It’s nice to see Ontario’s information and privacy commissioner, Ann Cavoukian, being so proactive on the issue of privacy as it relates to deployment of the smart grid. (Disclosure: Cavoukian is a good friend of mine and co-author of a book we wrote on privacy issues back in 2002).

Cavoukian’s latest annual report highlights the privacy risks involved with the rising use of smart meters and the increased collection of granular data about when and where people are using electricity. “In a future smart grid scenario that does not build in privacy, intimate details of hydro customers’ lives could be easily discerned by data automatically fed by appliances and other devices to the companies providing electric power (eg. what time you cook, shower, or go to bed — and the security issues such as whether the house has an alarm system),” Cavoukian writes in her report. “Once inferences can be drawn on granular energy consumption information flowing outside of the home, such as real-time energy use data, future consumers may have questions including: Who will have access to this sensitive data? For what purposes? What are the obligations of companies making smart appliances and smart grid systems to protect my privacy?”

Cavoukian has a new program called Privacy By Design, which places focus on the need to build privacy into new technologies and systems from the outset, rather than scrambling to make privacy/security fixes after there has been a major — and often embarrassing — information breach. The whole point of this is to learn from past mistakes during the early days of Internet, Web and e-commerce development, when companies rushed ahead to come out with services without considering the privacy implications. This got many companies, including big names like Intel and DoubleClick but also high-profile retailers, into a lot of hot water. The rise in identify theft only brought increased attention to the problem. Whether it was disgruntled employees looking to take advantage of this information from the inside, or clever hackers looking to steal information for a profit or for bragging rights, having so much detailed information about individuals in one place is — in Cavoukian’s words — a “treasure trove” that needs to be protected like Fort Knox. You can bet there are already hackers out there looking to make a name for themselves by being the first to access consumer information through smart grid infrastructure, even during these early days.

That’s why it’s crucial that utilities and their partners think of information privacy and security now, rather than as a Band-aid measure later. Not only is this a good strategy to avoid future legal challenges, it will also save them a lot of hassle and embarassment in the long run if they treat privacy/security seriously from Day 1. For that reason, I think Cavoukian’s Privacy By Design message needs to spread across the industry as we embark on what’s expected to be a massive, multibillion dollar smart grid buildout.

Reports surfaced last week that we’re running out of Web addresses. The Number Resource Organization, which is in charge of allocating Web addresses based on the IPv4 standard, warned that there is less than 10 per cent of these addresses left and that a severe shortage — and “grave consequences” – will be upon us if we don’t migrate quickly to the new IPv6 standard, which offers a virtually unlimited number of addresses.  “The limited IPv4 addresses will not allow us enough resources to achieve the ambitions we all hold for global Internet access,” said NRO chairman Axel Pawlik. “The deployment of IPv6 is a key infrastructure development that will enable the network to support the billions of people and devices that will connect in the coming years.”

Most media coverage has highlighted the growth in laptops, mobile devices, servers and routers, but more eye-opening is the coming wave of “smart” grid devices that will need to have their own IP addresses. Thermostats, smart meters, dish washers, laundry machines/dryers, intelligent lighting (in homes and buildings), electric cars — really any appliances or devices or machine that will be controlled remotely through the Internet. Here’s a question I honestly have no answer to: Are energy management and smart grid/appliance companies — General Electric, for example — aware of this coming shortage of IP addresses, and have they taken the necessary measures to avoid the crisis?

Network World had an informative article on this issue in October.

Apparently it’s not difficult to migrate from IPv4 to IPv6, but it does require a lot of investment in software and hardware upgrades. Will the energy sector be caught off guard by this? I’d love to open this up for discussion from some more knowledgeable people… please enlighten us.

