Is Your Thermostat Watching You? Device Fingerprinting Enters the Mainstream

(This post originally appeared on the ThinkSmartGrid blog)

Interesting article in this morning's Wall Street Journal on the topic of device fingerprinting, a discipline the NIST Smart Grid Cyber Security Privacy Team has spent quite a bit of time discussing. In a nutshell, an Australian company called BlueCava has developed technology to provide a unique digital fingerprint of individual cell phones, computers, and set-top boxes.

What's cool about this from a targeted marketing standpoint is that advertisers can now further increase the granularity of their ads, resulting in a dramatic increase in CPMs beyond what cookie-based technologies can provide. If I'm an advertiser, I'm stoked about the fact that now I can in effect unicast my ads, rather than broadcasting to the masses or multicasting to an imperfectly granular demographic.

Of course, if I'm not an advertiser, this scares me to no end. I'm not exactly a privacy zealot, but I will say that I'm concerned about privacy--and I'm not the only one. The Federal Trade Commission and the Department of Commerce are both working on reports on data privacy and behavioral tracking; the FTC's report might even be out this week. The big challenge is, what kind of teeth will these reports actually have? Recommendations are great, but without an enforcement mechanism, any kind of do-not-track tools are going to be left up to software & services providers, and to users themselves. I can certainly see a case where users are encouraged to download do-not-track tools from websites set up solely to embed tracking mechanisms in their do-not track tools.

Crazy? Not so much--we've seen this exact type of behavior from supposed free virus checkers and spyware removal tools. So, don't be surprised if the FTC makes recommendations which enable users to potentially better protect their personally identifiable information (PII), but that nothing substantive actually happens to make it compulsory for software and service providers to enable such protection.

Why are we talking about this here?

Well, device fingerprinting isn't only for consumer electronics devices--white goods, HVAC, and plug load components are all capable of being fingerprinted, too. While this discipline is newer than fingerprinting consumer goods, startups and established firms are racing to enable their energy management systems (EMS) to automagically discover devices to enable easier management. I'm aware of at least one company which has taken unique fingerprints on tens of thousands of unique devices in the home--washers, dryers, dishwashers, lamps, fans, and more. The whole point is to enable an energy management system to automagically discover and display devices in the EMS.

Why? Whoever makes the EMS easiest to use has a great shot at winning the home energy management war, a war worth many billions of dollars worldwide. Part of making the home EMS (HEMS) easy is to perform automatic discovery of as many devices as possible. Protocols like UPnP, Bonjour, and SNMP have performed these tasks in the information technology world for years. However, no such analog exists (yet) in the energy management world.

Think about how great it would be to go to your local big box store, buy a home energy management system (likely consisting of an energy services interface, which you can consider generically to look like your home router today; one or more intelligent power strips; and perhaps an in-home display, although the iPad and smart phones have pretty much put the IHD camp out to pasture), bring it home and plug it in, and have the system discover all the devices in your home which draw power.

The nuance here is that the IT-focused protocols I mentioned earlier use network protocols to perform discovery; in the HEMS case, discovery is performed over the powerline network (with wireless protocols serving as an adjunct), using either network protocols or the actual power signature of the device.

What's that, you say? The power signature of the device?

Yep.

A Whirlpool washing machine will put out a different power signature than will a Samsung washing machine. In fact, different models of washing machines from the same vendor will usually have unique power signatures. If the HEMS is able to perform this non-invasive load monitoring, then compare its results against a known database of device signatures, the end result is a rich visualization of the electrically-connected devices in the home. The better view of and the more intelligence about the connected devices, the more control the consumer gains over analysis and power use--and ultimately, better control over monthly bills.

Like all things in life, there are tradeoffs, potentially privacy-impacting. Lacking a sufficient privacy policy, a HEMS device could feasibly collect the information about the devices in your home, then add that to the digital fingerprint created by the BlueCava folks, providing an even richer view of everything that goes on in your home. Some folks will say that's crazy.

It's not.

The reason it's not is that the HEMS is unlikely to have a database of every washer, dryer, and box fan in the world; instead, the system will be smart enough to perform the non-invasive load monitoring (the listening part), send the signature (likely to be in the form of a hash, digitally representing the analog signal) to the HEMS back-end database sitting in the cloud, then receive the device-specific information (including a pretty icon!) for use in the HEMS graphical display.

Sound crazy? Then you probably haven't used Shazam to identify a song.

I don't know what Shazam's privacy policy looks like (which is a fail on my part, I guess), but the odds are pretty good that even for free users, the Shazam folks know what my listening habits are based on the five free tags I get every month, although they're unlikely to be able to do much with that data without some form of PII. If I'm a registered, paying user, obviously they know exactly what my listening habits are, and could very well correlate that with an online music vendor to serve me very specific ads based on the type of music I listen to.

That's not all bad. In fact, that type of correlation can sometimes work out really well. If you use Pandora, you're well aware of the Music Genome project, and the benefits you derive as a Pandora listener. In exchange for the occasional in-stream advertisement, and for ads served in the Pandora player while each song plays, I get to listen to music based on the types of tunes I've identified that I like.

Thumbs up for that one.

The spot where the hammer hits the thumb in the energy management space is when utilities and third party service providers don't establish well-defined, easy-to-understand privacy policies concerning the use of ALL energy data, including dynamically discovered information. Your washing machine isn't going to opt into a query, so when the HEMS performs its discovery, it does so with a modicum of responsibility, whether the HEMS is reporting to a utility, service provider, or vendor.

Used responsibly, that data could be extremely beneficial--if your Brand A dishwasher is about to fail, its internal diagnostics systems could alert you, as well as Brand A's service department, in the nick of time before you end up with a huge puddle of water on the kitchen floor. Used irresponsibly, the HEMS could intercept that diagnostics failure-pending command and auction it to the highest bidder, in a form very similar to how Google AdWords works today. Would it be worth fifteen or twenty bucks for Brand B to know that my Brand A dishwasher is about to go kablammo? Absolutely, just as Big Box Store A and Big Box Store B would love that data, either to earn my business, or maintain my brand loyalty.

The net-net here is that just because you're not paranoid, doesn't mean they're not out to get you. In these early days of the Smart Grid, utilities, vendors, and third party service providers all must work diligently to build consumer trust, to ensure users that they're working with them, rather than against them. Just as it's taken years for telecom and pay-TV vendors to learn how to interact with customers (and not all of them have, obviously), so too will it take time for utilities to adapt their behavior. The traditional terms ratepayers or load points no longer have a place in a utility's vernacular. We've launched ThinkSmartGrid to help utilities and their suppliers develop and deliver on all aspects of the Smart Grid, with a particular focus on the consumer value proposition. While you'll see announcements from us over the coming weeks and months about our relationships with leaders in multiple sectors like automated demand response (OpenADR) and visualization, we'll never lose sight of the consumer, and the need to include that consumer in the conversation.

Speaking of conversation, we want to include you, too, so please feel free to comment on our posts. The ThinkSmartGrid team brings a unique perspective to the market. While we may not always have the right perspective in your eyes, we look forward to opening and maintaining dialog with you.

For now, I need to move out of my thermostat's line of sight...just in case I'm being watched.