaczmarek: ] And when it comes to the possibility of our cars being hacked, it turns out the Department of Transportation is coordinating with the FBI and the Department of Homeland Security on planning a possible response. Mark Goldstein, our expert in all things connected communities, left me feeling the most optimistic about what the Internet of Things can mean for our future. I think Mark sees the potential of the Internet of Things to shape and improve broad swaths of our communities and public life. And, for that reason, our final words from the experts goes to Mark. [ Mark Goldstein: ] It offers vast opportunities in the next, say 20 years, for a lot of things to change and how we interact, as a community, as we, not just for specific sort of towns and villages and cities, but even more broadly, in manufacturing, and in many ways of life, in ways that humans won't always even appreciate, for years to come, but I think it will ultimately make our communities more livable and safer, and better for how we involve ourselves in public life, as well. [ Sarah Kaczmarek: ] It's nice to think about living in a world where the technology around us helps support our communities. On the flipside, it'll be interesting to see how the government responds to regulating all these new advances. And I'm sure GAO will be there to investigate the government's role along the way. Thanks for listening to another Watchdog Report, Big Bite Edition. If you'd like to hear more podcasts like this, or you want to send us a question or a comment, shoot us an email at podcasts@gao.gov. Be sure you don't miss an episode by subscribing to our podcast on iTunes. The Watchdog Report, Big Bite Edition, is a production of GAO's Office of Public Affairs. [ Music ]