My good friend Ann Cavoukian, Ontario’s privacy commissioner, has co-authored a new report that highlights the potential privacy breaches that could result as we move toward a smart grid infrastructure, one that will certainly have dozens of applications layered on top with the capability of capturing information about how and when we use electricity. It might seem like benign information gathering, but Cavoukian says there is room for abuse and efforts must be made during early design of the smart grid to build in privacy protection. “Electric utilities and other providers may have access to information about what customers are using, when they are using it, and what devices are involved. An electricity usage profile could become a source of behavioural information on a granular level,” according to the report, which gives examples of types of information that could also reveal when a person is away from home and if an alarm system is on or off. The benefits such smart electricity services and applications can provide shouldn’t come at the expense of personal privacy. “Much in the same way that we do not expect the postman to look inside our windows when he is deliverying the mail or the cable person to monitor the TV shows we watch after he has completed the cable installation, so too do customers not expect there to be any surreptitious profiling of their in-home energy-related behavioural patterns.”

Are we being paranoid? Maybe — but then again, the privacy erosion that came rapidly with the Internet caught many consumers and businesses off guard. Certainly, it’s worth learning from past mistakes and thinking about these privacy issues before, rather than after, the infrastructure and supporting applications for the smart grid are rolled out. (more…)

My Clean Break column yesterday takes a look at an overlooked issue on the smart-grid file: privacy and security. Last week Toronto Hydro disclosed that 179,000 customer online accounts had been illegally accessed, along with some personal information. Now, this could have happened to any Web site that gives online access to billing — retailers, banks, your phone or cable company — so this isn’t directly a “smart grid” issue. What it highlights, however, is that utilities are a target like anyone else, and could increasingly be a target as they deploy smart meters and begin to offer energy-management services through the Web. How much energy we use at various times of the day can, surprisingly, say a lot about you and your home. For one, it can tell someone you’re not home. And it can allow someone to track your activities throughout the day. As I point out in the column, the Black Hat conference in Las Vegas last week showed just how easy it can be to remotely infiltrate a network of smart meters and seize control. Of course, we also have to worry about the upstream as well, keeping security issues top of mind  as we modernize our transmission systems. This is critical infrastructure, and with more and more points of access being created to enable the “smart grid,” this infrastructure will be increasingly vulnerable to attack.

My column today was a snapshot of some energy management projects going on in Ontario, a sign that local utilities are getting energized about the possibilities of energy conservation, given the right technologies in the hands of homeowners and businesses.

I mentioned Milton Hydro’s 200-plus household project in Ontario, but I’d like to provide some context because the results only tell half the story. Here’s what I wrote in the column:

The pilot project, conducted between July 2007 and Sept. 2008, was a collaboration between Milton Hydro, Direct Energy and Bell Canada. Households were given the ability to monitor their energy use through the Internet, as well as through BlackBerry-like devices, and to remotely control the lighting and operation of appliances in their homes.

An easy-to-use Web interface, designed by Toronto-based Lixar SRS, gave them a detailed view of how much electricity individual appliances were using at any point in time. The results showed that one in 10 participating households, when handed this control, used 16 per cent less electricity over 12 months and 18 per cent less during peak periods.

I say only half the story because the Milton project was a bit of a mish-mash of different technologies, some of which worked and some that didn’t work so well. The fact that only 10 per cent achieved savings above 15 per cent per cent is a bit misleading because, as I understand it, different homes were tested with different technologies and protocols. The only common thread was the Lixar SRS energy management software, which Direct Energy hailed as the best part of the project. I’d like to emphasize this because Toronto-based Lixar is another Ontario cleantech company making waves beyond provincial borders. “The most impressive was the Lixar interface,” said David Dollihite, vice-president of product development at Direct Energy. “Lixar has got a leading edge customer user interface for the presentment of energy usage information, and the ability to turn that information into something that’s actionable.”

An example? Some participants in the project were given the capability of participating in provincial demand-response programs. During DR periods, participants saw savings of 44 per cent. Pretty damn good. I’ve taken the Lixar software for a spin, and have to say it lives up to expectations and is super user-friendly. (more…)