The Internet of Things with Laura DeNardis Ph.D., Globally Recognized Internet Scholar

Welcome to RxChill Pill, the podcast that strengthens your resilient mind every time you listen to the extraordinary stories, expert tips, and meditations to elicit your relaxation response, the antidote to your stress response. I'm Dr. Juna Bobby MD. I'm a physician and mom specializing in mind-body and lifestyle medicine. Find out more about me, my personalized online courses on procrastination and mindset coaching for kids, teens, and adults, at mindbodyspace.com.

Good to see you.

Good to see you too. Are the— is, is that your home or your home office? Nice. I like the books.

Thank you.

I see your books over there.

I've, I've got a lot of books and, uh, everyone makes fun of me at work because I don't have any books in my office. It's all very Spartan and very neat, and I, I have them all at home.

So today I'm so excited to have with me Dr. Laura Denardis. She's a globally recognized internet governance scholar and professor and interim dean of the School of Communication at American University in Washington, DC. She also serves as a faculty director of the Internet Governance Lab at American University, and her 6 books, including The Internet and Everything: Freedom and Security in a World with No Off Switch by Yale University Press, was published in 2020. With a background in information engineering and a doctorate in science and technology studies, her research studies the The Social and Political Implications of Internet Technical Architecture and Governance. She's an affiliated fellow of the Yale Law School Information Society Project and served as its executive director from 2008 to 2011. She's also an adjunct senior research scholar in the Faculty of International and Public Affairs at Columbia University and is a frequent keynote speaker at the world's most prestigious universities and institutions. She's taught at NYU, Yale Law School. She's been featured in Science magazine, The Economist, National Public Radio, New York Times, Time magazine, Christian Science Monitor, Slate magazine, Reuters, Forbes, El País, La República, The Atlantic, and The Wall Street Journal. Dr. Denardis served as the director of research for the Global Commission on Internet Governance from 2014 to 2016. Domestically, she was appointed member of the US Department of State's Advisory Committee on International Communications and Information Policy. She has more than two decades of experience as an expert consultant in internet governance to Fortune 500 companies, foundations, and government agencies. She holds an AB in engineering science from Dartmouth College, master's in engineering from Cornell University, a PhD in science and technology studies from Virginia Tech, and was awarded a postdoctoral fellowship from Yale Law law school. Wow. That's a, that's a pretty big introduction there, Laura. Thank you so much for being here today.

Thank you so much for having me.

Your new book here that I have, The Internet and Everything, about the freedom and security in a world with no off switch. I mean, you've been writing about this and researching this forever, right? But as a child, did you say, Mom, I want to be an internet governance scholar. How does that happen?

Well, as a child, I don't think I even knew what the internet was. You know, it was being developed at some point in the background, but, uh, you know, I didn't know what it was. But I did have a father who was a telecommunications engineer, and that really influenced my interest in math and science and technology. And we were actually one of the first one of the first households in my area to have what was then considered to be a home computer, which was called a Radio Shack TRS-80. You couldn't really do very much with it. You could play little games like Pong, and you know, at the time it was terribly exciting, but that was definitely an influence on me when I was young.

Uh-huh. And then, but you studied engineering, is that how you started?

And then I studied engineering and the way that I got interested in the subject of internet governance actually happened when I was a graduate student at Cornell. Studying information engineering. And we used to use the internet for something— chat, just like we do now. It's called Internet Relay Chat and email. And it went down. There was a pretty major outage, and it was the first major disruption to the internet in the fall of 1988. And the outage actually got traced back to compute— to the computer science department at Cornell and a fellow graduate student who unleashed what was called a worm, which was—

A worm?

A worm, right. Autonomous code that self-propagates and it disrupted many of the systems in the internet and created the outage. And I became very interested in internet security over that. The feds started coming around, there was a great interest in it and the media covered the internet suddenly and they had a lot of errors in technical descriptions of the internet and, you know, exactly what was happening. So the government was involved, the media started covering the internet, one of my fellow graduate students had unleashed this, and it led to public understanding to a certain extent of what the internet was or what it might be, and it also led to something called the Computer Emergency Response Team, which was an entity designed to help address security. So I was hooked. Um, it involved the government, private industry, um, the media, the technology, and it also drew attention, uh, for myself to how vulnerable the internet was to those kinds of disruptions.

And at that time you were a grad student studying engineering. Uh-huh. And you were using the internet mainly for chatting, you said communications at that time, or research, or both?

Even mostly for social reasons, honestly. Even in, even in those days, college students used it for the same things that college students do now. Obviously there was no social media at the time, but there were some, I guess you could argue that they were social media, like multi, they were called MUDs, multi-user domains, and different kinds of ways to communicate socially. Email was certainly something that we used on campus and we would—

We had to be on a computer.

Had to be on a computer. You couldn't just whip out a cell phone and start, you know, there were no smartphones, really no cell phones at the time.

As I remember, we had to even sign out time on a computer, right? You had to like actually sign in.

You had to go to a room that was usually in the basement of an old building and Yeah, sign out time in a computer.

Wow, we're dating ourselves here now.

Right. But, but yeah, all the Macs at that time there, we all had, uh, Apple Macs as well. And so we're doing things on Apple Macs, but it was just the very beginning of—

with the little discs, right? We had to put it—

put a disc in.

So what— why did this graduate student release that? And also, you said a self-replicating code, so literally a virus. That's what a virus does.

It's— you could call it nefarious code.

Yeah.

You know, malware is the term for it. Malicious code. It can be a virus, which is something that usually requires a person to take an action, like downloading. You click on a link in your email and it downloads something that can do harm to your computer or engage in identity theft or other kind of harm. A worm is usually a term for that kind of code that replicates itself, so it doesn't really require an action by a human. That happens— that happened back then, and it still happens today in these attacks that are usually called botnet attacks or denial of service attacks. These— yeah, DDoS is usually— everything in internet governance is an acronym, unfortunately, but DDoS attack stands for distributed denial of service attack. And that's where there's software that becomes a bot. It acts on its own, it's programmed to act on its own and to self-replicate and to do some kind of harm, such as bombard a website with so many requests that are not human requests, they're from the software, that it makes it inaccessible to others.

