Tagtrustmark

What I learned from launching a consumer trustmark for IoT

W

Throughout 2018, we developed the Trustable Technology Mark, a consumer trustmark for IoT, that our non-profit ThingsCon administers. As the project lead on this Trustmark, I spent countless hours in discussions and meetings, at workshops and conferences, and doing research about other relevant consumer labels, trustmarks and certifications that might offer us some useful paths forward. I thought it might be interesting to share what I’ve learned along the way.

(Please note that this is also the reason this blog post appears first on my website; it’s because if there’s anything problematic here, it’s my fault and doesn’t reflect ThingsCon positions.)

1) The label is the least important thing

Launching a Trustmark is not about the label but about everything else. I’ve encountered probably dozens of cool label concepts, like “nutritional” labels for tech, “fair trade” style privacy labels, and many more. While there were many really neat approaches, the challenges lie elsewhere entirely. Concretely, the main challenges I see are the following:

  • What goes into the label, i.e. where and how do you source the data? (Sources)
  • Who analyzes the data and decides? (Governance)
  • Who benefits from the Trustmark? (Stakeholders and possible conflicts of interest)
  • How to get to traction? (Reach & relevance)

We’ve solved some of these challenges, but not all. Our data sourcing has been working well. We’re doing well with our stakeholders and possible conflicts of interest (nobody gets paid, we don’t charge for applications/licenses, and it’s all open sourced: In other words, no conflicts of interest and very transparent stakeholders, but this raises sustainability challenges). We don’t yet have robust governance structures, need a bigger pool of experts for reviews, and haven’t built the reach and relevance yet that we’ll need eventually if this is to be a long term success.

2) Sometimes you need to re-invent the wheel

Going into the project, I naively thought there must be existing models we could just adapt. But turns out, new problem spaces don’t always work that way. The nature of Internet of Things (IoT) and connected devices meant we faced a set of fairly new and unique challenges, and nobody had solved this issue. (For example, how to deal with ongoing software updates that could change the nature of a device multiple times without introducing a verification mechanism like reverse engineering that would be too cost intensive to be realistic.)

So we had to go back to the drawing board, and came out with a solution that I would say is far from perfect but better than anything else I’ve seen to date: Our human experts review applications that are based on information provided by the manufacturer/maker of the product, and this information is based on a fairly extensive & holistic questionnaire that includes aspects from feature level to general business practices to guarantees that the company makes on the record by using our Trustmark.

Based on that, our Trustmark offers a carrot; we leave it to others to be the stick.

That said, we did learn a lot from the good folks at the Open Source Hardware Association. (Thanks, OSHWA!)

3) Collaborate where possible

We tried to collaborate as closely as possible with a number of friendly organizations (shout-out to Better IoT & Consumers International!) but also had to concede that in a project as fast moving and iterative it’s tough to coordinate as closely as we would have liked to have. That’s on us — by which I mean, it’s mostly on me personally, and I’m sorry I didn’t do a better job aligning this even better.

For example, while I did manage to have regular backchannel exchanges with collaborators, more formal partnerships are a whole different beast. I had less than a year to get this out the door, so anything involving formalizing was tricky. I was all the happier that a bunch of the partners in the Network of Centres and some other academic organizations decided to take the leap and set up lightweight partnerships with us. This allows a global footprint with partners in Brazil, United States, United Kingdom, Germany, Poland, Turkey, India and China. Thank you!

4) Take a stand

One of the most important take aways for me, however, was this: You can’t please everyone, or solve every problem.

For every aspect we would include, we’d exclude a dozen others. Every method (assessment, enforcement, etc.) used means another not used. Certification or license? Carrot or stick? Third party verification or rely on provided data? Incorporate life cycle analysis or focus on privacy? Include cloud service providers for IoT, or autonomous vehicles, or drones? These are just a tiny, tiny fraction of the set of questions we needed to decide. In the end, I believe that in order to have a chance at succeeding means cutting out many if not most aspects in order to have as clear a focus as possible.

And it means making a stand: Choose the problem space, and your approach to solving it, so you can be proud of it and stand behind it.

For the Trustable Technology Mark that meant: We prioritized a certain purity of mission over watering down our criteria, while choosing pragmatic processes and mechanisms over those we thought would be more robust but unrealistic. In the words of our slide deck, the Trustmark should hard to earn, but easy to document. That way we figured we could find those gems of products that try out truly novel approaches that are more respectful of consumers rights than the broad majority of the field.

