We are delighted to have Dr. Marguerite Nyhan as a guest speaker on Tuesday 11th October at 4pm, Iontas Building, room 2.31 for the first of our Programmable City seminars this academic year 2016/17.
Dr. Marguerite Nyhan is a Post-Doctoral Researcher at Harvard University, based in the Department of Environmental Health. Prior to her current appointment, she led the Urban Environmental Research Team at Massachusetts Institute of Technology’s Senseable City Laboratory. Marguerite holds a PhD in Civil & Environmental Engineering from Trinity College Dublin. During her PhD, she was a Fulbright Scholar at MIT. Marguerite has spoken widely about her research including addressing the United Nations Environment Assembly in Kenya, and TEDx Dublin. She has also lectured in the Department of Urban Studies & Planning at MIT.
Marguerite will be talking about modeling and predicting interactions between human populations, urban systems, the natural environment and the built environment.
Rob Kitchin and Gavin McArdle have published a new Programmable City working paper (no. 21) – Urban data and city dashboards: Six key issues – on SocArXiv today. It is a pre-print of a chapter that will be published in Kitchin, R., Lauriault, T.P. and McArdle, G. (eds) (forthcoming) Data and the City. Routledge, London..
Abstract
This chapter considers the relationship between data and the city by critically examining six key issues with respect city dashboards: epistemology, scope and access, veracity and validity, usability and literacy, use and utility, and ethics. While city dashboards provide useful tools for evaluating and managing urban services, understanding and formulating policy, and creating public knowledge and counter-narratives, our analysis reveals a number of conceptual and practical shortcomings. In order for city dashboards to reach their full potential we advocate a number of related shifts in thinking and praxes and forward an agenda for addressing the issues we highlight. Our analysis is informed by our endeavours in building the Dublin Dashboard.
Smart city solutions utilise complex, networked assemblages of digital technologies and ICT infrastructure to manage various city systems and services. Any device that relies on software to function is vulnerable to being hacked. If a device is networked, then the number of potential attack points multiples across the network, and the hack can be performed remotely (1). Once a single device is compromised, then the whole assemblage becomes vulnerable to cyberattacks that seek to ‘alter, disrupt, deceive, degrade or destroy computer systems and networks or the information and/or programs resident in or transiting these systems or networks’ (2).
There are three forms of cyberattack: availability attacks that seek to close a system down or deny service use; confidentiality attacks that seek to extract information and monitor activity; and integrity attacks that seek to enter a system to alter information and settings (such as changing settings so that components exceed normal performance, erasing critical software, or planting malware and viruses) (3). The vulnerability of smart city systems is exacerbated by a number of issues including weak security and encryption; the use of insecure legacy systems and poor maintenance; large and complex attack surfaces and interdependencies; cascade effects; and human error and disgruntled (ex)employees (19). The result is that the process of making city systems and infrastructures ‘smart’ has also made them vulnerable to a suite of cyber-threats (4,5,6).
Cyberattacks can target every type of smart city solution and particular system components. There are a number of weak points – including SCADA systems, the sensors and microcontrollers of the Internet of Things, and communication networks and telecommunication switches.
SCADA systems
Various forms of urban infrastructure, including the electricity grid, water supply, and traffic control, rely on SCADA (supervisory control and data acquisition) systems that are used to control functions and flow (4). These systems measure how an infrastructure is performing in real-time and enable either automated or human operator interventions to change settings. SCADA systems can be traced back to the 1920s, but were extensively rolled out in the 1980s (12). As a consequence, many deployments are quite dated. Many have been found to operate with their original security codes (13). In some cases, while the infrastructure is relatively secure, the communications network is vulnerable (4). A number of SCADA systems have been compromised, with hackers altering how the infrastructure performs, or causing a denial-of-service, or have stolen data. Probably the most infamous SCADA hack was the 2009 Stuxnet attack on Iran’s uranium enrichment plant in which the system was infected by malware that destroyed a number of centrifuges by running them beyond their design specifications (12). By 2010 over 90,000 Stuxnet infections were reported in 115 countries (5).