That was the one where Twitter went down, right? Was that the one?

Well, there was a very famous example of this a few years ago where Internet of Things devices like home appliances and video recorders, video cameras were hijacked. They often have vulnerabilities or are not regularly updated, so they're susceptible to this kind of invasion where Malicious code is implanted and then they hijack these devices. And in the example that you're, uh, that you just mentioned, they attacked very popular websites like Twitter, Reddit, eBay. And you don't have to actually infiltrate those sites. An analogy would be if we took about 1,000 of our best friends and we said, everyone call into the Boston or the DC or the New York 911 system at the same time. It would— you're not, you know, infiltrating a system, but you are consuming resources so that it's not available for legitimate traffic. And so that's what happened in that case.

I see.

And going back to that grad student, did you know him or her? I'm assuming it was a her.

I didn't know him well, but he was in my building. And he lived on the same floor of my building. And he now is a professor of computer science and he's done very well. But at the time he said that he wanted to make people aware of the vulnerabilities in the internet. It exploit, you know, I won't go into the technical details of how it was carried out, but it certainly did make people aware of some technical vulnerabilities.

So he was just doing it to show how— get awareness, basically.

That's what he said.

Or was it a prank, like those MIT students when they do those pranks at MIT?

It was all of the above.

But okay, wow.

But to the feds, he was prosecuted under, uh, the Computer Fraud and Abuse Act and had to do community service. And but, but he did very well in his career.

Who is it?

Can we say Robert Morris? It was called Morris Worm. If you look up Morris Worm, that was really the first major disruption to the internet. But that got me interested in the topic of internet governance.

And I saw in your, I read in your book that the people who carried out that DDoS attack was doing it to win what, Minecraft? Is that true?

Yeah, the Mirai botnet is the name of the, the, the attack that took down some of those major websites like Twitter and Reddit. And the software actually originated from some, um, some video users who were— yeah, they, they were Minecraft users and they developed the software. But then once the software is out in the wild, it can be taken up by anyone and used.

And so why did those people do that that day, to to all these big sites?

Do you—

was there a reason? What was the motive?

Often it's— motives are very difficult to assign in DDoS attacks, and it's also very difficult to track down who carries them out. And it's also easy to, um, have some kind of attribution that points to someone who actually didn't do it. It's, it's very, very difficult to, uh, to stop after the fact in terms of identifying the person, but Often, and I'm just speaking in a generality now, often there is a political motivation for this. So for example, there have been DDoS attacks carried out against political campaigns or taking that, I think one of the most difficult cases was in Estonia when the Estonian government and banking sites and all kinds of institutions had their websites disrupted by this and it was politically motivated. From and attributed to Russian sources. And so this happens all the time. Often it's for a political motivation. And then sometimes it's just, you know, a young hacker trying to carry something out.

Wow. And/or somebody trying to steal our personal information, right? For monetary gain?

Well, there are a lot of cybersecurity attacks for just that reason. Often they, originate in North Korea or they originate in China. And there's all kinds of economic espionage that comes through these cybersecurity attacks, not necessarily denial of service attacks, but the kind of infiltrations that create data breaches and extract information.

Uh-huh.

There is a huge economic incentive behind that. For example, stealing intellectual property rights. And trade secrets and business secrets. So there's, that is definitely a problem, a whole category of problem that costs, you know, billions and billions of dollars a year.

And that you can trace back to where it came from.

Sometimes you can trace it back and sometimes it's a little more difficult. It depends on how obfuscated it is. But in the United States, we have a pretty good apparatus of, you know, between, you know, our different agencies that can, try to find out the attribution of that and where it originates. And often it comes down to North Korea, it comes down to Chinese nationals, and it comes down to Russian nationals, as well as all over the world. I mean, the economic attacks, the data breaches. They say that there are two kinds of companies: the kind that knows that they've had a data breach, and then the kind that doesn't know that they've had a data breach. But this is very, very common as well. Not as—

Right.

I mean, we get those emails all the time like, oh, you might have been involved in a data breach, right?

Yes. And then you have some sort of credit service that can monitor whether someone is trying to have a credit card in your name or do some kind of identity theft. But almost students, you know, universities have had data breaches, banks. Equifax is an example, Home Depot, Target. What is remarkable about this is that even if someone has never been on the internet, they can still be affected by the data breaches because they may be a customer at Target and had their credit card information stolen. So it speaks to this issue of how you don't have that much, in a way, what is the human agency? There's a lot of human agency that we have, We also have to acknowledge that this is a society-wide problem because even someone who has never been on the internet can be affected by a data breach. And a lot of, and in fact, a lot of people online are not actually people, they're bots, like in social media.

Right, right. So, but going back to the credit card thing, so unless you're using good old cash or like an IOU, You're gonna have somebody be able to data breach you. Is that what you're saying? I mean, so as long as you're using a credit card, basically you can be a victim.

If someone has, if someone goes to a university and has their personal information in the university sites, or if someone loses their bank, or if someone shops at Target and they don't, even if they use cash, they may be enrolled in one of these, uh, affinity programs where it gives you a discount on, you know, Tide detergent because you use it all the time. That is, that's collecting data and information can get out in the wild and be stolen. So it's, you know, the choice of— it's a society-wide problem because, okay, it's a society-wide problem. There's only so much human agency that you can have in this unless you live in Montana out in the middle of nowhere, you shoot your own bison for dinner. You have to— that's right, you have to take care of it yourself.

So literally, so literally, if you give any information, we're basically at risk. If you, you're involved in any social contact, even if you join a gym, or you, and you give them your information, it's in their data.

