IEEE Technology and Society Magazine - December 2021 - 108

Soft Law Governance of Artificial Intelligence
the public about commercial and government data
practices and make them aware of what, if any, alternatives
are available to individuals.
Finally, NTIA's stakeholder process should consider
various aspects of risk communication-
meaning the exchange of information, concerns,
and preferences about risks-between the decision-makers
(IoT technology creators) and the
public [71]. Effective communication builds trust,
and with trust people will tolerate certain levels of
risk-provided they also understand the benefits of
their interconnected technologies [72]. Increased
communication also leads to higher accountability,
a goal that " relates to the responsibilities, incentives,
and means for recourse regarding those building,
deploying, managing, and using IoT systems and
services " [73]. Of course, it should be noted that
" [p]oor disclosures, including overly extensive disclosures,
can actually impede consumers' ability to
make informed choices " [66].
Taken together, a document considering each
of these facets would be more all-encompassing
than the 2017 process NTIA engaged in. Currently,
there are few, if any, official guidelines available
to foster trust of IoT devices, and there is little in
the way of regulatory requirements for minimum
security standards. Again, a key component of
building trust is ensuring devices are secure, as
insecure data is the primary way in which user
privacy is likely to be breached. Multistakeholder
collaboration that culminates in the promulgation
of best practice guidelines like those outlined
above can foster trust and mitigate the real and
perceived privacy and security risks of the IoT,
moving us one step closer to a secured, private,
and connected future.
Blockchain
While still early in its development, the blockchain
offers a promising strategy to implement
stronger privacy and security protections for IoT
data. A number of companies and researchers are
investigating using blockchain to allow IoT users and
consumers to better control access to and the integrity
of their IoT data, while still obtaining the many
potential benefits of the IoT [74], [75]. Because
there are many diverse types and purposes of both
the IoT and blockchains, prescribing any one solution
will not be possible, but it may soon be feasible
to identify blockchain protection as a best practice
108
for securing the data on many IoT systems. Soft law
IoT standards should therefore start incorporating
blockchain applications.
A blockchain is a form of distributed ledger in
which the data on the ledger are stored in blocks
of validated and cryptographically hashed transactions
that are immutable. The decentralized nature
of the blockchain has the potential to help address
some of the key concerns about the privacy and
security of IoT data [75], [76]. Most IoT devices
store data in a centralized cloud infrastructure
maintained by the IoT manager. This centralized
storage presents many of the security and privacy
concerns that citizens have about data collection
because they cannot know nor control how their
personal data is being used. As Wharton School
Professor Kevin Werbach eloquently explained:
" What we need is a technology that allows for sharing
without giving up control. Fortunately, it exists.
It is called blockchain " [77].
The consumer whose data is collected and stored
in the centralized database has no control or direct
knowledge of how their data is managed, leading to
concerns (whether real or perceived) that their data
may be sold or used for unconsented applications.
Moreover, the central storage of data creates a single
point of failure in which a hacker could potentially
steal, manipulate, or (in the case of a ransomware
attack) lock the data [75].
The decentralized structure of blockchains aligns
with the decentralized distribution of IoT devices.
A key theme of many blockchain solutions for IoT
data privacy and security is to store the IoT device
data at least initially on the edge (i.e., on the IoT
sensors or " things " ) rather than a central cloud. The
IoT sensors are unlikely to have adequate storage or
computational capacity to store a complete copy
of the blockchain themselves. Instead, one of the
models being investigated is that each " thing " on the
IoT would store its own data and connect to a local
blockchain. Smart contracts running on the local
blockchain would allow the consumer to control
who gets access to their data stored on IoT devices,
and for what purpose [76].
Blockchain offers a number of other advantages
for securing data on the blockchain. The multinodal
nature of the blockchain can be used to verify realworld
data generated by IoT devices and ensure that
the data have not been tampered with or spoofed
[78]. In addition, since data on the blockchain can
IEEE Technology and Society Magazine
IEEE Technology and Society Magazine - December 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2021
