Why data privacy is up to developers

Shutterstock image: internet of things, connectivity.

With mobile devices generating and sharing ever more data, developers need to build in the privacy safeguards that standards organizations and consumers can't necessarily mandate.

"I don't think it's realistic to expect people to understand the complexities of [the Internet of Things] and to even be able to really assess the risks of their interactions with systems unassisted," said Naomi Lefkovitz, senior privacy policy adviser at the National Institute of Standards and Technology. "I really think system designers need to do a better job of building systems that first and foremost minimize privacy risks."

Lefkovitz, who was one of several federal speakers at the American Bar Association's Internet of Things (IoT) conference on March 30 and 31, added that once systems are finalized, the risks are locked in, and people have no real choice other than avoiding the system altogether.

"You can either turn them on or off," she said, using web cookies as an example. "That's not much of a choice."

She urged developers to think of privacy from the beginning, design meaningful choices for users and build in safeguards. For example, it would be helpful to have sensors that signal when they're recording to help Americans avoid "that panopticon effect of never knowing if we're being watched or not," Lefkovitz said.

Such design choices are particularly important as the IoT spreads vulnerabilities deep inside organizations and homes.

"You can't look at any device and assume it is fundamentally safe based on how it is or isn't connected," said Jeff Greene, former senior counsel for the Senate Homeland Security and Governmental Affairs Committee and now senior policy counsel at Symantec.

Citing the fact that even devices not connected to the Internet are vulnerable to hacking, Greene advised device makers to incorporate basic -- but often neglected -- security measures, such as avoiding hard-coded passwords and prompting users to change default device passwords during setup.

Various organizations have issued standards for IoT privacy and security, but industry needs to rally around credible norms, said Michael Aisenberg, principal cyber policy counsel at Mitre.

If that doesn't happen voluntarily, he told the room full of lawyers, IoT standards might be "built on the back of a cacophony of litigation" -- which might be lucrative for lawyers but bad news for public policy.

About the Author

Zach Noble is a staff writer covering digital citizen services, workforce issues and a range of civilian federal agencies.

Before joining FCW in 2015, Noble served as assistant editor at the viral news site TheBlaze, where he wrote a mix of business, political and breaking news stories and managed weekend news coverage. He has also written for online and print publications including The Washington Free Beacon, The Santa Barbara News-Press, The Federalist and Washington Technology.

Noble is a graduate of Saint Vincent College, where he studied English, economics and mathematics.

Click here for previous articles by Noble, or connect with him on Twitter: @thezachnoble.


  • Management
    people standing on keyboard (Who is Danny/

    OPM-GSA merger plan detailed in legislative proposal

    The White House is proposing legislation for a dramatic overhaul of human resources inside government and wants $50 million to execute the plan.

  • Cloud
    cloud applications (chanpipat/

    GSA plans civilian DEOS counterpart

    GSA is developing a cloud email and enterprise services contract inspired by the single-source vehicle the Department of Defense devised for back-office software.

  • Defense
    software (whiteMocca/

    DOD looks to unify software spending for 2020

    Defense Department acquisition head, Ellen Lord, hopes to simplify software buying and improve business systems following the release of the Defense Innovation Board's final software acquisition study.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.