Have a credit card, if you need a credit check, if you pay rent, if you go swimming at the local fitness center. I mean, there's— we're a data-driven society and we live in a model right now in which, um, you know, some people call it a Faustian bargain where we turn over our data and then that data is gathered by the intermediary companies, whether it's Google or whether it is Facebook or Twitter or Samsung or anything else, and that can be monetized, aggregated, sold, and used to serve ads to us. So that's, that's the business model in which we use— it's a tremendous benefit to us because we use these, most of these platforms for free, right?

So are there like— is there such a thing as like cyber gangs? So you mentioned 3 major countries that a lot of these come from, but like, can Joe Schmo from Estonia, you were mentioning Estonia before, that's why I'm saying that, but can they figure out how to do phishing or like phishing attacks or get your credit card information somehow? Can they do that or is it really like organized large crime?

It's both.

It's both, okay.

Yeah, it's both. Some, I would even say that a subset of this is state-sponsored. Subset is from organized crime. And then you have these one-offs where, uh, you know, you get these phishing attacks. I mean, if you ever, if you ever thought that, um, we, we can make a difference, you know, we can make a difference if we're aware of these kinds of attacks. Uh, phishing attacks is an example.

Right.

Um, and I would ask the question, who would be president? Um, if someone hadn't clicked on, I mean, it's, this is not answerable, right? It's just a hypothetical question.

Yes.

But someone who worked for the DNC at the DNC clicked on a phishing link in the email and it led to the release and the hacking of the DNC emails during the last presidential election. So that's an example of something that was probably politically motivated, but it can come from anywhere. And the idea is to, you know, this is sort of an ad hoc example with the DNC email release, but a lot of phishing attacks are designed to carry out identity theft. Theft, where you would— they say, oh, your American Express account has been breached, we need to verify that it's you. And it's not coming from American Express, it's coming from some kind of a nefarious actor. And they say, please input your credit card account. I actually, um, had someone hack our faculty, um, by using my identity in a way. Um, they received the I'm the interim dean this year, and the entire faculty and staff received some email saying, pretending to be from me, it wasn't actually from me, saying, "I need your help. Please text me right away to this number." And one of our faculty members thought it really was me and said, "What do you need?" And the person said, "I need you to buy a," a gift card so that I could take care of something.

And at that point, I hope they were like, okay, this is not her.

They actually did it. One, one person did it. And, you know, as I would tell the story, that's the only one that had my back, that actually thought I, I really needed the help. You know, the intention was good, but they're so— they can be so believable because they have some kind of information about you or about the relationship or the name of the person. And so it's— yes, these attacks only work if they're believable.

We just had, um, we just had two grandparents. One of them was my husband's mom. She's very savvy. So when somebody called her on the phone and asked her, you know, she— they actually mentioned her grandson's name and said, hi Grandma, it's blank. And she was like, oh well, What's wrong? And he's like, I am stuck in the Dominican Republic. Can you send me some money? I don't wanna tell mom and dad. So this was a script. I heard about this from other grandparents and she's very savvy. So she was like, uh-uh, no, goodbye, hang up. She's 80-something. But yeah, that was creepy.

This is very common. Very common. And phishing attacks are only effective if there is that whiff of truth in them. So that people believe something. And that's where the internet of things and the data gathered from the internet of things can actually exacerbate this and make it much more believable. If someone has data that's collected from your home alarm system.

I don't, you know, some of the listeners might not really, I wasn't very familiar with these terms either. So IoT is internet of things. So define that versus IOE, which is internet of everything.

Regardless of terminology, there's a very major transformation that's happening in society, and that's that the internet is no longer just a communication system in which we do things like we're doing right now, talking or sending emails or—

which of course this, this app also said they might be recording us. So I noticed that because I was interviewing you today and it said we might be capturing some audio and video.

Absolutely. And that's what you— but that's part of the communication network, the email, social media. This is what we think about when we think of the internet in general, or downloading knowledge or doing banking. But actually now more things than people are connected to the internet, and those things are very diverse. They certainly include things that might be in a home, like home appliances, alarm systems. It's very difficult to even buy a new home without having almost every object connected. People have connected blinds, they have connected coffee machines, they have connected thermostats, they have connected door locks.

So when you say, say, drapes, um, thing that has a Bluetooth or Wi-Fi and I click on it and it opens and closes, so you're saying that that actually is collecting data? That can—

well, that can be— if that's connected to Wi-Fi, which is connected to the internet, that's definitely part of the internet.

So when I connect that to my phone to control it from my iPhone, then it's right there, it's connected. You nodded yes. So that would be—

You're still very connected to the internet.

Yes. Okay. So the minute I connect it to my phone, so for example, I have all my lights on my phone, it's connected and there's data that could be mined.

That's part of the internet of things. That is part of the internet of things. So in homes, it's also in industrial settings, there are, Autonomous vehicles. You know, we talk a lot about driverless cars, but already driverless dump trucks and other kinds of industrial vehicles are used to do mining and, you know, in all kinds of industrial settings. That's part of the internet of things as well. And also connected medical devices where someone might have a smart thermometer or a smart insulin pump or some kind of diet— you're wearing a Fitbit, uh, some kind of, uh, you know, glasses or blood pressure cuffs or things that are connected to the internet. So taken as a whole, this is, you could call that either the internet of everything, you could call it the internet of things. I decided to call this book The Internet in Everything to capture how far the digital world has leapt from human-facing display screens into this cyber-physical world that's all around us. So that's the transformation.

That's amazing. And you proposed, I mean, you talked about Dick Dick Cheney's heart monitor in the book? Do you remember that?

Yes, this is the Internet of Things or the cyber-physical world, whatever we want to call it. It's part of a long trajectory, and when Dick Cheney was the vice president, this was disclosed far more recently in an interview, I believe on 60 Minutes, that his doctor decided in an abundance of caution to disconnect his cardiac, you know, his connected cardiac appliance, his pacemaker basically, so that he wouldn't be assassinated over the internet. So this is— wow— this is something that happened a long time ago, but since that time there have been FDA warnings that some internet-connected cardiac appliances have been hackable. So, wow, it's—

and Is it internet-connected so the doctor can pay attention to what his heart is doing, right? Is that why it was connected to the internet in the first place?