Is this for everyone, or for everything? Certainly not. But that’s ok: We can stand behind it. And should we learn we’re wrong about something then we’ll know we tried our best, and can own those mistakes, too. We’ve planted a flag, a goal post that we hope will shift the conversation by setting a higher goal than most others.

It’s an ongoing project

The Trustable Technology Mark is a project under active development, and we’ll be happy sharing our learnings as things develop. In the meantime, I hope this has been helpful.

If you’ve got anything to share, please send it to me personally (peter@thewavingcat.com) or to trustabletech@thingscon.org.

The Trustable Technology Mark was developed under the ThingsCon umbrella with support from the Mozilla Foundation.

Monthnotes for December 2018

M

Featuring the Trustable Technology Mark, ThingsCon Rotterdam, Smart Cities, and a Nordic Progressive Tech Agenda.

If you’d like to work with me in the upcoming months, I have very limited availability but am always happy to have a chat. I’m currently doing the planning for Q2 and Q3 2019.

Trustable Technology Mark

The Trustable Technology Mark launched to great media reports. Now on to sign up companies!

I was incredibly psyched when I received my VaiKai Companion doll and it already shipped with the Trustmark!

The VaiKai Companion is one of the first products to carry the Trustable Technology Mark.

ThingsCon Rotterdam

In Rotterdam, we celebrated 5 years of our annual ThingsCon conference, and oh boy it was a blast. Videos forthcoming; in the meantime, here are some photos. We also have a new website at thingscon.org.

Smart Cities

Thanks to fellow Mozfellow Meghan McDermott and Aspen Institute I got to spend a few days in NYC discussing if and how the principles underlying the Trustable Technology Mark might be useful for the Smart City context. Namely, could they be applied to Smart City procurement or some other mechanism that provides leverage for quality control and for defending citizens’ rights?

A Nordic Progressive Tech Agenda

As part of some work with the good folks at FEPS, I headed on up to Oslo for a workshop with SAMAK and their Nordic allies to discuss what a Nordic agenda for tech and society might look like. So many things to explore there, I’m grateful to be part of this larger conversation.

What’s next?

A hopefully largely flight free Q1 as part of an experiment on more sustainable habits; lots of planning around ThingsCon and the Trustmark; more conversations around a European digital agenda and Smart Cities.

If you’d like to work with me in the upcoming months, I have very limited availability but am always happy to have a chat. I’m currently doing the planning for Q2 and Q3 2019.

Yours truly,
P.

Monthnotes for November 2018

M

This month: Trustable Technology Mark, ThingsCon Rotterdam, a progressive European digital agenda.

If you’d like to work with me in the upcoming months, I have very limited availability but am always happy to have a chat. I’m currently doing the planning for Q2 2019.

Trustable Technology Mark

ThingsCon’s trustmark for IoT, the Trustable Technology Mark now has a website. We’ll be soft-launching it with a small invite-only group of launch partners next week at ThingsCon Rotterdam. Over on trustabletech.org I wrote up some pre-launch notes on where we stand. Can’t wait!

ThingsCon Rotterdam

ThingsCon is turning 5! This thought still blows my mind. We’ll be celebrating at ThingsCon Rotterdam (also with a new website) where we’ll also be launching the Trustmark (as mentioned above). This week is for tying up all the loose ends so that we can then open applications to the public.

A Progressive European Digital Agenda

Last month I mentioned that I was humbled (and delighted!) to be part of a Digital Rights Cities Coalition at the invitation of fellow Mozilla Fellow Meghan McDermott (see her Mozilla Fellows profile here). This is one of several threads where I’m trying to extend the thinking and principles behind the Trustable Technology Mark beyond the consumer space, notably into policy—with a focus on smart city policy.

Besides the Digital Rights Cities Coalition and some upcoming work in NYC around similar issues, I was kindly invited by the Foundation for Progressive European Studies (FEPS) to help outline the scope of a progressive European digital agenda. I was more than a little happy to see that this conversation will continue moving forward, and hope I can contribute some value to it. Personally I see smart cities as a focal point of many threads of emerging tech, policy, and the way we define democratic participation in the urban space.

What’s next?

Trips to Rotterdam (ThingsCon & Trustmark), NYC (smart cities), Oslo (smart cities & digital agenda).

If you’d like to work with me in the upcoming months, I have very limited availability but am always happy to have a chat. I’m currently doing the planning for Q2 2019.

Yours truly, P.

