Blogs

Smart cities – they may be smart but are they secure?

As the UK starts to get smart with the roll-out of smart meters and a plethora of local council initiatives, Rob Miller, a senior security researcher at MWR InfoSecurity, looks at other smart cities around the world to see what lessons can be learned before we become too smart and get burned.

In 2010 the European Union chose the Spanish city of Santander as a test bed for smart city technology. A whole host of smart city technology was implemented. Some systems monitored the levels of rubbish in dumpsters to optimise rubbish collection. Other systems dimmed street lights when it did not detect pedestrians. As a collective result of these and other smart city systems, Santander claimed to have reduced energy usage by “as much as 25%”

Smart city technology can also be used to benefit cities in other areas. In Amsterdam and Dublin, publicly accessible databases have been set up that share information collected from smart city technology. Information like where parking spaces are available in real-time, the levels of rain fall and current traffic conditions are all collected and shared. The goal is for entrepreneurs to come to the city and create products that use this data. In this way smart city technology is being used to promote new business, whilst improving services for its citizens.

Smart lessons
However, smart city technology is not without its risks to both councils and manufacturers.

In 2012 in Malta it came to light that organised crime had compromised Malta’s smart meter system. While these meters were being used to measure energy usage of homes, and bill customers accordingly, it was found that the meters had been tampered with causing them to under charge. According to the Malta Independent, the total cost to the tax payer of the scam amounted to around £26 million.

A further concern is how Councils handle the public’s information.

In London in 2013 smart bins were introduced that would display adverts based on who was walking by. This was accomplished by tracking the unique identifiers of smartphones. The company called it a cookie for the real world. Unfortunately they did not inform the public about how they were tracking them and so, after public outcry, the bins were removed to the cost of the developer.

Smart times
Smart cities represent a great potential benefit, but given the amount of investment required to implement these systems safely and securely, they should definitely not be seen as a quick win.

Smart city solutions are likely to be designed to run for tens of years to recoup the investment, and this means getting security and privacy concerns right first time is a must. IoT devices are a core component to smart cities, allowing systems to collect data wirelessly across the city using small, low powered devices. We need to take the time to include security requirements early in the process to help keep the risks and costs to a minimum, and also to give a clear picture of whether it is profitable to enter this space.