Or so that he can connect to it and see, you know, what kind of information, warnings can— if someone has an insulin pump, if someone has an embedded pacemaker, it's not only so that the doctor can monitor it, but it gathers data that can then be used by the doctor or tell the person person themselves if they have to take some kind of action. This was quite a while ago, and it's an example of how the body is now part of the internet space.

Mm-hmm.

And you mentioned like every app that we— let's say you're feeling sad one day and you look up something on the internet about how you're feeling sad, that gathers data about how you felt that day in that moment. Or apps that we're using? What about all those self-reflection apps? They're all gathering data on how we feel and—

There are many different ways to gather that information about how we feel. The one that has been used for a long time is just based on what we're searching for, what we're saying to other people, words that are detected, sites that we visit. Uh, who we're talking to. Uh, if you're, if you're contacting, you know, like a therapy website or, you know, any, there's a lot of data that can be gathered, but now this information can also be detected through a Fitbit bracelet and, you know, pulse rate, different kinds of physiological, um, you know, data that can be collected. And increasingly facial recognition can detect how someone is feeling.

Wow.

Wow.

Yeah, this one has heart rate variability, so it knows kind of like when I'm stressed, it thinks.

Everybody is stressed during coronavirus.

That's true, right? That's true. And I was gonna— but I wanted to— I want to ask you about the internet and about smart devices and coronavirus too, because I think there are some benefits of being interconnected with medical devices and especially with something like the coronavirus. But I want to get back to this page on Figure 1. You mentioned things like groceries that could be something that's part of the Internet of Things. How are groceries part of that?

People have connected refrigerators that can monitor what you put into it, how much weight is on a shelf. You may have a smart device on your refrigerator that says you need to order milk or you need to order butter. All of these things taken together are very convenient and they create efficiencies and they help us to live, you know, it's good for human flourishing. I mean, anyone who has a disability themselves or disabled family member, you could immediately see how good these things are to help. But it's an example of the enhanced data that is now collected, where it extends not only into— not only from what we do through a screen where we're talking to someone or looking at someone and having a video conference or downloading knowledge, but it extends into the most intimate spheres of human existence. Such as what you're eating, what you're ordering, what you are doing in your bedroom, what you were doing in your car, what you were doing, you know, in these very, very intimate private settings.

How fast you were driving.

How fast you were driving. And this is relevant for a variety of reasons, but one has to do with the possibility of what's called algorithmic discrimination. Where the data that's collected could be used to make insurance decisions. It could be made— it is actually used to make insurance decisions, such as data from a car being gathered, and you could use that to get a lower rate on your insurance. You could have these kinds of, um, devices that are geared towards health and fitness, and that could potentially connect into whether someone should get a job. And wow, it's—

but they already have this information if they want it. Is that what you're saying? Do you have to give permission for somebody to have this information, or you think it's already out there for them to get it if they—

we almost always give permission when we download an app and start using it, and most people don't actually read them. I don't always read it. I sometimes just hit check when I want to download something really quickly, but when you start reading the terms of service, then you realize that there is quite a bit of data collection. And it's in this— in, in the case of the internet of things that are connected, the data collection is absolutely necessary for the functioning of the system itself. For example, I, I went to a farm in Culpeper County, Virginia, and saw a, a robotic milking machine. You know, all the cows get milked. It's called a voluntary milking system. And the farmer showed me how, well, you could go to the phone app and see how much milk is being produced. Like the data is constantly being collected, whether it's in that kind of a farm setting or an industrial setting or in a car or in home. So it's a complete constant feedback cycle that happens in the background rather than through a screen.

But what I mean is if I apply for insurance, for example, do they have a place, a database where they can go to to find out how fast I've been driving?

They can ask you if you are willing to have your data collected and have a discount on the insurance.

Oh, okay.

And many people opt into this. Safe drivers would want to opt into it, but it— which is a great thing, but it also can be a tax for those who don't want that kind of data collection because they'll essentially pay more for their insurance.

And I also read an article recently where this guy was riding his bike near a home. I think there was a home invasion and he was on his bike just taking a bike ride.

He must have been placed at the scene of the crime based on GPS data collection.

And then, I mean, eventually he was let go, but he was so upset by it. I mean, as would I, you know, this woman was, her home was invaded and he eventually showed that he, you know, cycles there every day for months, and he does that for exercise. But they have this wide net, so it's not that specific, right? But yet they can track you.

There are a lot of ways to track people, and we are attracted— even if we just carry our phone around with us, that places us, um, you know, like some people try to avoid cars, new cars that have data collection and GPS built in. But if you carry your phone with you that data is collected anyway, and it uses either triangulation from cell phone towers to place you, or GPS, which is satellites in the sky, or if you're connected to a Wi-Fi hotspot, that can put you generally in an area. There are many, many different ways to track exactly where we are. And if you look at the terms of service, uh-huh, of phones, cell phone connections, social media, you can see in there that location data is part of what's gathered.

And so if you turn your phone off, that's the only way that they can't track you, basically.

You could turn your phone off. No one ever turns their phone off because you need them in order to function.

That's true. And you— and on the other hand, you want to be found if something happens. Like, you need to—

you want to be found, right? So there are— so, I mean, there— the advantages far outweigh the disadvantages, but the privacy issue is a big one. Safety is an issue. A big issue, you know, as we move from the screen-based internet where you're only choosing to access it when you get onto your phone or onto your laptop or onto your computer to this environment where the internet is embedded in the physical world. That's quite, quite a change. That is quite a change.

And can you give us a couple of examples? I know you already did, but I mean, when you say embedded into the physical world, you're saying—

Okay, here's an example. A baby monitor. Yes.

Uh-huh.

