IEEE Technology and Society Magazine - December 2021 - 103

This creates higher security vulnerabilities for many
IoT-connected devices.
One such vulnerability is to distributed denial of
service (DDoS) attacks. DDoS attacks occur when an
attacker uses a large number of connected computers
or other devices to launch a coordinated wave of
requests or messages to a target website, overwhelming
the website's capacity to respond, and effectively
shutting down the site [20]. These DDoS attacks usually
employ a large number of computers that have been
commandeered by malicious software that, unbeknownst
to the equipment owner, is able to control the
computer remotely, creating " botnets " [20]. The more
sites or botnets that the attacker has under its control,
the more powerful the DDoS attack it is able to launch
[21]. Consequently, the IoT-with its large number
of connected devices and minimal security protections-provides
a lucrative platform for launching
DDoS attacks and has already been exploited for major
attacks against many leading Internet sites [22], [23].
Second, privacy may be the greatest concern that
citizens have about the IoT. " Americans hold a range
of strong views about the importance of control
over their personal information and freedom from
surveillance in daily life, " [24] and concerns about
increased technological surveillance are likely to
grow as more devices become connected to the
Internet. In addressing these privacy concerns, it is
necessary to consider both the real risks (i.e., with
actual harms) as well as the public's perception of
the risks. An illustration is provided by the privacy
fears raised against smart meters-devices that track
utility energy consumption of the systems they are
attached to [25]-which many experts assumed
would be relatively noncontroversial, but which
instead generated significant consumer opposition
and fears and even led to litigation [26].
The IoT also presents many of the same privacy
concerns as existing online and mobile communications
technologies-such as the potential disclosure
of financial, location, and health data [8]-but
the IoT goes beyond traditional digital privacy challenges
by also providing for " the collection of personal
information, habits, locations, and physical
conditions over time, which may allow an entity that
has not directly collected sensitive information to
infer it " [8]. As a report from the Berkman Center for
Internet & Society at Harvard University cautions, " A
plethora of networked sensors are now embedded
in everyday objects. These are prime mechanisms
December 2021
for surveillance: alternative vectors for information-gathering
that ... raise troubling questions about
how exposed to eavesdropping the general public is
poised to become " [27].
Such privacy and security concerns do not exist
only in theory; as the following section demonstrates,
the public's fears are well-founded, and individuals
have signaled that they are starting to take the potential
for unauthorized IoT data collection very seriously.
Three red flags for IoT innovation
The following examples provide instances in
which the public has explicitly articulated its concerns
about the privacy and security of their information
and has pushed back on unchecked data
collection. Notably, society is taking a stronger
stance on unknown and unconsented forms of data
gathering and the use of personal data for unapproved
or nefarious purposes.
Facial recognition technology
Facial recognition technology provides an important
analogy for growing public unease about a
technology that can collect widespread data on the
public, often without consent, or even surreptitiously
[28]. Facial recognition is the process of identifying a
person using their face, by capturing, comparing, and
analyzing details to recognize patterns [28]. While the
debate around facial recognition has been long-raging,
privacy and civil rights concerns have taken
center stage as this burgeoning technology gains traction
as a law enforcement tool [29]. Additionally, the
inability of current facial recognition technology to
consistently identify Black people properly, the secret
use of facial-scanning technology at mass events, and
the threat of using the technology for racial profiling
are all issues serving to make people more skeptical
of facial recognition software [30].
Civil liberties groups have indicated wariness
about facial recognition technology's potential abuse
by government and the risks inherent in facial recognition
biases; going so far as to express fear that such
technologies " may shove the United States in the
direction of an overly oppressive surveillance state "
[31]. As more information is revealed regarding the
invasiveness of these technologies, privacy advocates
have grown more urgent in their calls for restrictions:
In 2019, San Francisco became the first city to ban
facial recognition by government entities-the first
city-wide ban of its kind in the United States [31].
103
IEEE Technology and Society Magazine - December 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2021
