Read the original article here.

According to the government, 14bn objects are already connected to the internet, 40m of them in the UK. By 2020, it could be as many as 100bn worldwide. This huge surge in the amount of data being shared wirelessly is increasing both the opportunities and the risks for public services.

Making more objects “smart” can increase efficiency by paving the way for public services such as internet-enabled bins and traffic lights. But the potential for data breaches in the public sector will only get worse with the adoption of the internet of things. It is a major concern for the public sector because of the sensitive and personal information it handles, such as NHS patient records.

Data breaches already continue to hit the public sector. In March 2015, the Serious Fraud Office was hit with a £180,000 fine after a witness in an investigation was accidentally sent evidence relating to 64 other people involved in the case. The same month, North Tees and Hartlepool NHS Foundation Trust was ordered to review its data protection policy after a file containing sensitive patient information was found at a bus stop.

Exposing even more publicly held data on individuals could be devastating. Private medical records might reveal information such as mental health issues that could impact people when they apply for jobs; data might be used by hackers to bribe individuals in ransom attacks; and there are potentially deadly implications if hackers tampered with, or deleted important medical information, such as blood type.

“This is a business issue for the public sector,” says Mark Thompson, director at KPMG’s cyber security practice. “In order to make [the internet of things] valuable, you have marketing, finance and IT all interacting with data. IT can create the best network in the world, but when an organisation is sharing information between departments, there is always the chance that something can go wrong.”

The government is trying to understand the scope of internet-connected devices as well as the security issues they raise. The government chief scientific adviser’s report in 2014 said everyone involved in the internet of things should be constantly anticipating and preventing problems, rather than dealing with unforeseen consequences in retrospect.

Collecting and using data identifying individuals is regulated by existing legislation such as the 1998 Data Protection Act, which covers the internet of things, and the Information Commissioner’s Office (ICO) has published guidelines on issues such as the transmission of encrypted or unencrypted data; default settings for devices; and information handling responsibilities for organisations capturing and transmitting data from internet-connected devices.

Security transformation
Much concern focuses on personal data. This could be any piece of information, such as an ID number, that identifies an individual. Ensuring personal data is anonymous and complies with data protection regulation poses a mammoth task for the public sector.

Context is important when categorising data, says Andrew Paterson, the ICO’s senior technology officer. The name John Smith, for instance, isn’t considered personal data as it wouldn’t identify an individual on its own.

If another piece of information is added, however, such as a national insurance number or credit card details, the data becomes personal. In the event of a breach, it could then potentially be used for fraud and identity theft – or even sold to cyber criminals who exchange such details for cash.

Complicating the issue further, an amendment to EU data protection regulation means companies – and probably governments – can in future be fined a percentage of their turnover if they suffer a data breach.

The update will also require individuals to give much more informed and explicit consent for the use of data. But even this is ambiguous: consent can be withdrawn, says Richard Kemp, an IT law expert. “If consent has been given, it is for the use of data for a specific purpose. Data protection rules say it can not be used by anything incompatible with that purpose.”

Preparation
Central government has already made changes to the way it handles IT, with a significant move away from IT being primarily bought on a department-by-department basis. Services have been centralised and simplified with the foundation of the government digital service (GDS) and the idea of government as a platform. This means that by designing government services in blocks that do one job each, it’s easier to fix them, upgrade them, share them and scale them up. But there is still a shortage of IT professional skills in public services and security experts think the internet of things creates bigger challenges as it requires that data is shared as much as possible – while at the same time remaining confidential.

The internet of things also requires the public sector to replicate standards across larger, sometimes disparate organisations. “One part of the public sector doesn’t want to be setting a standard that isn’t replicated elsewhere,” says Kim Walker, technology partner at law firm Thomas Eggar. “Security has to be built in and that applies to the supply chain as well. Every time data is transferred, there is an opportunity for it to leak.”

Walker also says UK public sector bodies need to consider the implications of transferring data overseas. Previously public sector data tended to site on UK servers, but in a global world of internet-connected things, data could move to other countries.

Good groundwork is essential for any public sector project involving the internet of things. The ICO’s Paterson says the risks and benefits should be carefully examined before launch. “We recommend organisations perform a privacy impact assessment where they look at transparency and fairness, and not over-collecting data,” he says, pointing to the ICO’s guidelines on anonymity and big data.

Not all aspects of security are alien to the public sector. Some elements of this new IT world, such as the necessity to report a breach, will not require much adjustment. Public bodies such as the NHS are accustomed to reporting breaches.

As new regulation comes into place, it is likely the public sector will continue to suffer ICO fines. Stewart Room, a partner at PwC Legal, says other methods, such as compulsory audit, are a better route to ensure that having more devices connected to the internet will not result in huge security breaches.

Room adds: “The ICO has the power to carry out data handling and security audits and it seems that those are having a positive effect on practices within the public sector.

“When we get the new regulation, we could see a boom in fining, but after a few years it will settle down and be more about auditing and checking than about punishment.”