This is something that many people use when they say they come home from the hospital with their baby, and they may even have it set up ahead of time, but they have a baby monitor set up, and it's not just connected locally in the house, it's connected over the internet so that someone who is at work can look at a video of their, you know, bring up an app on their phone and look at a video to make sure that the baby is safe. That's an example of the internet embedded in this kind of a monitor. The internet can be embedded in something like a blood pressure cuff or a medical device in a doctor's office. It can be embedded in a car. It can be embedded in, you know, basically name any object. I, in fact, if someone goes on to Amazon, they could say, I'm just going to search for an object and and see if I could find one not connected to the internet. Sometimes it's harder to find one not connected. Even coffee machines are connected, are available with Wi-Fi connection.

So you could turn it on or brew something from your phone.

And an alarm system. So it's very convenient to be able to open an app on the phone and disable your alarm or see when it's been disabled if you have a childcare coming in or any kind of like dog walking services. You can see when it's disarmed. It's all connected to the internet.

So basically you're paying for convenience and safety. But on the other hand, there's this other dark side of it.

There, as always with any internet issue, it's a tension between the great conveniences and the great economic economic benefit and the human aspects that are, you know, it's just so convenient to use them and it's helping us to live better lives. There's a tension between that and the danger of insecure devices and the, the danger of giving up privacy, whether to governments or to the private sector that's collecting all of this data, and just In the case of the Internet of Things, there's an additional data— excuse me, in the case of the Internet of Things, there is an additional danger, and that is that a breach or some kind of a hack, it moves from disrupting email to potentially disrupting human life when something like the brakes of a car could be sabotaged or a device in a home could be hacked and do something like bring the temperature in the home up very, very high or turn on something like a coffee machine. I mean, it moves from harm that's related to communication to harm that's a lot more related to consumer safety.

Was that you who talked about revenge breakups where they would ghost the house and they broke up and—

Ghosting is an enormous problem with the Internet of Things because often when—

Can you explain that to people who might not know what that is?

If one lives in a home that has connected objects and if they go through a difficult breakup and maybe the one partner moves out, this is something that police are well aware of, and those who study domestic violence are well aware of. The partner who has moved out may be the person who controls the relationship to the device. Usually one person buys a device, or one person has the login to these home systems, and they can do things like turn the lights on and off. They can activate the surveillance cameras, like a Ring doorbell, and monitor what's happening and, you know, keep the person under surveillance or deactivate the locks or do other things that are— would anyone would consider to be harassment.

Oh, wow. And there was also a story you told about the baby monitor where somebody was hacking into a baby monitor and abusing the child.

A couple— these kinds of examples are not the norm, but they're important because they draw public attention to the problems and why it's so important to update a password or secure the device in some way. But in this case, a couple came, you know, heard some shouting and went into the baby's room, and a hacker was screaming at the baby through the baby monitor. So it's absolutely horrifying to think about that.

And why would somebody do that? Why would that— well, what is that, that motive?

I often ask myself the question of what motivates people to harass others online. And honestly, recently I was, um, uh, a witness to this kind of harassment on a Zoom call.

Um, it was a Zoom bombing.

Zoom bombing. Yes, I was on a call with some people. It wasn't a class, but it was, um, you know, with some friends, and someone jumped into the call and started spewing racist vitriol and pornographic information. And we got them off very quickly. This was before a lot of the security updates and the awareness of how to use Zoom to be password protected and have—

yeah, they changed it within a week.

Yeah, and I give the company a lot of credit because they never imagined that within the course of a week they would go from— they had a tenfold or maybe a hundredfold increase. Everyone was using Zoom for school, for family discussions, for work discussions. And when you have that kind of rapid change, the trolls always follow. I don't know what their motivation is. I can't imagine what the motivation is to spew that kind of racist vitriol and, you know, pornographic information in, in that kind of a setting.

But okay, so there is no real answer to some of that. Could that be some kind of, um, there's all those conspiracy theories that they're bots sent to create division in society. I mean, is there any evidence for that that you know of?

There is a tremendous amount of evidence that there are bots creating, disseminating, replicating, amplifying social media disinformation. Shortly after the 2016 presidential election, Facebook disclosed a lot of the disinformation that was circulating. Twitter disclosed, you know, that they were taking down millions of fake accounts that were run by bots. You know, they were software accounts that looked like people but actually weren't. So yes, there's tremendous evidence of this kind of automated disinformation dissemination and circulation, as well as automated harassment. I think in the case of the Zoom bombing, it was actual people. It's generally actual people. So sometimes it's people, and sometimes it is an automated program that, you know, is designed to be a troll.

A troll being something to disrupt.

—society and to create division. Right. Circulating hate speech, circulating disinformation. And the companies are always— it's like a game of whack-a-mole. It falls to the private sector who owns and operates these private platforms that we use. We have the— you know, when you think about what is the public sphere now, the public sphere is nearly completely digital. And that digital environment is owned and operated by the private sector, by companies. I think though there's an acronym, GAFAM, like Google, Apple, Facebook, Amazon, Microsoft, but also any kind of a company, you know, in any industry that has an online, um, you know, platform for speech. So we can't think about it as speech on the, you know, out in the neighborhood or out on a green or a, you know, public green. It's all happening through the private sector, and they are the ones who are trying to deal with what speech to take down, what speech to leave up, what kind of conditions there are to allow for comments or to detect bots. So it's a game of whack-a-mole.

Yeah, and, and there's a lot of, um gray areas there also, right? I mean, you were talking in one of your interviews about if somebody left a review about you, for example, and you want to take it down because you say it's false, but that person, it's their right to speak.

One person's censorship is another person's, like, privacy. I mean, it depends on where you are in the world too. In the US, we have a very, you know, strong tradition of free speech. In other places, privacy is valued to a greater extent. The internet doesn't know these boundaries. The internet crosses borders. You could reach across and gather information, communicate. But in places like the European Union, they have something called the right to be forgotten, which gives someone under certain conditions the right to have information taken down about them. But it's very difficult to figure out how to do that, especially if you're in the United States. Because let's say that, um, you publish something true about me online, but it was something that was, um, that harmed my reputation in some way. I don't really have the right to ask you to take it, you know, to ask the platform like Google to take it down unless it's defamatory, like intentional false, or if it's, um, some kind of harassment. Or hate speech. They have, um, they have lots of agreements and terms of service about taking down hate speech, harassment. But if it's something true, I don't have the right to go into your social media account and to make you take something down, or to make like Facebook take it down. So it's— it is— there are a lot of gray areas. How do you— I mean, how do you protect people? How do you not have hate speech but also to protect the First Amendment?