Internet of Things
The Internet of Things refers to the connecting together of machine-readable, uniquely identifiable objects across the Internet. Some objects are passive and can simply be scanned or sensed (such as smart cards with embedded RFID chips used to access buildings and transport systems). Others are more active and include microcontrollers and actuators. All kinds of objects that used to be dumb, such as fridges, thermostats and lights, are now becoming networked and smart, generating information about their use and becoming controllable from a distance. Moreover, sensors can be embedded into the urban fabric and throughout critical infrastructures to produce data concerning ‘location, proximity, velocity, temperature, flow, acceleration, sound, vision, force, load, torque, pressure, and interactions’ (13). Sensors and microcontrollers are hackable as they often have little effective security, encryption, or privacy protocols in place. RFID chips, for example, can be hacked, jammed and spoofed (13).
Communication networks and telecommunication switches
The Internet of Things are linked together via a number of communications technologies and protocols such as 4G LTE (Long Term Evolution), GSM (Global System for Mobile communication), CDMA (Code Division Multiple Access), WiFi, bluetooth, RFID (Radio-Frequency Identification), NFC (Near-Field Communication), ZigBee (open wireless standard), and Z-Wave (wireless communication). Each of the modes of networking and transferring data are known to have security issues that enable data to be intercepted and provide access to devices. Likewise, telecommunication switches that link together the local and long distance Internet infrastructure are known to have vulnerabilities including manufacturer and operator back-door security access and access codes that are infrequently updated (4).
Transport management systems and vehicles
There have been a number of cyberattacks on transport management systems in recent years, as well as proof-of-concept demonstrations of possible attacks. For example, a cyberattack on a key toll road in Haifa, Israel, closed it for eight hours causing major traffic disruption (9). A research team from the University of Michigan managed to hack and manipulate more than a thousand traffic lights in one city using a laptop and wireless radio (15). Likewise, IOActive Labs have hacked traffic control sensors widely used around the world and altered traffic light sequencing and interactive speed and road signs (16). A teenager in Lodz, Poland, managed to hack the city tram switches, causing four trams to derail and injuring a number of passengers (1, 13). In the US, air traffic control systems have been hacked, FAA servers seized, the personal information of 58,000 workers stolen, and malicious code installed on air traffic networks (13). Vehicles themselves are also open to being hacked given that a new car contains up to 200 sensors connected to around 40 electronic control units and can connect to wireless networks. A recent Wired article details how two hackers were able to remotely hack a car through its Internet computer that controls entertainment and navigation systems, facilitates phone calls and can provide a wifi hotspot, using it as a route to replace firmware that enabled them to take control of the car’s internal computer network. The hackers could then take over the driving of the car from over 10 miles away, turning the driver into a passenger (17).
Electricity grid and smart meters
The generation, transmission, and distribution of electricity are monitored and controlled using SCADA systems (12). In addition, the electricity grid consists of a range of other networked devices. In the case of the US energy grid over 70 percent of components are over 25 years old, including many SCADA systems (13). Given the potential cascade effects of shutting down the electricity grid, it has been a key point of cyberattack. Electricity grid utilities in the US report being under near constant cyberattack, with one utility recording that it was the target of approximately 10,000 cyberattacks each month (all five commissioners of the Federal Energy Regulatory Commission agree that the threat of a cyber-attack on the electric grid is the top threat to electricity reliability in the United States) (8). The Israel Electric Corp. reports that its servers register about 6,000 unique computer attacks every second, with other critical infrastructure also under continuous cyberattack (9). As smart grids and smart meters are installed, the number of potential access points to grid networks increases enormously (12). Smart meters themselves can be hacked with low-cost tools and readily available software to alter proof of consumption or to steal energy from other users (1, 14).
