Regulatory Environment

Disruptive Business Models

The major challenge of disruptive innovation is that existing markets and market-dominant practices are socially and economically embedded within wider society. Hence disruptive innovation while potentially creating new value for some also has the potential to drive adverse economic consequences for firms and individuals linked to the previous system (Dorrell, 2018). For example in the previously discussed Amazon Go scenario, a key question that is debated increasingly is whether the cobots, AI and Industry 4.0, will supplement human labor and liberate workers from mundane tasks and have humans focus more on tasks that demand executive skills, or conversely, supplant certain types of professions and employees such as cashiers in retail stores, or those earning a living driving taxis and trucks, who might potentially be replaced in the future by automated checkouts and autonomous vehicles (Berger., 2018).

There are other IoT based innovations that are not accomplished by businesses but by users seeking to satisfy their own needs, such as the real-time glucose monitor initially developed by a private community of diabetes patients and developers. This kind of “free innovation” introduces another type of a business model involving people who are not innovating for profits (Zhoudan Xie & Mark Febrizio , 2018).

Historically, policymakers have tried to unsuccessfully “regulate” disruptive innovations in two ways. The first seeks to preserve or protect existing practices through regulation, this approach has been taken by some jurisdictions responding to ride-sharing platforms for instance the ban on Uber in Queensland (Barnett & Barnett, 2016). These jurisdictions are those which previously had strongly regulated or monopolized taxi industries and thus strong pressure from interest groups to preserve existing markets. In many places where this regulatory approach was first attempted, governments have been forced to relent and change the approach after failing to achieve meaningful compliance (Department of Transport and Main Roads, 2018).

The second approach is equally ineffective and driven by market logic it favors allowing disruption to alter markets with little regulatory oversight (Lepore, 2014). The reasoning here is that disruptive innovation represents a form of progress and thus is inevitable (Lepore, 2014). From this perspective those who suffer the economic ‘collateral damage’ are simply an unfortunate consequence of the survival of the fittest in a competitive market and should seek to adapt to the new markets or find employment in other sectors.

There is a reasonable argument that certain forms of disruptive change are inevitable or at least impossible to prevent once on the market, hence protectionist responses are unlikely to be effective. Instead regulators should acknowledge the potentially corrosive impacts of disruptive innovation and take a transitionary perspective towards existing markets (and individuals) likely to be affected. Thus, the middle ground approach must consist of three aspects:

• Preserving and enforcing the public good aspects of existing regulation (e.g. taxation, employee rights, health & safety).
• Recognizing that disruptive innovation is happening and encouraging it in an orderly and well-regulated way.
• Recognizing that disruptive innovation creates ‘collateral damage’ and that unchecked, this can be highly societally corrosive. This can be responded to by a transitionary approach in affected sectors.

When it comes to regulators adopting and using IoT for delivery of services to businesses, while the value proposition of IoT for government to business services is evident the business model is unclear. The business models for IoT within the government to business space aren’t fully established. There are significantly higher number of applications being developed and implemented particularly in areas such as Smart Cities where IoT is being projected as a competitiveness differentiator to create an attractive and competitive economy. These are typically more relevant in the government to consumer/public domain where cities for example deliver services directly to citizens. In most of these cases, city governments invest in the technologies and, in some instances, engage the private sector to participate in the delivery. However, there are limited applications and mostly in the pilot stages where IoT is being used as a means to improve regulatory compliance while reducing burden on businesses largely due to a lack of clarity on the business models and regulatory motivation (World Bank, 2017).

Ethics and Equity

Social behavior and appropriate use become even more crucial in an increasingly interconnected environment created by IoT that links devices, systems, data, and people. At its best, the IoT has the potential to create an integrated ecosystem that can respond to a spectrum of needs, increasing efficiency and opportunity and empowering people through technology, and technology through intelligence. At its worst, the IoT can open a Pandora’s Box of inappropriate and unsafe behavior, unintended consequences, and intrusiveness (Berman, 2017).

Research that evaluated case studies ranging from a smartphone and an activity tracker (Fitbit) to an intelligent personal assistant (Alexa, Siri), a chatbot (Microsoft’s Tay), a self-driving car (Tesla, Google-Waymo) to a self-service checkout showed that “things” informed by algorithms and/ or AI gain new skills they have not had before. With this, they acquire a new form of agency, new ways to act and to make decisions (Bunz, 2018). Examples of suggested near future technologies are the use of AI powered IoT systems in surgery or the deployment of AI in military contexts (known as Lethal Autonomous Weapons Systems (LAWS)).