I mean, just on a basic everyday level, one of my friends who's a physician, she's an incredible physician. Everybody loves her. She's amazing. And some patient who never even saw her left this horrendous paragraph about her, never met her, just was trying to get an appointment with her, but was angry.

So that was probably in an online reputation platform. Platform of some kind like Yelp or—

Yeah, something like that. Right. It was terrible. And for her to fight that, it was just— it's not even— she doesn't have time. She's busy saving lives.

In that case, the doctor probably could make the case, make an appeal to the company saying that I can prove this person never saw me and it's not relevant. And in that case, it would be appropriate to take it down. Mm-hmm.

But when, you know, I have a website and sometimes I get these, you know, I stopped leaving like a sign up with your email address because I got so many fake email addresses. Now I'm pretty sure it was a bot because they all had very similar things about them and they weren't Gmail or something that was recognizable. And I pretty much figured it out like this. These are not real people. Why are they doing that? What's the advantage of them trying to spam me? Like, I'm just so curious because, you know, for somebody who doesn't know that much about the internet, we're not sitting here thinking about ways to harass people. I, I don't even understand how people have time to do that, why they're doing that, what— how are they even being supported to do that?

You're correct that a lot of times that, that is automated in some way. And I think it's geared towards trying to create a relationship or a two-way flow of information with an actual person that can solicit information that could be valuable to them in some way, whether it's just a collection of emails, whether it is some kind of personally identifiable information or something else that can be used.

And they're just casting a wide net. Casting a wide net. So I have a few friends who were also hacked on their Facebook accounts And then they would set up a duplicate Facebook account and then reach out to a bunch of their friends and say, "Hey, this is my new— hello, this is my new account." And I have alerted some of them of this happening and they didn't know, but they would steal a couple of personal pictures to put on the profile to create this new version of them. Right. That's also looking for more information from their friends perhaps.

That's an example of impersonation that can happen, and you know, the platform will take that down if it can be demonstrated that it is impersonation, it's not the actual person. But often a motivation for that is a personal one where someone is trying to harass someone that they perceive to have wronged them in some way. Really? Or it can be used like a disgruntled former employee, someone who, like an ex-girlfriend or ex-husband or ex-wife, or it can be just purely for, you know, I don't really understand this, but purely for sport, just to see if people can do it. In other cases, it can be to try to gain identity theft in some way and access personal information. There are many different motivations for that.

All very unpleasant. So how do we protect ourselves? I mean, I know you are a technophile, right? You do love technology. You do love, I mean, who doesn't right now, right? I'm sure you're teaching all your classes online.

Everything at the university has moved online. So how, right?

So we all love it. So how can we protect ourselves? You said there are some very simple ways to do that. Do this. And if you had kids, what, at what age would you let them know about all the stuff that goes on like this and how can they protect themselves? And you had mentioned something very simple, like just changing your password.

Right. On, on one hand, mm-hmm, humans lack personal choice because as I mentioned before, if someone is a target customer and never has been on the internet, they could be affected by a data breach. So one solution area is a society-wide one to have meaningful data privacy legislation that restricts how information can be shared about us and what can be gathered. There are, you know, data protection laws around the world that are more advanced than the US environment, which really is tailored more towards industry. So we have health data privacy, we have financial data privacy,, and it would make sense for all of us as a society to have some kind of, uh, privacy legislation. But there are also things that individuals can do where we do have agency, you know, and make choices about what we allow into our homes, what kinds of platforms we use, what kind of social media we use, whether or not we use encryption, whether or not we have certain kinds of privacy settings. I mean, you can even go to a YouTube video that says, here's how you change the settings in your iPhone to have maximum security and maximum privacy. You know, we can educate ourselves about how to do that, and we can decide, do we want to have something like Alexa listening in, in homes? Do you want to have, um, you know, name a razor, you know, like a men— a man's razor, or a hair dryer. Do these— do we really need one that's connected to the internet? And you can make consumer choices. That's another way of having power. And but we could also, um, secure the things in our own homes. So if we have a device with a default password, which often is password or 1, 2, 3, 4, 5, 6, we can change that and, you know, regularly change it. We could make sure that— and this is a really, really big one. It doesn't sound very big, but it actually is. If everyone updated their software on their laptops or updated their operating system on a phone, that the reason to do that is because, um, constantly there are new vulnerabilities that are discovered and the, the software updates as among other things, patch those vulnerabilities. That we have a great deal of power to do that. And then just educating a lot of times the younger, people are even more educated about this. Like, there has been— there actually has been a lot of training in elementary schools, junior high school, and high school to young people about how to be very careful about who to speak with online, how to not be harassed online, how to have privacy. So they— their privacy literacy is actually fairly high. I think now we're at a time where perhaps security literacy is something that we need to bring into schools more.

Okay, that's, that's nice to know. And, um, Facebook recently said that they're encrypting all of the Messenger app, right? Is that, is that trustworthy to— when you talk about encryption, how easy is that to really encrypt, and what does that really mean for the layperson?

Encrypt any kind of messaging platform that we use, or we could call it messaging software. Mm-hmm. Really, we really should use encrypted software. What that means is that I will write something on my phone, for example, and it gets scrambled so that if it's intercepted in the middle of the network, the person who's intercepting it won't be able to read it. And then it arrives at the recipient's device and becomes unscrambled. So that's basically what encryption is. It's also used for other things such as authenticating that a person is who they say they are. And, um, encryption is something that is an untapped technology in a way. There's no reason why we can't have greater encryption, uh, from a technological standpoint. But regrettably, there are other kinds of values in society that come into tension with that. And governments often push back against really strong encryption because it's necessary for intelligence gathering and law enforcement functions to be able to—

I was going to say there's a downside to that too. If you put too much, then you can't chase anyone down.