Building management systems
Building management systems are often considered an aspect of property services rather than IT services and cybersecurity is not a key issue in purchase or operation (18). The consequence is weakly protected systems, often still configured with manufacturer codes. Moreover manufacturers often do not have processes in place for responding to vulnerabilities or a notification process to inform customers about security threats (18). The vulnerabilities of building management systems pose two main threats. The first is that if they are hacked building operations could be disrupted and safety risks created. The second is that they provide a potential route for breaking into enterprise business systems and critical company data if they share the same network. In the case of the Target data breach in which over 100 million customer details were stolen it appears that the retailer did not properly segment its data network, with hackers gaining access through the company that maintained its heating, ventilation and air conditioning (HVAC) system (18).
Cameras
Cities are full of a plethora of CCTV cameras; some owned and controlled privately, others by public authorities and police services. The security of these cameras is highly variable, with some lacking encryption or usernames and passwords, and others open to infection by malware and firmware modification (20). Accessing a camera provides a means to spy on individuals, such as viewing home presence or using a bank ATM camera to monitor the digits being pressed. Demonstrating the scale of the issue, one website provides access to the feeds of thousands of unsecured or poorly secured cameras (uses admin passwords) from 152 countries (21). Cameras can also be turned off, with some lacking the function to be restarted remotely (19).
Many cyberattacks are relatively inconsequential, such as probes and address scans, and are unsuccessful, while a small number are much more significant and involve a security breach. In a 2014 study of 599 utility, oil and gas, energy and manufacturing companies nearly 70 percent reported at least one security breach that led to the loss of confidential information or disruption of operations in the previous 12 months; 78 percent expected a successful attack on their ICS (industrial control systems) or SCADA systems in the next two years (10). In 2012, 23 gas pipeline companies were hacked and source code and blueprints to facilities stolen (7). Between 2010 and 2014, the US Department of Energy (that oversees the US power grid, nuclear arsenal, and national labs) documented 1,131 cyberattacks, of which 159 were successful (11). In 53 cases these attacks were ‘root compromises’, meaning that the attackers gained administrative privileges to computer systems, stealing various kinds of personnel and operational information (11).
Cyberattacks can be performed by hostile nations, terrorist groups, cyber-criminals, hacker collectives, and individual hackers. Former FBI director, Robert Mueller, details that 108 nations have cyberattack units, targeting critical infrastructure and industrial secrets (13). The majority of attacks are presently being repulsed using cybersecurity tools, or their effects have been disruptive or damaging but not critical for the long term delivery of services (3). Indeed, it needs to be recognised that to date, successful cyberattacks on cities are still relatively rare and when they have occurred their effects generally last no more than a few hours or involve the theft of data rather than creating life threatening situations. That said, it is clear that there is a cybersecurity arms race underway between attackers and defenders, and that more severe disruption of critical infrastructure has been avoided through the threat of mutually assured destruction between nations (22). This is not to suggest that smart city initiatives should be avoided, but rather that the cybersecurity challenges of creating secure smart cities should be taken seriously. It is likely that cyberattacks will increase over time, they will become more sophisticated, and that they have the potential to cause significant disruption to city services and the wider economy and society (5).
Two of the plenary sessions at this year’s Association of American Geographers meeting in Chicago (April 21-25) — Heidi Nast’s Dialogues in Human Geography forum and Paul Robbins’ Progress in Human Geography lecture — examined in broad terms the relationship between fertility rates, population, the changing nature of work, and the future of capitalism. Interestingly, fertility seems to be the forgotten focus in the discipline of demography and population the forgotten field in human geography. However, both sessions called for a renewed focus, not with respect to population growth over the next couple of decades, but the longer run fertility rate and population decline due to take place in the second half of the century. In both cases, an argument was made regarding the consequences concerning the functioning of capitalism and the health and wealth of society. Both talks also folded in an analysis of work and production — in Paul’s case types of employment in India and in Heidi’s automation (in a loose sense as much of her talk concerned the development of sex robots in the context of a crisis of masculinity, social alienation, and falling fertility) — and its spillover effects for lifestyle and consumption.
