KEEP
YOUR WEARABLES CLOSE
AND YOUR DATA CLOSER
Online data privacy is probably a debate too late.
Prof. Sundaram of UIUC calls it the Faustian Bargain we have made, with an asymmetric twist that favors businesses. And if mistrust about privacy spills over from online to IoT devices and infrastructure, the potential of Internet of Things (IoT) could be stunted in infancy.
Download PDF

DEEPAK SHARMA(DS)
in conversation with
HARI SUNDARAM(HS)

FOR BUSINESSES, there has been no better time to romance technology. Some shiny new technologies will fall in the hype cycle and the wildly successful ones will plunge entire categories into pain, but what’s a romance without its ups and downs. Amid a cohort of fast maturing technologies, Big Data and Small Data have made online experiences deeply personalized and mass customization of products and experiences possible and profitable.

To make this possible, our personal data is being collected, bought and sold several times a day by close to 400 tech firms with little or no meaningful control in our hands. The innocuous cookie that came with the Netscape browser in 1994 has reshaped our online experience to what it is today. Personalized news, advertisements, offers and recommendations, which are put together in milliseconds between your mouse click and page load are made possible by your data moving across dozens of companies and platforms working in concert. Each personalized ad or offer that appears on your smartphone is an eerie reminder of just how much of your information is out there amid strangers.

On the flip side of the business-technology romance, the love-hate relationship of consumers with technology is mostly explained by this mistrust about data privacy. Privacy abuse also continues to play on the minds of regulators as they seek to control the treatment of personal data by search engines, online businesses, content websites, apps and service providers. Regulators seek to control what these businesses can collect from users, what warnings they need to provide, what they can or cannot do with the data and ensure that users can easily exercise the right to be forgotten. In reality, protection has lagged woefully behind and experts believe that the biggest compromises have already been made.

The problem could get a lot worse with IoT, or a lot better. As our physical environment gets peppered with sensors and online interactions are no longer boxed inside browsers and apps, we will get warier about what we carelessly might reveal ourselves. Businesses investing in beacons, sensors and smart devices will feel the trust deficit in the personalized offerings they can create and sell to customers who err on the side of caution.

Deepak Sharma of Wipro speaks at length with Prof. Hari Sundaram of University of Illinois at Urbana-Champaign on Incognito, a project in collaboration with Prof. Robin Kravets, and a framework that’s addressing the privacy issue in IoT in an unusual way.

DS: WHAT IS INCOGNITO? IS THERE A STORY ON WHAT MOTIVATED IT?

HS: Incognito is a protocol that lets individuals control who has access to their data in an Internet of Things (IoT) environment. Users can control how much information they expose, to which businesses and for how long.

The online privacy problem provoked a simple question about the choice of giving up personal data for personalized experiences-does it have to be all or none? You can take it a step further-what if businesses could take the guesswork out of large amounts of psychographic, demographic, location and behavior data and complex mining techniques? What if customers willingly exposed gold standard information about themselves to the IoT infrastructure of a business?

Could technology foster that trust-based environment in which users feel secure, in control of their information and in an equal relationship with businesses that want their data? And how do you do that without relying on the benevolence of business to not be evil, or relying on regulators playing nanny.

DS: CAN YOU MAKE THAT MORE VIVID WITH AN EXAMPLE?

HS: Here is one from your nearest grocery store. You walk into this grocery store for the first time. You can imagine the complex acrobatics that data has to do to hazard a recommendation about your preferred purchases and that will create a wow moment for you. And this data has been acquired online, over multiple online and offline touchpoints, often without your explicit consent, married with demographics and psychographics of 'people like you' to make this guess.

What if your smartphone tells the store that you are Indian, vegetarian but shops fish and poultry?

DS: THAT WOULD HELP THE USER FEEL MORE IN CONTROL, BUT CAN YOU EXPLAIN WHAT MAKES THAT DATA SAFER?

HS: For one thing, you are giving up exactly what they need to help them create that unique experience. Not additional information that can be bought, sold and potentially misused. For another, you can choose to have the IoT infrastructure ‘forget’ your digital footprint by assuming a new identity since the system will not be able to easily connect with the old one. You could do this especially if you are disappointed with an experience and do not intend to come back, or just because you choose to. The data you have already shared may remain as an isolated fragment in that grocery store’s system but it has little value if it cannot be correlated over time or with other aspects of your identity.

DS: ARE THERE NEW TECHNOLOGIES THAT MAKE IT WORK? AND WERE THERE ANY AHA! MOMENTS THAT MADE IT ALL COME TOGETHER?

HS: There are several existing technologies that come together to make Incognito, along with some novel concepts.

One key insight came out of flipping an existing assumption on its head. The T in the IoT means that we are used to thinking of identities for Things, essentially devices and sensors. What if we started with identities of users-not one but several, in fact as many as one wants or thinks are manageable. You could have an identity for your local Starbucks, any Starbucks in the world or any café. We call this Contextual ID, or CID. It’s a key building block for Incognito. Digital forgetting in Incognito is made possible by just abandoning CIDs.

Let’s make things more interesting-we said we won’t depend on the benevolence of business. With sophisticated mining techniques, behaviors are predictable and, by themselves, they can be like signatures that can identify you to a business. So we used a real-world analogy of getting lost in a crowd to avoid being tracked online. We call it the kindness of strangers-it’s a technique that permutes the CIDs of anonymous and consenting users who are in physical proximity to confound any behavior-matching algorithm. It virtually ensures that data patched together using this approach will contain no meaningful information for a business from which you chose to wipe your digital memory.