The major socio-ethical questions surrounding AI is of autonomy. As machines become more competent (at their particular task) the need for human input decreases to the point where the machine may be considered to be acting autonomously or making autonomous decisions. There are a set of related questions that must be asked when considering machine autonomy:

1. Should machines be allowed to make autonomous decisions?
2. If machines do make autonomous decisions what sorts of things can machines decide?
3. Who is responsible (legally, ethically, socially, financially) for the outcomes of a machine’s decision?
4. What level of human review or oversight is necessary when a machine makes an autonomous decision?

These questions are important to consider and naturally will relate differently to different AI applications. For example, the impacts of poor decisions made by an intelligent toaster are unlikely to be catastrophic. However, poor decisions by autonomous vehicles could be lethal. Thus, there are a number of other factors which have to be considered in responding to each of these questions, such as the reversibility of the decision, and seriousness of the consequences should the machine make the wrong decision.

Furthermore, as AI systems develop increasing autonomy there is the potential for errors to occur on a semi-regular basis. When the results remain non-catastrophic it has the potential to create a situation known as ‘normalization of deviance’. In this situation, errors which do not lead to adverse consequences become redefined from being problems to acceptable operating risks despite being outside of design specifications. As these errors continue to occur they eventually may lead to catastrophic outcomes which were foreseeable but not corrected due to habituation towards the errors (Vaughn, 2016). In the case of AI, it is important to remain aware of this potential as there will be errors in the early stages at least and in the absence of catastrophes, complacency may quickly set in.

Another well documented risk associated with AI is the potential for algorithms used in machine decision making to reflect human biases (such as racism or sexism) due to these biases in the data inputs. This presents the danger of ‘objective’ decisions not really being objective and thus AI could perpetuate human inequalities. This risk has been extensively covered in literature (Buchanan & Miller, 2017).

The complexity and breadth of the topic means that the gaps in knowledge and governance of AI are many. Nonetheless, the key task from a policy perspective will be regulating autonomy in a manner that integrates the scientific, philosophical, and disciplinary research on AI into a more general approach to the regulation and governance of autonomy. Bridging the science and regulation of AI is a complex task. For example, a small change in AI behavior from a technical perspective may represent a radical change from a regulatory or social perspective. The change in autonomy is significant and so are the social and regulatory implications. Because of the complexity of the scientific, philosophical, and sociopolitical/legal issues around AI, it is imperative to develop a more general policy perspective integrating these various insights.

Connected devices have the extraordinary potential to improve the health, economic, and personal welfare of underserved communities. Wearable devices, for example, can closely monitor a patient’s health, which is critical for certain illnesses. Heath care providers can do this remotely, which helps rural patients or patients with mobility problems. While IoT has the ability to improve the lives of consumers and citizens, a lack of access to the Internet, and thus many IoT applications, could also make things worse for underserved communities. If policymakers do not implement policies to encourage equitable deployment, the Internet of Things could exacerbate existing inequalities by providing the benefits of data-driven decision making only to some and placing already underserved communities at an even greater disadvantage (Department of Commerce, 2017).

Technology Standardization, Interoperability and Access

IoT tools and technologies are now cheaper, faster, and more easily available than ever before. As the technologies continues to evolve, there continues to be some underlying challenges with potential policy implication where governments can play a proactive and positive role (World Bank, 2017):

