It’s nice to see Ontario’s information and privacy commissioner, Ann Cavoukian, being so proactive on the issue of privacy as it relates to deployment of the smart grid. (Disclosure: Cavoukian is a good friend of mine and co-author of a book we wrote on privacy issues back in 2002).

Cavoukian’s latest annual report highlights the privacy risks involved with the rising use of smart meters and the increased collection of granular data about when and where people are using electricity. “In a future smart grid scenario that does not build in privacy, intimate details of hydro customers’ lives could be easily discerned by data automatically fed by appliances and other devices to the companies providing electric power (eg. what time you cook, shower, or go to bed — and the security issues such as whether the house has an alarm system),” Cavoukian writes in her report. “Once inferences can be drawn on granular energy consumption information flowing outside of the home, such as real-time energy use data, future consumers may have questions including: Who will have access to this sensitive data? For what purposes? What are the obligations of companies making smart appliances and smart grid systems to protect my privacy?”

Cavoukian has a new program called Privacy By Design, which places focus on the need to build privacy into new technologies and systems from the outset, rather than scrambling to make privacy/security fixes after there has been a major — and often embarrassing — information breach. The whole point of this is to learn from past mistakes during the early days of Internet, Web and e-commerce development, when companies rushed ahead to come out with services without considering the privacy implications. This got many companies, including big names like Intel and DoubleClick but also high-profile retailers, into a lot of hot water. The rise in identify theft only brought increased attention to the problem. Whether it was disgruntled employees looking to take advantage of this information from the inside, or clever hackers looking to steal information for a profit or for bragging rights, having so much detailed information about individuals in one place is — in Cavoukian’s words — a “treasure trove” that needs to be protected like Fort Knox. You can bet there are already hackers out there looking to make a name for themselves by being the first to access consumer information through smart grid infrastructure, even during these early days.

That’s why it’s crucial that utilities and their partners think of information privacy and security now, rather than as a Band-aid measure later. Not only is this a good strategy to avoid future legal challenges, it will also save them a lot of hassle and embarassment in the long run if they treat privacy/security seriously from Day 1. For that reason, I think Cavoukian’s Privacy By Design message needs to spread across the industry as we embark on what’s expected to be a massive, multibillion dollar smart grid buildout.

My good friend Ann Cavoukian, Ontario’s privacy commissioner, has co-authored a new report that highlights the potential privacy breaches that could result as we move toward a smart grid infrastructure, one that will certainly have dozens of applications layered on top with the capability of capturing information about how and when we use electricity. It might seem like benign information gathering, but Cavoukian says there is room for abuse and efforts must be made during early design of the smart grid to build in privacy protection. “Electric utilities and other providers may have access to information about what customers are using, when they are using it, and what devices are involved. An electricity usage profile could become a source of behavioural information on a granular level,” according to the report, which gives examples of types of information that could also reveal when a person is away from home and if an alarm system is on or off. The benefits such smart electricity services and applications can provide shouldn’t come at the expense of personal privacy. “Much in the same way that we do not expect the postman to look inside our windows when he is deliverying the mail or the cable person to monitor the TV shows we watch after he has completed the cable installation, so too do customers not expect there to be any surreptitious profiling of their in-home energy-related behavioural patterns.”

Are we being paranoid? Maybe — but then again, the privacy erosion that came rapidly with the Internet caught many consumers and businesses off guard. Certainly, it’s worth learning from past mistakes and thinking about these privacy issues before, rather than after, the infrastructure and supporting applications for the smart grid are rolled out. (more…)