Privacy risks associated with the Smart Grid

Smart Grids provide many benefits to its stakeholders; in particular, consumers are given control and transparency over their energy usage. In practical, terms what this allows includes (but not limited to) as follows:

The above consumer benefits are only a small subset of available examples. One thing, that is perfectly clear, is that to realize these benefits there will be a need to utilize personal data, in other words data that identifies the consumer. Consider that in Italy, for example, in 2009, it was reported that 85% of homes already had a smart meter in each home⁴ that of course puts the earlier quote into context whereby there will be a massive collection of personal data (note: the author(s) make no statement on the specific implementation of the Italian Smart Grid deployment, merely to illustrate the amount of personal data collected).

Earlier chapters discussed the technical components of the Smart Grid, but it is important to consider that these systems will collect personal data. Although specific implementations may have additional components capable of collecting and processing personal data, the following represents the core devices at the center of privacy concerns related to the grid.

Smart Meters: One of the key objectives of the meter is to record the energy consumption of the consumer, and report this back to the operator/energy company. As we mentioned earlier, one of the main consumer benefits is to report energy usage in a very granular fashion, where, for example, they could well report consumption in near real-time.

One could ask the question, well so what? Does it really matter if anybody knows how much energy you are consuming? Well, the impact on privacy is that it allows a third party to establish a profile of the activities being undertaken at a property. For example, if there is no usage of energy at specific times in the day, it may be an indication that property is vacant. Now ask the question, does it really matter? Do you really want third parties to know at what time your home is potentially vacant? Moreover, the level of granularity goes beyond simply on or off. For example, a third party may even be able to estimate the number of individuals at a given property.

Consumer Appliances: Not only are the meters capable of capturing usage by consumers, the appliances that are now “smart” also have the opportunity to capture and reveal a wealth of information. According to the National Institute of Standards and Technology (NIST); NISTIR 7628, “Guidelines for Smart Grid Cyber Security: vol. 2, Privacy and the Smart Grid⁵,” it is possible to utilize Nonintrusive Appliance Load Monitoring (NALM) techniques to not only reveal usage patterns about individual appliances, but also identify individual appliances using libraries of known patterns. Indeed, an Italian research study from 2002 using data from 15 min intervals was able to pinpoint the use of washing machines, dishwashers and water heaters with an accuracy rate over 90%. Furthermore, this degree of accuracy is only likely to increase as more signatures become available.

This degree of accuracy is presented in graphical format in Figure 4.1.

Perhaps, letting third parties know about the appliances you use in your home is not an issue. It is not as though your medical records are being shared publicly? However, there have been a number of “worst cases” and in some cases farfetched scenarios presented that have raised some significant concerns by consumers. Some of these examples include the use by law enforcement to review the energy consumption of properties to determine whether, for example, marijuana is being grown! While this may seem one of those scenarios, we class under the farfetched category, consider that in Ohio, there are at least 60 subpoenas filed by law enforcement seeking customer’s energy records from power companies.⁶ This technique is confirmed as effective by enforcement, and according to a spokesperson from American Electric Power, they commented “We’re obligated when we get these requests. There’s not an option to say no.” Ultimately, the net result is that law enforcement are provided with information about the subscriber, including the billing details. It would be fair to say that when the grid becomes ubiquitous, more detailed information is available that the number of subpoenas is likely to increase. While this example may seem perfectly reasonable, and for those of you that are not marijuana growers, the risk that the Smart Grid can allow law enforcement the opportunity to undertake non-intrusive, real-time surveillance is of little concern. However, this particular use case does represent a very interesting precedent, the case in question is Kyllo v. United States; in this particular case, the government used the monthly energy records for its case against a suspected marijuana grower to demonstrate that the power usage of the suspect was deemed as excessive and in line with that of a marijuana growing operation. The case, however, demonstrated a very interesting precedent pertaining to the privacy interest under the Fourth Amendment. This contains a “search and seizure” provision that requires warrants before the government can invade one’s internal space. In this particular case, the Supreme Court stated.

“We think that obtaining by sense-enhancing technology any information regarding the interior of the home that could not otherwise have been obtained without physical intrusion into a constitutionally protected area, constitutes a search [and is] presumptively unreasonable without a warrant.”⁷

The case in question had some additional facets that related to the government’s use of thermal imaging to determine the areas of the house that were hotter than other parts. The court ultimately found that the Kyto had a reasonable expectation of privacy as the government used a technology not in general use.