• Network coverage: The required mobile and wireless networks should provide continuous coverage, stable, and reliable connectivity despite the huge demand coming from increased device connections. Limited coverage is often the cause for reduced benefits from IoT applications.
• Power consumption: IoT applications depend on devices that operate using electrical energy. Low power consumption is therefore very important to facilitate continuous operation of these devices. Newer IoT devices and applications have begun to explore and exploit energy harvesting techniques to achieve long-term operation of battery-powered IoT devices.
• Privacy and security: IoT devices may suffer from privacy and security vulnerabilities. Existing solutions often are not sufficient to address these challenges.
• Interoperability/standards: Different IoT systems should coexist without affecting each other. There are, however, only limited wireless standards available to address the connectivity and interoperability of the huge amount of different IoT devices being deployed.
• Market Readiness: The lack of market readiness may be one of the biggest barriers in commercializing IoT products and services. Applications that do not require or expect government intervention, such as in Industry 4.0, have been widely adopted. By contrast, despite the innovative IoT technologies being produced, the IoT market remains underdeveloped and unready at scale when government partnership or action is needed or inevitable.
• Reliability: The typical consumer electronics life cycle of 2-4 years is not feasible for large-scale IoT. The costs and logistics of updating/redeploying any pieces of an IoT system every 2-4 years can potentially outweigh the value for all stakeholders. Any IoT solution should have a clear annual maintenance contract (AMC) in place to support the devices and services over the lifetime of the system. An AMC will incentivize the system provider to provide devices that will be able to withstand external conditions, their sensors remaining calibrated to ensure proper measurements.
• Monopoly Characteristics: Dependence on wireless networks presents typical characteristics of a natural monopoly such as high entry and sunk costs, large initial infrastructure investments, supply-side economies of scale, a limited number of suppliers, market power, concentrated competition, and marginal costs tending to zero especially in jurisdictions with existing monopolies for telecom utilities.

Data Privacy & Security

A defining characteristic of the IoT is pervasive, often opaque collection and seamless linkage of user data to provide personalized experiences (Wachter, 2018). To enable this functionality, IoT devices and services must be connected and share data about users’ interactions with multiple nodes in the network. Consistent identification of users and devices across the network is likewise necessary.

These features of the IoT, which create numerous privacy risks, are frequently designed to go unnoticed by users in order to provide a ‘seamless’ experience. For example, the placement of sensors in clothing materials facilitated by advances in nanotechnology opens the door to monitoring information on an individuals' location and possibly some vital signs. The use of wearables for monitoring health status become more accepted, it could result in the collection of large-scale data on individuals' health status (Costigan, 2016; Bannerjee, 2018). The impossibility of anonymizing data, weak cybersecurity standards, and the opaque operation of many IoT devices and services further exacerbate these privacy risks, and users’ awareness of them. A fundamental tension exists between the seamless and nontransparent nature of the IoT, and the need to keep users informed and in control of collection and processing of their personal data to protect against privacy threats.

Security implications are likely to arise from IoT based applications due to the typical lack of security functions in the majority of sensors and actuators that make up the backbone of the IoT (Costigan, 2016). Specifically, as companies push out more minimally viable products in a rush to meet demand, low-cost sensors and actuators for data collection, monitoring, and process optimization will remain unlikely to have properly embedded security functions within them. Moreover, sensors tend to suffer from limited memory capability and computational power, further diminishing opportunities to produce IoT devices with appropriate security protocols (which frequently is not a primordial goal in the mind of developers). This inherent weakness in IoT translates into possible societal vulnerabilities as devices across sectors ranging from health to agriculture can be compromised.

An extreme example of poor data privacy is the social credit system currently being piloted in the People’s Republic of China. Under this system a vast range of behaviors both criminal and non-criminal may affect an individual’s social credit score, like a credit score, and this in turn impacts a range of outcomes from educational and job prospects to loan terms (Hoffman, 2018). This is an extreme case however it is both a clear affront to liberal democratic values and a potential warning of the socially destructive potential of data-driven smart cities.

Although the use of data for social engineering may appear positive to some, historical cases of surveillance-based societies clearly show that any public goods are offset by poor outcomes for citizens living under such a regime (Lichter, et al., 2015). Such systems have the potential to exacerbate existing inequities, for instance insurers in some states may deny insurance to those seen as high-risk. The social inequity effects of such market driven systems are already well documented in some places such as the United States and if the use of private data in making these determinations is not regulated to protect the vulnerable then this outcome may become more widespread.

The second concern regarding security is that even if private data is used in a responsible way it will create a vast data bank of sensitive personal information. Poor security practices may then allow actors with illegal or otherwise nefarious intentions to access this data placing citizens at risk of adverse outcomes. The risk is not only from third-party actors seeking to access a restricted system but also (or even more so) from those with legitimate access who may misuse the data (Hutchings & Jorna, 2015). Thus, solving the security problem is not simply a question of cybersecurity but also of regulatory and governance practices within organizations using data.