Trust Indicators for Emerging Technologies

T

For the Trustable Technology Mark, we identified 5 dimensions that indicate trustworthiness. Let’s call them trust indicators:

  • Privacy & Data Practices: Does it respect users’ privacy and protect their data rights?
  • Transparency: Is it clear to users what the device and the underlying services do and are capable of doing?
  • Security: Is the device secure and safe to use? Are there safeguards against data leaks and the like?
  • Stability: How long a life cycle can users expect from the device, and how robust are the underlying services? Will it continue to work if the company gets acquired, goes belly-up, or stops maintenance?
  • Openness: Is it built on open source or around open data, and/or contributes to open source or open data? (Note: We treat Openness not as a requirement for consumer IoT but as an enabler of trustworthiness.)

Now these 5 trust indicators—and the questions we use in the Trustable Technology Mark to assess them—are designed for the context of consumer products. Think smart home devices, fitness trackers, connected speakers or light bulbs. They work pretty well for that context.

Over the last few months, it has become clear that there’s demand for similar trust indicators for areas other than consumer products like smart cities, artificial intelligence, and other areas of emerging technology.

I’ve been invited to a number of workshops and meetings exploring those areas, often in the context of policy making. So I want to share some early thoughts on how we might be able to translate these trust indicators from a consumer product context to these other areas. Please note that the devil is in the detail: This is early stage thinking, and the real work begins at the stage where the assessment questions and mechanisms are defined.

The main difference between consumer context and publicly deployed technology—infrastructure!—means that we need to focus even most strongly on safeguards, inclusion, and resilience. If consumer goods stop working, there’s real damage, like lost income and the like, but in the bigger picture, failing consumer goods are mostly a quality of life issue; and in the case of consumer IoT space, mostly for the affluent. (Meaning that if we’re talking about failure to operate rather than data leaks, the damage has a high likelihood of being relatively harmless.)

For publicly deployed infrastructure, we are looking at a very different picture with vastly different threat models and potential damage. Infrastructure that not everybody can rely on—equally, and all the time—would not just be annoying, it might be critical.

After dozens of conversations with people in this space, and based on the research I’ve been doing both for the Trustable Technology Mark and my other work with both ThingsCon and The Waving Cat, here’s a snapshot of my current thinking. This is explicitly intended to start a debate that can inform policy decisions for a wide range of areas where emerging technologies might play a role:

  • Privacy & Data Practices: Privacy and good data protection practices are as essential in public space as in the consumer space, even though the implications and tradeoffs might be different ones.
  • Transparency & Accountability: Transparency is maybe even more relevant in this context, and I propose adding Accountability as an equally important aspect. This holds especially true where commercial enterprises install and possibly maintain large scale networked public infrastructure, like in the context of smart cities.
  • Security: Just as important, if not more so.
  • Resilience: Especially for smart cities (but I imagine the same holds true for other areas), we should optimize for Resilience. Smart city systems need to work, even if parts fail. Decentralization, openness, interoperability and participatory processes are all strategies that can increase Resilience.
  • Openness: Unlike in the consumer space, I consider openness (open source, open data, open access) essential in networked public infrastructure—especially smart city technology. This is also a foundational building block for civic tech initiatives to be effective.

There are inherent conflicts and tradeoffs between these trust indicators. But **if we take them as guiding principles to discuss concrete issues in their real contexts, I believe they can be a solid starting point. **

I’ll keep thinking about this, and might adjust this over time. In the meantime, I’m keen to hear what you think. If you have thoughts to share, drop me a line or hit me up on Twitter.

Monthnotes for August 2018

M

Lots of ThingsCon & Trustable Tech goodness this month.

The State of Responsible IoT 2018

Our (now-)annual ThingsCon report The State of Responsible IoT is out.

It’s an annual collection of essays by experts from the ThingsCon community. With the Riot Report 2018 we want to investigate the current state of responsible IoT. In this report we explore observations, questions, concerns and hopes from practitioners and researchers alike. The authors share the challenges and opportunities they perceive right now for the development of an IoT that serves us all, based on their experiences in the field. The report presents a variety of differing opinions and experiences across the technological, regional, social, philosophical domains the IoT touches upon.

