IoT's Threat to Free Speech

There's a lot of buzz surrounding the Internet of Things (IoT). It's been heralded as a new Industrial Revolution (that would be #4, if you're counting). It's also been labeled a possible threat to national security. While I actually believe both of these to be topics of merit and worth much additional discussion, I'm actually most concerned at this point in our history of the IoT posing the first legitimate threat to free speech we've seen in the Internet Era.

The Internet is an Equalizing Force

If you consider the raw power of the Internet as an equalizing force, much of its impact is derived from way it has fundamentally transformed the way we communicate. The ability to suppress dissonant opinions has, for most of the world, been eliminated. Information in the form of text and even video can be instantly distributed to an audience of millions. That has not only empowered the individual, it has greatly expanded the reach of existing broadcasters and news outlets - a local community's newspaper can now theoretically reach the same audience that was previously untouchable by all but the likes of CNN, Reuters, etc.

Unfortunately, there is a fundamental flaw in the system that can, for the first time in history, be exploited with remarkably little expense or effort. Every publisher of information, while exponentially more powerful than before, is still completely dependent on the fact that their publication "lives" at a domain name (such as cnn.com) and an associated network of servers (from a single server to a robust content delivery network). And while these networks are often taken for granted, they are universally vulnerable to a type of attack called a Distributed Denial of Service (or DDoS).

What is DDoS?

A DDoS attack can be characterized as such:

1. An attacker uses their own network of compromised devices (infected with malware) to simultaneously request information from your website or webserver.
2. Your webserver attempts to respond to every request - but in the process, it or another component in the network is simply overwhelmed. Imagine you (the webserver) are standing behind a podium in front of an enormous audience and thousands are shouting bogus questions at you, each expecting a response (and if you don't respond, they simply shout again).
3. In being overwhelmed by the massive number of bogus requests, legitimate requests go unanswered. Effectively, your server has been rendered mute - you're offline.

There are plenty of variations of the above, including the ability to greatly amplify the attack volume by essentially making a lopsided request - think of a short question that requires a long answer before you can move on to the next question.

How does it affect a website?

Recently, a security researcher and investigative journalist wrote a story about a couple of "entrepreneurs" running a network of compromised machines (a botnet) and offering a "DDoS-as-a-Service" business, if you will. The story resulted in their arrests, and as retaliation, the first of this new trend in massive IoT-fueled DDoS attacks was launched. It measured a whopping 620Gb/s - to put that in perspective, imagine we printed the requests on paper. That would require 4,000 trees per second, or around 80 trucks per second.

Since then, the 1Tb/s threshold has been crossed multiple times - and attributed to a botnet of roughly 150,000 compromised IoT devices. Multiple European media outlets have been targeted, and most recently, the Dyn DNS service was hit - which impacted even the likes of Facebook and Twitter.

Gartner projected 6.4 billion devices connected to the Internet in 2016;

HP says 70 percent of "things" are vulnerable to hacking.

The Tip of the Iceberg

If Facebook and Twitter are unavailable to large parts of the world when under attack by a small fraction (0.002%) of IoT devices in the wild, what does the rapid adoption of these devices mean? I've seen estimates from 30 billion Internet-connected "things" by 2020, up to 75 billion - and each year, the projections seem to get higher.

If only 10% of 5 billion devices are amassed into a single botnet, they could launch an attack (without amplification) 3,000 times larger than the attacks we've seen this week.

Imagine a DDoS attack of 3 petabits per second.

No content delivery network - no network, period - could sustain that sort of focused traffic and stay online. The impact wouldn't be limited to fewer social media posts - it would effectively cut off the channels of communication and free speech that we've grown accustomed to.

Whoever controls such a botnet would wield the power to silence any publication, news outlet, or dissonant at any time - with no technical solution or remedy.

I admit that I don't have a solution. This post is the equivalent of waving a flag or firing a flare. I know the eventual solution will be a combination of securing the IoT and also implementing policy and technology safeguards. I also know we must do all we can to preserve the world's most accessible forum for free expression: the Internet.

About the Author:

Mike McTaggart is a Digital Transformation Leader with an engineering mind, a passion for technology, and a commitment to integrity. He has led software, sales, marketing, and content generation teams from 5 to 50+, and has helped dozens of organizations - large and small - realize the potential that technology brings to business. He has a reputation for thoughtful, measurable, and strategic leadership through change and uncertainty. In an age of digital transformation, Mike can help you craft the strategy, build consensus, and produce actionable data-driven plans to cut through all the noise.