After over two years of controversy, Sidewalk Labs finally presented a 1,500-page draft master smart city plan for a government-owned stretch of Toronto’s eastern waterfront, but critics immediately pointed out it doesn’t include an independent group overseeing all digital innovations or strict guidelines that force proposed projects to de-identify personally identifiable data when collected.
Alphabet Inc.’s subsidiary has gotten an earful in recent months about privacy concerns surrounding the proposed facelift to the waterfront property, said Dan Doctoroff, Sidewalk Labs’ chief executive officer during a press conference Monday.
“Boy, did we hear concerns,” he said, and suggested the right response is the creation of an independent, government-sanctioned Urban Data Trust, that will quell fears among the public and oversee all collection and use of urban data within the smart city. The draft Master Innovation and Development Plan (MIDP) describes urban data as “both personal information and information collected in a physical space in the city, where meaningful consent prior to collection and use is hard, if not impossible, to obtain.”
Sidewalk Labs is proposing a non-profit data trust, but those details, the company said in the MIDP, will be determined based on input from government, the community, and researchers
Meanwhile, Sidewalk Labs proposes to take on the role of lead developer on the 12-acre plot of land at Parliament St. and Queens Quay named The Quayside phase, essentially a test development to prove that they can actually follow through on a proposal this big. Quayside is explored in the greatest amount of planning detail throughout the MIDP, and consists of mixed-use development, video cameras and sensors that would collect urban data. But Sidewalk Labs doesn’t want to stop there – the company and its local partners plan to develop the western part of Villiers Island, which is city-owned land and not part of the existing deal, and make it the home of an expanded Google Canada headquarters.
Leaning hard on a third party to make the major decisions around privacy is a mistake, according to Ann Cavoukian, Sidewalk Labs’ former advisor and current Waterfront Toronto consultant, who spoke with IT World Canada after the document went public. She said Sidewalk Labs needs to have a much stronger influence on these decisions.
“They need to do more. They should be addressing this up front. That’s why they approached me at the beginning of this operation to be their consultant and embed privacy by design into this new smart city. I told them I would be a thorn in their side if they didn’t offer the strongest privacy protections. They said that was okay…and then they walked away from it. That’s what bothers me.”
Cavoukian resigned from her advisory role with Sidewalk Labs last October amid rising concerns that the organization wasn’t going to force companies to de-identify collected personal information at the source. This process is used to prevent a person’s identity from being connected with information gathered by the smart city’s chattering devices.
Sidewalk Labs encourages this philosophy throughout the MIDP and said it will push the yet-to-be created data trust to abide by it as well. But Cavoukian said this actually leaves the door open, even if it’s a tiny bit, for incoming companies to potentially sidestep the rules. The absence of strong language proactively discouraging proposals that suggest they have a good enough reason to ignore de-identification is a problem. Sidewalk Labs executives spoke on background about the data trust and confirmed incoming companies could do their best to convince the trust to be a bit more flexible.
“They would have to make the case that whatever their use is, they don’t think that de-identification is necessary to be privacy protected, but the data trust can totally reject that – that’s the power of the trust,” one executive explained, adding that no phone data is going to be collected by the data trust. Third-party apps, however, may wish to use properly de-identified data for research purposes. The executive emphasized the goal is to make urban data publicly accessible by default, and integrated it into existing open data portals, much like the one currently hosted by the City of Toronto. They want to use data collection to make life more efficient for people living in or passing through the proposed smart city development.
The Canadian Civil Liberties Association (CCLA) warns this proposed oversight strategy is unproven, and in March, published an open letter asking all levels of government to hit the reset button on the smart city project. It also pointed the finger at Waterfront Toronto, suggesting it “exceeded its own powers under its governing statute,” and that they allowed a private enterprise to steer the ship into an “unregulated frontier”.
Waterfront Toronto’s board chair, Stephen Diamond, made it clear in an open letter released June 24 that Sidewalk Labs’ local partner had nothing to do with the MIDP’s creation.
“Waterfront Toronto did not co-create the MIDP,” he wrote, adding that while the potential to address major gaps in housing and public transportation through a smart city remains a compelling outcome, “It is clear that Waterfront Toronto and Sidewalk Labs have very different perspectives about what is required for success.”
In regards to the lingering privacy issues, he wrote, “We will require additional information to establish whether they are in compliance with applicable laws and respect Waterfront Toronto’s digital governance principles.” Diamond also expressed reservations about Sidewalk Labs’ proposal to be the lead developer of Quayside. “Should the MIDP go forward, it should be on the basis that Waterfront Toronto lead a competitive, public procurement process for a developer(s) to partner with Sidewalk Labs.”
And while Cavoukian said she is confident in Waterfront Toronto’s ability to prioritize privacy by design during the consultation process, another major problem is the fact that the data trust doesn’t currently exist.
“[Sidewalk Labs] had 18 months to produce one, surely they could have pulled together the parties by now, and then have Waterfront Toronto approach those parties, and say ‘Glad you’re joining us but here are the terms. You must de-identify data at the source.” If the parties don’t want to do it they don’t join.
“It’s not privacy versus the interests of the city and the data that is needed – you can do both, you must do both. That’s why you have to do it proactively up front.”
Don’t forget about security
Details around the security infrastructure protecting Toronto’s neighborhood of the future are vague, but the MIDP does point to the use of software-defined networks across the smart city as a means to provide the area with greater coverage across waterfront as well as heightened security. Software-defined network technology makes network performance and monitoring feel a bit more like cloud computing than traditional network management, which is why it’s increasingly becoming a go-to solution for emerging smart city projects. This type of network also knows what kind of data a device is supposed to be transmitting, so it would be able to detect if any of them are compromised.
The MIDP said Toronto has more than 11,000 devices mounted to public infrastructure, including Wi-Fi access points, cellular nodes, environmental sensors and traffic cameras. Installing these devices usually leads to major disruptions to street life because they were never designed to host digital hardware. Sidewalk Labs said it has designed a standardized mount called “Koala” that would make it fast, inexpensive, and safe to install a device on a light pole or other street fixture by providing a sturdy physical mount, power, and network connectivity.
David Masson, Canada country manager for cybersecurity firm Darktrace, described the smart city project as a “large-scale experiment” that cannot afford to leave the security decisions to the end of the development cycle. He foresees artificial intelligence technology playing a big role in the dissemination of the gathered urban data, a task that will become increasingly difficult for human beings to tackle due to the proliferation of connected devices. Statista projects that in one year, the number of Internet of Things connected devices will jump by 4 billion to approximately 30 billion. By 2025, that number is expected to hit 75 billion.
Masson said he was intrigued by Sidewalk Labs’ decision to go with a data trust concept. It’s something large corporations would normally steer clear from.
“Up until a few months ago, companies like this wouldn’t have considered that. I thought it was an interesting idea.”