In late 2014, the RAND Corporation hosted an expert panel for the National Institute of Justice on how the criminal justice community can take advantage of new Internet technologies such as the Internet of Things, intelligent agents, and semantic tagging. RAND recently released its report on the workshop (http://www.rand.org/pubs/research_reports/RR928.html), describing the panel’s assessment of the science and technology needed to take advantage of emerging opportunities while mitigating potential threats. Cybersecurity, along with protecting privacy and civil rights, became a major theme of the workshop. More than half of the research and development needs that came out of the panel either raised security, privacy, and/or civil rights concerns, or had implied security and rights requirements.
The technology area is seen as offering some of the most promise—but also some of the greatest security risks—is the Internet of Things (IoT). With the IoT, a wide range of everyday objects (vehicles, refrigerators, thermostats) and embedded sensors (computers in clothes, watches, medical devices, and physical infrastructure) are linked to the Internet. As such, they can both act as sensors uploading data to the Internet and receive commands remotely (such as turning up the thermostat and turning on lights before residents arrive home). However, panelists noted that sensors and other IoT devices may be vulnerable—they receive and transmit a great deal of data, which opens channels for hackers. Further, their tendency to be small, lightweight, and inexpensive may not leave much room to run security software. Consequences of breaching an IoT device could be enormous. As an example, a top need from the panel was sensors that can detect when other officers are nearby. This would be a great boon in support of crisis response and operational deconfliction; it also poses a severe risk if criminals can hack into those devices and, say, identify undercover agents, too. Intelligent software agents, which can search and retrieve mission-critical information from various media sources, were also seen as posing a risk, as information returned and marked as critical to law-enforcement operations by an intelligent agent might also be critical to criminals.
More broadly, the panel emphasized that data-sharing standards and policies and procedures for using these new technologies need to have cybersecurity, privacy, and civil-rights provisions built in from the beginning, rather than treated as an afterthought. The White House Cybersecurity Coordinator has noted that information security in general is seen as too hard and too expensive, and still something that has to be added in by experts rather than designed in and turned on by default. The RAND report specifically recommends a study to develop common attributes for criminal justice policies, procedures, and technologies to protect IoT devices and intelligent agents.
For more information, the report, Using Future Internet Technologies to Strengthen Criminal Justice, is available for free downloading from RAND’s website.