DS: CAN YOU TELL US HOW THE FRAMEWORK GOES BEYOND TYPICAL COMMERCIAL USE CASES AND HELPS USERS CREATE, CURATE AND SHARE THEIR OWN EXPERIENCES WITH THIS FRAMEWORK?

HS: Take the simple situations that improve your museum experience: “What did other people with an interest in Impressionism see here?” Or a shopping experience: “What do other people who are on a diet buy here?”

Another feature is the ability to expose your data to other users in your trusted personal and social network so you can create even more personalized experiences. So if you are visiting a foreign city many years after your parents, you could find out what your parents ordered when they visited this café? With the assurance of control, you can leave your digital footprint and experience in an open environment and create shared memories and experiences that can be shared with your network.

How can we use IoT to trigger healthier, greener and more civic behaviors on a large scale? Eating healthier, getting more exercise, reducing energy consumption and voting will make the world a better place.

DS: IT’S CLEARLY A NOVEL IDEA WITH BREAKTHROUGH POTENTIAL, BUT DIFFUSION OF INNOVATION IS UNPREDICTABLE. WHAT DO YOU THINK ARE THE CHALLENGES AHEAD?

HS: The most interesting challenge is at the intersection domain of design and technology. It is important that users can intuitively and naturally manage their CIDs and that creating, exposing and abandoning their IDs doesn’t strain the experience.

Another challenge is that Incognito’s privacy strategy relies on the full spec version of Bluetooth Low Energy (BLE) implementation. In the current environment, it is rarely implemented. There are other optimization gaps-we have kept the core payload for CID implementation at 31 bytes but the encryption is heavy. This can be a problem with the lossy nature of BLE. But none of these are insurmountable.

PROF. HARI SUNDARAM

is an Associate Professor at the University of Illinois at Urbana-Champaign and holds a joint appointment between Computer Science and Advertising. Prior to this, he was an Associate Professor at Arizona State University with appointments in Computer Science and the School of Arts, Media and Engineering; he helped co-found the latter. He earned his B.Tech from the Indian Institute of Technology, Delhi (1993), M.S. from Stony Brook University (1995) and Ph.D. from Columbia University (2002), all in Electrical Engineering. He loves photography, listening to jazz and spending time with his family.

DS: WHY DID YOU PICK THIS CHALLENGE TO WORK ON?

HS: Interestingly, we didn’t start off by trying to solve the IoT privacy challenge. Incognito is part of the answer to a more ambitious challenge, of using technology to trigger healthier, greener and more civic behaviors on a large scale. Eating healthier, getting more exercise, reducing energy consumption and voting will make the world a better place. We all know this, and yet we have trouble adopting better behaviors. Imagine the impact if 10 million New Yorkers could be persuaded to reduce their carbon footprint by using the IoT a little bit.

Putting a diverse group together is the first step in innovation. The group needs a common language to create dialogue between experts, each of whom looks at the same problem from a different perspective.

DS: GETTING MILLIONS, ESPECIALLY NEW YORKERS TO MAKE HEALTHIER CHOICES, SOUNDS LIKE YOU ARE TRYING TO GET IOT TO DO WHAT THE CARROT AND THE STICK COULD NOT DO BETWEEN MICHAEL BLOOMBERG AND MICHELLE OBAMA. WHAT OTHER TECHNOLOGIES WENT INTO THIS PROJECT?

HS: Any real human problem is never the domain of one technology or even technology per se is inadequate. We are taking ideas from behavioral economics and psychology to synthesize persuasive messages. On the other end, we are analyzing physical world-interaction of a social network, via the IoT. Our current research in Network Analysis is being pushed to new boundaries by incorporating mechanism design in shaping network behavior and distributing messages more effectively in a network using information theory.

The T in the IoT means that we are used to thinking of identities for Things, essentially devices and sensors. What if we started with identities of users – not one but several?

DS: YOU ARE NO STRANGER TO INTERSECTIONS. YOU CO-FOUNDED THE CENTER FOR ARTS, MEDIA AND ENGINEERING AT ARIZONA STATE UNIVERSITY. TELL US A BIT MORE ABOUT THE CHALLENGES THERE.

HS:One of the most satisfying challenges we addressed was to create media-rich environments that engage and provide feedback to enable patients to recover after a stroke. Recovering lost movement functions after a stroke necessitates patients to practice repetitive, monotonous movements (typically 200 repetitions a session) day after day, year after year. Supervised physiotherapy sessions are more effective, because sustaining motivation is in one's own hand, as we all know. But insurance coverage is very limited, making this an expensive endeavor for most people. Our team had musicians, gamers, designers, mathematicians and artists. And watching the solution come together taught me a couple of things about innovation, and about my own motivation. Putting a diverse group together is the first step in innovation when you are trying to solve even a simple human problem, if there is such a thing. The group needs to develop a common language for creating dialogue between experts, each of whom looks at the same problem from a different perspective. This language provides a common scaffold that allows them to communicate effectively and to build on each other’s ideas.

Seeing first-hand the huge impact that innovation can have on the lives of stroke patients is probably also the reason I started looking for challenges that are more meaningful and have more human impact.