Terrorists. How do you chase terrorists?

And, you know, or child molesters. Exactly right.

As always, there's a tension, and so you have to figure out, um, the balance between the two.

Okay, so one last question. Thank you so much for all this. Um, so I just wanted to touch on that idea of consumers. Most consumers would say, why do I care? I'm not doing anything bad. I'm not worried that people know that I need milk, um, and it helps me. And what would you say to these, you know, the usual person who doesn't do anything nefarious and they're— it helps them through their daily lives to pressure these, um, private companies that you say are now responsible? For internet safety?

For someone that is embracing these devices and is embracing technology, I would say to be human is to be technological. And, you know, throughout history we have embraced new technologies, and then once they become enmeshed in our lives, we stop viewing them as technology. It's kind of interesting, like we don't think about the kitchen sink as technology anymore, but at one point that was the height of technology. And it's the same thing with digital communication technologies and the Internet of Things, where I would encourage people to use these but to take serious the privacy and the security and other kinds of safety issues that can crop up in them. Like, raising, raising that awareness, raising that concern, concern is is not at all dystopian. It's actually because these devices are so important for accessibility for disabled people, for education, for communication. And right now in this moment in time where we're all having Zoom calls with, and Zoom Easter services, Zoom Seder, you know, Microsoft Teams business meetings, it's a reminder about how much to the internet has to offer. And it's exactly because this role in our society and in our human lives is so important that we have to get the security and the privacy right and take it seriously.

Do you feel that we're ready for a viral attack or a cyber attack? Are we doing enough? Because that has come up with the COVID crisis. You know, there are articles about this that We're vulnerable. What if Zoom went down? What if the whole internet system went down? My son the other day, he's home from college and he said there was a storm and he said, "If I lose Wi-Fi, I'm going to die," because he's doing his assignments.

The greater vulnerability is the power grid because the internet is only as good as the power grid, which has a lot of points of vulnerability and it's an aging infrastructure. With the internet, it's decentralized. It was designed— the basic switching design called packet switching arose out of the Cold War need to have survivable switching in the case of a nuclear attack. So there's a lot about the internet that is decentralized, but there also are these points of concentration, such as you mentioned Zoom. If that went down right now, that would really affect a lot in the context of COVID-19. If something like Facebook went down, and when it has gone down, that really captures a lot of attention, but they tend to come back up. And, you know, it's always a cat-and-mouse game of something can be taken down but then restored with appropriate backups, with appropriate replication. And, you know, that is not just the case for these large infrastructure companies, but just a reminder to all of us to back up our own data, whether it's in the cloud or whether just on a backup device. We can't take for granted that, uh, we're not gonna lose that data, but if we have the appropriate replication and backup, then we'll be okay.

And in your expert opinion, that leads me to my next question for you. Should I have paper versions of very important things? I'm a minimalist and I got rid of almost all my paper. Couple of years ago.

Well, I'll speak for myself. I, I have most everything in the cloud. And you do? Okay. I have it locally on my devices, but also backed up into the cloud and synchronized between the different devices and backed up electronically. So I'm a big proponent of, you know, being in the digital world. But then there are some things, uh, some important paperwork items that you know, related to home sales, related to birth certificates, related to Social Security cards, passport documentation, in a small safe so that those are preserved in the case of some kind of catastrophic temporary outage.

Okay. And I see a lot of books too, so you keep a lot of books around as well. I love having—

I love having— I love the feel of a book. I read, I read a lot electronically or on my iPad, but I also love picking up a book and reading it.

So to summarize, we can do a lot on a personal level just by changing passwords and keeping track of those kind of things and what comes into our lives.

And keeping ourselves educated about what's necessary in society and what kind of limits we want to put on the collection of data. And, you know, we're— in fact, this moment with COVID-19 is an opportunity to ask, how much privacy are we willing to give up in order to have tracking, for example. So I think we're in a real moment for people to think for themselves about what's more important, how much privacy should be preserved, what should be legal in terms of tracking, even on a voluntary basis. So there are some very difficult questions.

Yeah, I have relatives in South Korea, and they have an app where you can know if somebody COVID positive was in that area, so you can stay away from that area. Right, which people find very helpful.

And Google and Apple are working on apps that do exactly that. So that, you know, social and health upheaval brings up— brings technological upheaval, and it always raises questions. But almost all of the important issues in society are mediated some— in some way in the digital sphere. So I think just educating ourselves about these kinds of policy questions, whether it's whether it's privacy or whether it's how to educate young people about cyberbullying and hate speech, you know, and harassment. Education is a big part of this as well.

And so updating our brains and also updating our software. I love it. When you talk about privacy and legislation, for people who are not very well-versed in that, how do you know who's influencing you? Asking what? Do you just ask your— before you vote what they stand for as far as internet security?

A lot of the politicians have similar positions about privacy, speech, protection of intellectual property rights online. You know, honestly, I'm just saying a lot of them have similar, and there are differences as well. But in the case of the— along party lines, there are some that are along party lines as well. But, okay, but when it comes to the Internet of Things, there has been some very interesting state movement, such as in California, they have privacy legislation that in essence could be the basis for a more national privacy legislation. And in fact, it may not be— and this, I could argue both ways on this, but you could argue that it may not even be necessary to have completely national legislation, because if you have a very, very strong privacy protection in a big state, that covers enough, then most corporations are selling products to that state, and they would probably update their products to comply with that. So if there was one major region or state that had security and privacy requirements for the Internet of Things, such as upgradability, such as encryption built in and security by design, and such as some kind of a principle of minimization of how data is shared, I think that that would have sweeping effects across the country. Okay, great.

And also, uh, don't be scared of all these terms, right? Don't be scared.