Our contributors are a veritable all-star lineup from around the globe including Christian Villum, David Li, Dries de Roeck, Prof. Dr. Eduardo Magrani, Prof. Dr. Elisa Giaccardi, Ester Fritsch, Prof. Dr. Gaia Scagnetti, Holly Robbins, Iohanna Nicenboim, Prof. Dr. Irina Shklovski, Iskander Smit, Dr. James Pierce, Dr. Laura James, Luca van der Heide, Maya Indira Ganesh, Peter Bihr, Dr. Rachel Douglas-Jones, Dr. Ronaldo Lemos, Prof. Dr. Seyram Avle, Prof. Dr. Silvia Lindtner, and Simon Höher.

Trustable Technology mark

With lots of priceless input from Jason Schultz, the kind help from our partner test companies, and based on feedback from across the ThingsCon network, we’ve managed to hugely streamline the application process for ThingsCon’s Trustable Tech mark—while also making it a lot more robust by putting human experts in the loop.

Current overview presentation from earlier this week:

Media, etc.

Brand Eins interviewed me about IoT and how it challenges our notion of ownership and trust. Details in my blog post here. The text is now available for free (no more paywall).

What’s next?

Trips to Torino for a ThingsCon & Trustmark workshop & to London for Mozfest.

If you’d like to work with me in the upcoming months, I have very limited availability but am always happy to have a chat.

Have a great September.

Yours truly, P.

Monthnotes for June & July 2018

M

Lots of travel and a brief time off means a combined summer-ish edition of month notes for June & July. A lot has happened over the last 8 or so weeks, so let’s dive right in. In no particular order…

Trustable Technology mark

The ThingsCon trustmark for IoT has a name, finally! Meet the Trustable Technology mark, or #trustabletech for short. The URL (trustabletech.com) still forwards to the trustmark page on ThingsCon.com, but will have its own place soon. The most current version of the explainer presentation is up on Slideshare:

What’s more, I’m not alone in this endeavor—far from it! More and more folks from the ThingsCon network have been giving their input, which is priceless. Also, Pete Thomas (University of Dundee) has been taking the design lead and been a great sparring partner on strategy questions, and Jason Schultz (NYU Law) has been thinking about legal and policy implications. A big thank you to Pete & Jason! I’m super excited this is moving along at such a clip.

Going forward, the next steps are to finalize and then test more extensively the checklist for the assessment that’s open for comments in this gDoc. Jason and I also just presented the trustmark at the most recent ThingsCon Salon Berlin (video below), and I’ll be presenting it again at ThingsCon Salon Cologne on August 3rd. (Thingscon.com/events has all up-to-date details.)

Media, etc.

Brand Eins interviewed me about IoT and how it challenges our notion of ownership and trust. Details in my blog post here.

My somewhat eclectic newsletter Connection Problem has completed Season 3 with just over 30 installments. I’m taking a writing break of a few weeks, and then I’ll kick off Season 4 soon. Sign up now if you want to follow along!

ThingsCon

With ThingsCon, we co-signed not one but two declarations and open letters: The Toronto Declaration about AI and human rights (initiated by AccessNow) and the Open Letter to G20 Leaders.

Travel & Events I Attended

I got to join a whole bunch of things those last few weeks.

I thoroughly enjoyed both a workshop on IoT security and market surveillance by Stiftung Neue Verantwortung, where we discussed all things certification, incentives and assessment frameworks; and the always fascinating Museum of the Future workshop in Berlin. I’d been to one in Amsterdam before, and even though I’m spoiled by greatly curated events, the group that Noah & team convene in this context is humbling and fascinating and the only thing I wished is that I could have been there full time, which this time alas wasn’t possible.

In between the two I got to go to New York City for meetings and a quick swing-by at Data & Society, as well as Toronto for the Mozilla Foundation’s all-hands where I was kindly invited to participate as a fellow. Speaking of committed & warm & driven groups!

After that, some family time in the Pacific Northwest, and a short vacation, which included a little road trip through the Cascades. What a stunning & wonderful region!

What’s next?

On one hand I’m gearing up the planning for fall. If you’d like to work with me in the upcoming months, I have very limited availability but am always happy to have a chat.

On the other I’m pretty much heads-down to get the trustmark to the next level. This includes the nitty gritty work of both improving the trustmark assessment tool, and of lining up launch partners. It also means planning a little road show to expose this idea to more eyes and ears, including ThingsCon Salon Cologne, Mozfest, ThingsCon Amsterdam, and a few other events in between. We’re also in the middle of copy-editing the upcoming 2018 issue of the ThingsCon report “The State of Responsible IoT” (#RIoT). More on that soon.

So back to the text mines!

Have a great August.

Yours truly, P.