Originally published on pelicancrossing.net
This year’s Computers, Privacy, and Data Protectionconference had the theme “The Internet of Bodies”. I chaired the “Bodies in the Clouds” panel, which was convened by Lucie Krahulcova of Access Now, and this is something like what I may have said to introduce it.
The notion of “cyberspace” as a separate space derives from the early days of the internet, when most people outside of universities or large science research departments had to dial up and wait while modems mated to get there. Even those who had those permanent connections were often offline in other parts of their lives. Crucially, the people you met in that virtual land were strangers, and it was easy to think there were no consequences in real life.
In 2013, New America Foundation co-founder Michael Lind called cyberspace an idea that makes you dumber the moment you learn of it and begged us to stop believing the internet is a mythical place that governments and corporations are wrongfully invading. While I disagreed, I can see that those with no memory of those early days might see it that way. Today’s 30-year-olds were 19 when the iPhone arrived, 18 when Facebook became a thing, 16 when Google went public, and eight when Netscape IPO’d. They have grown up alongside iTunes, digital maps, and GPS, surrounded online by everyone they know. “Cyberspace” isn’t somewhere they go; online is just an extension of their phones or laptops..
And yet, many of the laws that now govern the internet were devised with the separate space idea in mind. “Cyberspace”, unsurprisingly, turned out not to be exempt from the laws governing consumer fraud, copyright, defamation, libel, drug trafficking, or finance. Many new laws passed in this period are intended to contain what appeared to legislators with little online experience to be a dangerous new threat. These laws are about to come back to bite us.
At the moment there is still *some* boundary: we are aware that map lookups, video sites, and even Siri requests require online access to answer, just as we know when we buy a device like a “smart coffee maker” or a scale that tweets our weight that it’s externally connected, even if we don’t fully understand the consequences. We are not puzzled by the absence of online connections as we would be if the sun disappeared and we didn’t know what an eclipse was.
Security experts had long warned that traditional manufacturers were not grasping the dangers of adding wireless internet connections to their products, and in 2016 they were proved right, when the Mirai botnet harnessed video recorders, routers, baby monitors, and CCTV cameras to delier monster attacks on internet sites and service providers.
For the last few years, I’ve called this the invasion of the physical world by cyberspace. The cyber-physical construct of the Internet of Things will pose many more challenges to security, privacy, and data protection law. The systems we are beginning to build will be vastly more complex than the systems of the past, involving many more devices, many more types of devices, and many more service providers. An automated city parking system might have meters, license plate readers, a payment system, middleware gateways to link all these, and a wireless ISP. Understanding who’s responsible when such systems go wrong or how to exercise our privacy rights will be difficult. The boundary we can still see is vanishing, as is our control over it.
For example, how do we opt out of physical tracking when there are sensors everywhere? It’s clear that the Cookie Directive approach to consent won’t work in the physical world (though it would give a new meaning to “no-go areas”).
Today’s devices are already creating new opportunities to probe previously inaccessible parts of our lives. Police have asked for data from Amazon Echos in a Arkansas murder case. In Germany, investigators used the suspect’s Apple Health app while re-enacting the steps they believed he took and compared the results to the data the app collected at the time of the crime to prove his guilt.
A friend who buys and turns on an Amazon Echo is deemed to have accepted its privacy policy. Does visiting their home mean I’ve accepted it too? What happens to data about me that the Echo has collected if I am not a suspect? And if it controls their whole house, how do I get it to work after they’ve gone to bed?
At Privacy Law Scholars in 2016, Andrea Matwyshyn introduced a new idea: the Internet of Bodies, the theme of this year’s CPDP. As she spotted then, the Internet of Bodies make us dependent for our bodily integrity and ability to function on this hybrid ecosystem. At that first discussion of what I’m sure will be an important topic for many years to come, someone commented, “A pancreas has never reported to the cloud before.”
A few weeks ago, a small American ISP sent a letter to warn a copyright-infringing subscriber that continuing to attract complaints would cause the ISP to throttle their bandwidth, potentially interfering with devices requiring continuous connections, such as CCTV monitoring and thermostats. The kind of conflict this suggests – copyright laws designed for “cyberspace” touching our physical ability to stay warm and alive in a cold snap – is what awaits us now.
Illustrations: Andrea Matwyshyn.
Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard – or follow on Twitter.