Parsing between the two talks, my sense of the argument starting to be formulated runs in a broad sense thus. Fertility rates have been falling globally and by 2050 will be below replacement rate in the vast majority of countries with the exception of sub-Saharan Africa. At this point, the dependency ratio will be very high and growing (ratio of older people to working population), and the global population will peak in the latter part of the century and start to decline at roughly the speed it is growing at present, with this occurring earlier in countries that presently have a low fertility rate. As such, the market for consumption of products and services will start to plummet, especially in the West. Moreover, the increasing growth of automation of work (pretty much any work that involves formalised knowledge (e.g., law, medicine, finance) or practices (manufacturing) is set to speed up markedly (Gartner, for example, predict a third of all jobs could be automated by 2025) meaning that labour will become more precarious, less skilled, and less well paying, meaning widening inequalities and decreasing incomes across lower and middle class households.
In combination, reducing population, shrinking cities, a high dependency ratio, widening inequalities, rising labour precarity and falling incomes will create a fatal crisis for capitalism. Think Detroit and the rustbelt but on a grand, global scale – cities and the production of goods and services scaled for 9-10 billion, but with waged labour highly precarious and a shrinking population and market base. In other words, whilst attention is presently focused on the issue of rapid global population growth, rural-to-urban migration, resource conflicts and climate adaptability, it is the crisis that follows that will be truly challenging because it signals the end game of a form of political economy that is reliant of constant growth, new markets, and consumers who can afford to consume. In other words, in its present pursuit of profit and accumulation, capital is creating the conditions to systematically starve itself.
Capitalism has always been vulnerable to crises, but they tend to be short, sharp shocks, whereas population decline and automation will be long-term systemic challenges. I think there’s some interesting ideas here that are worth fleshing out and thinking through. It’ll be interesting to see if people start to pick up on them and how the debate — and society — develops.
We are delighted to welcome Mark Maguire to The Programmable City project on Wednesday 25th February, 4-6pm in room 2.31, Iontas Building, Maynooth University. This is the fourth of our Programmable City seminars this academic year. Mark is a lecturer in Anthropology at Maynooth University. His research focuses on the areas of migration and security. He is concerned with exploring international migration through ethnographic research on everyday lives and the technologies and processes of securitization, especially counter-terrorism, biometric security, affective computing and the detection of abnormal behaviour and ‘malintent’. Mark is author of Differently Irish (Woodfield Press 2004), which explores the lives of Vietnamese refugees and their families, and, with co-author Fiona Murphy, Integration in Ireland: the everyday lives of African migrants (Manchester 2012). Mark is co-Editor of Social Anthropology/Anthropologie Sociale.
We’re pleased to announce the advertisement of a three year postdoc position on the Programmable City project. Full details of the project can be found on the Maynooth University HR page, but essentially the post will study algorithms and code used in smart city initiatives (broadly conceived) from a software studies perspective. As such, the project will critically examine how software developers translate rules, procedures and policies into a complex architecture of interlinked algorithms that manage and govern how people traverse or interact with urban systems. It will thus provide an in-depth analysis of how software and data are being produced to aid the regulation of city life in an age of software and ‘big data’. The primary methods will be a selection from those set out in the paper ‘Thinking critically about and researching algorithms’.
We are seeking applications from researchers with an interest in software studies, critical data studies, urban studies, and smart cities to work in an interdisciplinary team. Applicants will:
have a keen interest in understanding software from a social science perspective;
be a proficient programmer and able to comprehend other developer’s code;
have a good, broad range of qualitative data creation and analysis skills;
be interested in theory building;
have an aptitude to work well in an interdisciplinary team;
be prepared to undertake overseas fieldwork;
have a commitment to publishing and presenting their work;
have a willingness to communicate through new social media;
be prepared to archive their data for future re-use by others;
be prepared to help organise and attend workshops and conferences.
The closing data is 5th December. See the full job description here for more details.
We would encourage any interested candidates to apply for the post and for readers of the blog to bring the post to the attention of those who you think might be interested, or circulate in your networks/social media.
