Convergence Applied: Connected Communities, Municipal Efficiencies, and Grilled Delights

This is the second installment in our series on technology convergence, cybersecurity, and the implications for policymakers. You can read the first post here.

Key Takeaways

• Policymaking conversations about emerging technologies and their risks often suffer from a lack of specificity that can result in poor outcomes or inaction. In order to understand these broad technology concepts like convergence and their risks, we need to look at a specific use case – connected communities.

• Connected communities is a concept that informs how to deploy and orchestrate multiple technologies including IoT sensors, AI, data analytics, and 5G among other technologies.

• Through the convergence of these technologies,  data are generated and collected on anything from traffic patterns to how full a waste receptacle is. 

• City officials use the data to maximize efficiency in the allocation of resources and delivery of services.

• The connectivity that makes a convergence system work also creates vulnerabilities and when they are connected to critical infrastructure, the vulnerabilities turn into potential disasters. 

• Our next post will examine risks to critical infrastructure posed by connected communities and implications for homeland security.

Introduction

Having a general conversation about risk is about as useful as having one about AI, IoT, or any other technology. These are terms that can mean nothing and everything at the same time. A statement like, “We need to do something about IoT” is vague to the point of not being useful. “What are the risks to our organization,” sounds similarly insightful and commanding but means little. In my time at DHS, I can recall someone saying that we “just needed to add some AI” as if he was telling me to add some cumin to my chicken kabobs. The point is that conversations about emerging technology and risks often suffer from a lack of specificity that can result in poor outcomes and deferred action.

In the previous post, we discussed the convergence of technologies to create an exponentially more powerful capability. As a general concept it is useful to consider but convergence suffers from the vagueness problem. To improve not only our understanding of convergence but also our ability to talk about broad technology concepts and their risks, it is useful to find use cases that have real world applicability to bring the discussions to life. 

In this post, we will discuss convergence as applied to a particularly impactful use case, connected communities. This framing will help zero in on why convergence is such an important concept in emerging technology and point out some specific risks. Connected communities are perhaps the best example of technology convergence because we can easily see the results and applications around us every day. We can also easily imagine scenarios where this technology is not used for noble purposes, giving us a path toward putting policy controls in place to mitigate real risks.

Connected Communities

Connected communities is the new name for what used to be called smart cities because the technology is not exclusive to urban settings. It is also not a technology but more a concept for how to deploy and orchestrate multiple technologies. There is also no single or standard way that a connected community architecture is created or deployed. Generally, we can think of connected communities as including some kind of IoT sensor that feeds data to a cloud over a telecommunications or WiFi link. That data is processed in the cloud by an AI or analytics platform that feeds information to municipal officials via a dashboard. The officials may or may not be able to make live adjustments, but at minimum they can see an analyzed version of the data being collected in the field.

·         Internet of Things Sensors

·         Artificial Intelligence and/or Data Analytics

·         Cloud

·         Data Visualizations

·         5G or WiFi

But, what data is being collected? Well, it could be anything. It might be traffic patterns, sewer levels, how full a waste receptacle is, electricity use, flooding levels, weather monitors, and a host of other things. Connected community architectures are set up to be data generation machines that collect information on aspects of the municipality in which it is deployed. What information highly depends on the municipality and the goals of the deployment. For example, New York City’s Mobile Manhattan collects information on traffic volumes to find ways to improve traffic in the city. A rural community might prioritize weather information or smart irrigation and other cities might prioritize access to data. In any case, connected communities collect data. Lots of it. If a connected community is a giant data generation machine, it is made of established and emerging technology parts.

There is much to be excited about when thinking about connected communities. After all, who would not want to reduce Manhattan gridlock? Traffic is a single and relatable example, but it is one symptom of how the growth in population across municipalities of all sizes creates a greater demand for resources and services. By resources, we are referring to things like water, health care, electricity, sanitation, transportation, food, and more. Another name we give those things is critical infrastructure. 

Citizens of any municipality depend on services not only for convenience but for life. Placing IoT sensors on and around these resources and services allows city officials to better understand how to allocate and distribute those resources and maximize efficiency of delivery. Again, what’s not to like? We can use less electricity by monitoring its use. We can improve access to city services and data by rolling out a mobile app and deploying public WiFi. The possibilities go on and on. This is what convergence does. Rather than a piece of infrastructure like cloud or individual IoT sensors, knitting them all together creates the ability to improve the delivery of public services and generally make life better for our community dwellers. This is of increasing importance as populations grow and demands on resources grow with them. But does simply connecting everything to the internet solve our problems? What other problems does it create?

Understanding & Managing Risk

It hardly takes a cybersecurity expert to see that the addition of thousands of internet-connected devices to critical infrastructure creates thousands of opportunities for malicious cyber actors to gain access and disrupt the delivery of services. A cyber event that results in the denial or disruption of critical infrastructure or municipal services would rank as a significant event the way the ransomware attack on Colonial Pipeline did. 

But convergence does something else as well. Convergence also creates a path from a simple outlying technology all the way upstream to what could be a major cyber event. Maybe it is an electric vehicle charger, a garbage can sensor, or a deployed surveillance camera. Any of them could be a vulnerability that was discovered by the wrong cyber actor and because they are connected to a larger architecture, those cyber actors could gain access to sensitive information like citizen data, electrical grids, traffic lights, irrigation systems, and more. The connectivity that makes a convergence system work also creates vulnerabilities and when they are connected to critical infrastructure, the vulnerabilities turn into potential disasters.

None of this is to say that we should ban connected community architectures. They truly provide some very real and very important benefits. But we need to be mindful about what we are doing when we propose connected community projects and deploy them in our municipalities. In other words, we need to manage risk. We should look at the problems we are trying to solve and ask ourselves if the technology we are deploying solves those problems. We should recognize when we have multiple technological vulnerabilities sewn together and practice how to respond to a failure in that system. Convergence introduces complexity and complexity introduces risk, but if we can speak about that risk using a real life use case, we can see the vulnerabilities and find ways to mitigate them.