One thing is clear that the use of a thermal imager was able to reveal a considerable amount of information related to the activities of the suspect, but if we consider smart meters—they can reveal considerably more. In this particular case (and as we saw with the statistics demonstrated in Ohio), law enforcement will invariably request the energy usage records from the grid operator/energy company. In this particular case the third-party doctrine of the Fourth Amendment will clearly apply. According to the Harvard Journal of Law & Technology vol. 25, Number 1 Fall 2011,⁸ it states that

“The third-party doctrine states that a person cannot legitimately expect information that is shared with a third party to remain private from law enforcement.”

Although this may not be a concern for the reader, why of course should you be concerned about law enforcement having access to full details about your energy consumption, law enforcement is only one class of third party that would benefit from data derived from meters. There exist considerably more data classes, and third parties that would benefit from gaining access to such information, examples of privacy concerns as detailed below and based on a report by the Information and Privacy Commissioner of Ontario, Canada.⁹

The Table 4.1 illustrates the type of data that could well be garnered from the Smart Grid, and this data could well become valuable to third parties beyond law enforcement. We will discuss the supply chain within the Smart Grid elsewhere in the book, but with regards to privacy, the concerns are very high for consumers where sensitive data could be made [legally] available to organizations outside of the energy supplier, grid operator, and of course law enforcement. One simple example may be insurance companies, where an insight into the behavior of consumers could well impact insurance premiums. Although the possibility of the insurance provider utilizing energy consumption to set premiums may seem somewhat far fetched, it is worthwhile considering that the grid operator may look to develop information it collects as a revenue stream. Consider also the attractiveness of such a rich repository of valuable information to those individuals that may seek to access data they are unauthorized to access.

Of course the release of individual, personal data will be covered by privacy legislation, and this was highlighted by the Article 29 Working Party opinion¹⁰ on Smart Grids which stated; “Where personal data are contained in the information generated and disseminated by a smart meter, the Working Party determines that Directive 95/46/EC applies to such processing.” Therefore it is expected that without some form of explicit consent, the grid operator/energy supplier cannot release this information to authorized third parties. Note, the caveat there? Authorized third parties. If you have a database with millions of records that are of economic benefit to many, then it does make the system considerably more attractive to malicious individuals looking to get the data for re sale. This becomes an unintended consequence of the Smart Grid, where the simple collation of such valuable data, makes it more attractive for malicious individuals to try and retrieve the data to sell on. This is out of scope for this book, mainly because the controls for protecting this data are covered by multiple books elsewhere (this will likely be within the IT domain).

As mentioned earlier, it is expected that the data will not be about the individual and therefore not covered under the scrutiny of data protection legislation. What is likely to be sold to authorized third parties should be anonymized. When we say authorized, however, we are likely to be referring to that authorization being provided by the operator, and not the consumer. This of course should not cause any privacy concerns, right? Well not quite.

The challenge we face with the release of very large volumes of data is the issue of inference. Of course, we make a very big assumption that the data cleansing routine is of sufficient quality so as not to inadvertently reveal personal information. However, if we assume that obfuscation of personal data fields is of sufficient quality, then we are faced with the inference challenge. In a nutshell, this refers to the ability to derive data that may be sanitized from the collation of multiple data sources. A simple example is those records which fall outside of normal, or average consumption, and is a technique we saw used by law enforcement to infer marijuana growth. The field of analytics for the Smart Grid is anticipated to grow enormously, and Pike Research estimates that the market for software and services that can mine intelligence could reach a cumulative $11.3 billion between 2011 and 2015.¹¹ Of course, this figure in itself is not indicative of burgeoning privacy considerations and indeed, there could be tremendous value to the consumer in the operator in identifying intelligence that could be passed to the consumer. For example, recommendations on energy consumption that could save money; we noticed that your washing machine is used always during peak hours, but by doing your washing an hour later then you could save twelve dollars per month. However, what may be less desirable are a plethora of electronics manufacturers inundating consumers with details of their latest products with detailed prior knowledge about the devices and their consumption within the home, without prior consent. This concept of Big Data, and the ability to infer certain things about consumers are already uncovering things about consumers that somewhat blur the line of ethics. A recent example related to shopping habits reveals this in striking detail, whereby in a recent NY Times¹² article, it was revealed that the US retail shopping organization “Target” were able to identify their customers that were likely expecting a baby. Simple indicators such as women buying larger quantities of unscented lotions at the start of their second trimester, as well as purchases of other indicating products, all suggested the customers that were likely pregnant. Indeed, the company built a “pregnancy prediction” score that predicted the likelihood of the data subject being pregnant based on the various products purchased together. This allowed the company to send coupons based on the stages of pregnancy (note: they were able to predict the due date). The implications of this degree of accuracy were demonstrated approximately a year after the pregnancy prediction was developed as cited below:

“A man walked into a Target outside Minneapolis and demanded to see the manager. He was clutching coupons that had been sent to his daughter, and he was angry, according to an employee who participated in the conversation.

‘My daughter got this in the mail!’ he said. ‘She’s still in high school, and you’re sending her coupons for baby clothes and cribs? Are you trying to encourage her to get pregnant?’

The manager didn’t have any idea what the man was talking about. He looked at the mailer. Sure enough, it was addressed to the man’s daughter and contained advertisements for maternity clothing, nursery furniture and pictures of smiling infants. The manager apologized and then called a few days later to apologize again.

On the phone, though, the father was somewhat abashed. ‘I had a talk with my daughter,’ he said. ‘It turns out there’s been some activities in my house I haven’t been completely aware of. She’s due in August. I owe you an apology.’”

Now of course there is no suggestion that Smart Grid analytics can indicate whether consumers are expecting a baby. However, what this example demonstrates is that here you have a commercial organization being aware that a girl was pregnant before her own father, and that the field of analytics is able to infer that level of accuracy simply based on a series of purchases. Although this example is entirely unrelated to the type of data that can be garnered with Smart Grids, it demonstrates the power of analytics and how “creepy” the conclusions it can draw. Furthermore, when it comes to Smart Grids there are three factors we know for sure:

When you combine these three factors, it is evident that the implications regarding the privacy of consumers may well be significant, and of concern. Of course if handled appropriately, there should not be this degree of concern. After all, what consumer wouldn’t want to know ways to save money? Or should I have said… what operator wouldn’t want to know ways to make money! However, a simple privacy notice is not sufficient, electronic distribution today only provides the opportunity to accept or reject. Reject in many cases is simply being prevented from utilizing the service; therefore, allowing some constructive feedback option is essential.

Moreover, what the above example does demonstrate is that there may be privacy concerns when at first glance there may not appear to be any issues. There is a great deal of research being conducted to determine the amount of information that can be garnered from Smart Grid deployments. One such example¹³ was presented at the hacker conference, the Chaos Computing Congress by researchers Dario Carluccio and Stephan Brinkhaus under the title “Smart Hacking for Privacy.” The title of the presentation does of course give the game away with regards to the content; however, the level of detail they were able to derive from their research was certainly surprising. By signing up with a company known as Discovergy to have a meter installed in their chosen location to conduct the research, they were able to identify a number of privacy concerns. Their research uncovered numerous security flaws that included the ability for their data and passwords to be intercepted, as they were transmitted in clear text, they also found that the smart meters were monitoring power usage, not in the fifteen-minute intervals suggested as standard earlier in this chapter, but rather in two-second intervals. We had previously discussed the privacy implications associated with fifteen-minute intervals, but the researchers then asked the question, what level of detail could be garnered from considerably smaller intervals? The outcome of their work found that not only are there likely signatures for the devices within a consumer’s home but also the research found that there are also likely to be signatures for movie or a television show based on the brightness levels for particular scenes. We had previously considered the need for security controls to protect the usage data from unauthorized third parties and suggested that they are out of scope for the book as this topic is extensively covered in other publications. However, just because it is covered elsewhere, its importance should not be underestimated. Carluccio and Brinkhaus found the historical records of meter usage were easily obtainable from the company’s systems despite the design only allowing access for the previous three months. The CEO of Discovergy, who was at the presentation, took to the stage and defended the polling interval as necessary in order to notify consumers if they had left their home with an iron left on, but had promised to make the polling interval configurable for their customers who are concerned with privacy issues.

Therefore operators should most certainly undertake an assessment to consider the privacy implications with any implementation. Who knows, as investment continues in the field of analytics, and as the data sets do get richer, it may well be likely to predict pregnancies.