EU investing €120bn to create a giant Internet of Things - but what about the security risk?

On 19 April, the European Commission (EC) announced plans to invest €120bn (£93bn, $136bn) over the next five years into creating a "digital single market" – essentially, getting all EU member states to pool their resources to invest in emerging technologies like the Internet of Things (IoT), 5G and quantum computing, as well as a huge push into cloud storage infrastructure.

Many European countries already have their own national initiatives when it comes to digitising industries, but the European Commission says that working together can increase the amount of investment available, and that the €120bn put in will likely see a return of an additional €110 billion of revenue for industry, per year, in Europe over the next five years (backed up by studies by PwC and Boston Consulting Group).

Interestingly, the EC is particularly focused on creating a new initiative on the "free flow of data within the EU", which is designed to mitigate current problems with "unjustified localisation requirements in national legislation" as well as with how data ownership is determined, who can use the data and under what circumstances it can be reused.

Linking together all data in the EU – what could be wrong with that?

IoT refers to smart devices that send information, wirelessly, back to a computer server or smartphone app, to help people make better decisions and keep tabs on machines to prevent problems and better use their resources, such as when roads are most congested and public carparks are most popular, or to monitor operations on a remote oil rig in the middle of the ocean.

The reason the EC is so concerned about creating a free flow of data within the EU is because rather than each European country having its own IoT-driven smart cities - laden with smart devices tracking data on our everyday lives - the EC instead wants all the data from all the smart cities across Europe to be sent to a centralised cloud.

"While personal data is covered and protected by EU rules, there are no clear guidelines for other types of data. Large amounts of data are produced every second, created by people or generated by machines, such as sensors gathering climate information, satellite imagery, digital pictures and videos, purchase transaction records, or GPS signals," the EC writes in its press release.

"They represent a goldmine for research, innovation and new business opportunities. But data often remains stuck in national expensive data centres (e.g. Member States requirements to keep data inside their territory). Unnecessary restrictions should be removed and national systems better aligned to allow a better flow of data within the EU and to stimulate the development of new technologies such as cloud computing."

Even better, under the European Cloud Initiative, the EC wants to create a better cloud where scientific researchers, businesses and public services can exploit big data together, including the European Open Science Cloud (EOSC), which will enable 1.7 million European researchers and 70 million professionals to share, store, analyse and reuse research data in science and technology virtual environments, similar to the big cache of data recently released by CERN.

The European Commission should beware cyberattacks

Sharing and cooperation across borders sounds like a utopian idea, as does the pooling of resources (although one does wonder how we can so freely spend €120bn). But, has the EC not been watching the news about the plethora of data breaches and cyberattacks affecting businesses, government agencies, retailers, the press and even consumer cloud services like Apple's iCloud, at all?

Yes, linking information for the greater education of all is admirable, and that's why we have the internet, but imagine what would happen if a hacker were to take advantage of a giant IoT network to hack a popular smart device in people's homes (like Nest smart thermometers) and use it to spy on users, or steal the data for some nefarious purpose?

The state of IoT security isn't any better than cloud security – in fact hacking IoT connected devices is considered to be the one of the top cybersecurity concerns in 2016, according to security firm Trend Micro.

The EC says that in order for IoT to "unleash its full potential for the economy and society", there needs to be a single market, where all smart things, devices and services can connect seamlessly anywhere in the EU and across borders, and that all operators, service providers and product developers need to adopt a "Trusted IoT label" that will give consumers information on privacy and security.

That's a good step forward, but first we need to think about this – do we really need other countries' data? Do we really want to be giving away IoT data from our industries, which could perhaps be used to the advantage of rival companies in other EU countries?

When it comes to science and the greater understanding of mankind, why not. But frankly, not everyone in the EU needs to know what time, every day, I turn my lights on and how high my thermostat is set to. And nor should they, either.