You can educate yourself. Really, there's really not anything that, um, that can't be understood. It's just a different terminology. And unfortunately, there are a lot of acronyms, and I hope I didn't use too many acronyms.

No, but your book will also has a lot of tips on how to How to Protect Yourself and to Educate Yourself. It has everything in it.

Thank you very much.

Like each chapter covers so many things, right? I wish we could go chapter by chapter. It's amazing. This was really interesting and I could talk to you forever. And I wonder if you could just elaborate on that one quote that data is people, the Soylent Green analogy.

A friend of mine who is a constitutional law professor at Yale Law School named Jack Balkin, has said that data is Soylent Green, if you remember that sci-fi movie. I love the movie. Because data is us. So the data collected is about what we do in our daily lives, what we do in our personal life, what we do in our economic lives. And then it's taken, it's monetized, and used to serve ads to us. But the basic building block that goes into it is people. And so that's why data is Soylent Green. People behavior.

And Soylent Green was about there being a lack of food, and then people find out that the food they're getting for free, distributed, is actually made of people, right? That's like data. And that's Westworld. Do you watch Westworld?

I do watch Westworld.

I stopped watching, it was so violent, but my son and my husband love it. And then I started thinking about it, and now I want to watch it after having read your because it is about gathering data on people.

And about autonomous technology and robots. And, you know, there are robots, they don't all look human, but there are robots moving merchandise around massive Amazon fulfillment centers. There are robots online that are called bots, you know, that are masquerading as people. There are robots that look like people and are used to keep human beings company or used as sex robots. And these kinds of automated technologies are all around us.

But also, it could be amazing because if somebody knew how to intubate or take care of ICU patients right now with a robot or virtually, we would not risk the healthcare workers' health.

It's an example of how beneficial these technologies are when you think of the healthcare applications.

Mm-hmm. And so Westworld to you is real, step to reality, or is it still far out there. Do they get some of the stuff right?

There is no question in my mind that in our lifetime we will have very lifelike robots that can talk with us and that can fulfill a lot of human jobs. That's why there are so many labor and work implications to the internet and everything. So we will have self-driving cars. And when you think about how many people work in the transportation industry that will have sweeping effects on work, labor, and the ability for people to make a living.

But not to be too dystopian, because we need people to run these robotic things.

The nature, the nature of the jobs will change. They will be, they will require a lot of, you know, digital know-how and creativity and creativity and the ability to design and secure these. And if they just think about driverless cars, that will make— I think it will make driving much safer because there's a lot of, there's a lot of human error. So the security has to be right. You won't have drunk drivers, you won't have distracted driving, and there won't be the tailgating, right? So it could actually, it could create a much better consumer safety environment.

But again, for people out there who are worried about their jobs, I mean, really, they've shown in research that creativity, curiosity, all of these things that are human are what's going to keep humans occupied. And you'll never run out of jobs if you cultivate that.

Excellent. Do you agree? I think that we're not going to run out of jobs. But I think there'll be a great deal of disruption as things that can be displaced by automate, whether robots or autonomous vehicles or cashiers, or, you know, so much is about to be, it is, it is already being replaced. And this is the nature of, you know, history is replete with examples of, you know, one kind of industry. What's an example of a recent industry that has been transformed by technology. Maybe travel agencies. You used to see these on every corner. Mm-hmm. And you know, now you just go online. You, there still are travel agents that are specialized, but so many industries are being disrupted by the cyber-physical world where it's not just about the digital knowledge and transactions, but about physical things that can be automated in some way that used to be done by a human.

And now it's going to be so much faster in the transformation with COVID-19 because they're going to automate so many more things. I expect to see drones delivering things soon.

It's a really interesting question to ask, how will the coronavirus, how will the novel coronavirus change society? And part of that is how will it change technology? I can already imagine I imagine that people will rethink the traveling that they do as part of their jobs, or rethink, you know, what can be done from home for people lucky enough to be in industries that can be done from home. And it will, you know, it will change a lot about— hopefully it'll just be a temporary change where people are not shaking hands and hugging. I can't wait to go back to that environment. But I think it will change the view of technology technology. There's been a lot of dystopian discussions about the internet and digital technologies over the last 5 years, people signing off of social media or trying to, you know, criticize rightly some of the vulnerabilities and problems in technology. But now we are in a moment where we really, really need the technology. And I think that that will change in the short term and people will go back now, maybe not not to the utopian view of 20 years ago where people said it would spread democracy and solve all the world's problems, but maybe it presents an opportunity for a realistic view about what the internet can do and also how important it is to solve the problems that still exist. While we look at the necessity of technology during the coronavirus and beyond, it's a reminder to us that we have to remember that the security of these services, the security of devices, the security of food delivery is— it's cyber-mediated. And so what that means is that cybersecurity is the great human rights issue of our time. We have to get the security of these right in order to continue to reap the benefits of them.

Yes, definitely. Okay. Thank you, Laura.

It's really good to see you. I'm so happy that we met. And, you know, thank you very much for inviting me to your show.

I'm so grateful to you for being here today. That was amazing. And, well, thank you so much.

And most importantly, stay safe.

You too. You too.

Thank you so much for listening and strengthening those neuronal resilience connections in your brain.

I know it's a mouthful.

That's my inner science geek just telling you that you're changing your brain and boosting your resilience just by listening, reflecting, and learning. Email us at info@mindbodyspace.com if you have questions you'd like answered on the podcast or you have guests that you'd like to suggest. Most importantly, please share this podcast with your friends, family, and community. We can all use our brain's chemistry to boost our immune systems and resilience right now. Also email me at info@mindbodyspace.com to sign up for my SMART Programs, stress management and resiliency training, for the first time given completely online. The SMART Program was developed at the Benson Henry Institute for Mind Body Medicine at Massachusetts General Hospital, Harvard Medical School. 40 years of robust research backs this program. Again, that's info, I-N-F-O, at mindbodyspace.com. Looking forward to seeing you. This is Dr. Juna signing off, wishing you and your loved ones wellness.