Does Privacy Matter with the Smart Grid?

As we hear more stories about the Smart Grid and the media focuses attention on potential security risks, it is worth asking whether privacy has a role to play.  But first let me set the ground rules.  I do not subscribe to the notion that privacy is security for the legal/policy types who can’t talk techie at a detailed level.  All too often I’ve seen privacy articles and discussions devolve into discussions about password length or the need for encryption.  That’s not privacy; it’s security, and it pains me to see two perfectly good disciplines get pillaged by folks who run out of material and decide to veer into a different discussion.  That’s not to say that they both can’t be discussed at the same time, but people need to know the difference.  So for me, privacy is about only the process involved in determining who should get access to a piece of information and for what purpose.  In some senses privacy is what makes security useful as security is concern deploying restrictions to access based on the criteria set by privacy.

With that said, are we really facing privacy issues with the Smart Grid?  And I caveat that by saying that privacy here means how personally identifiable information about energy customers is used and shared.  In theory, privacy could cover trade secrets and other sensitive information as in a sense that data is meant to stay private, but for purposes here, we’re just talking about the customer information.  In an excellent article entitled “Smart Privacy for the Smart Grid:  Embedding Privacy into the Design of Electricity Conservation” the authors go to great lengths in describing the various types of measurement that can be taken and how it could be used:

Whether individuals tend to cook microwavable meals or meals on the stove; whether they have breakfast; the time at which individuals are at home; whether a house has an alarm system and how often it is activated; when occupants usually shower; when the TV and/or computer is on; whether appliances are in good condition; the number of gadgets in the home; if the home has a washer and dryer and how often they are used; whether lights and appliances are used at odd hours, such as in the middle of the night; whether and how often exercise equipment such as a treadmill is used. Combined with other information, such as work location and hours, and whether one has children, one can see that assumptions may be derived from such information.  For example: the homeowner tends to arrive home shortly after the bars close; the individual is a restless sleeper and is sleep deprived; the occupant leaves late for work; the homeowner often leaves appliances on while at work; the occupant rarely washes his/her clothes; the person leaves their children home alone; the occupant exercises infrequently.

Practically speaking, I suppose that exposing this information could be a bit embarrassing, but much of it serves little purpose to someone with malicious intent unless the person is a celebrity as I’m sure Al Gore can attest to when his house legitimately became drawn into charges of hypocrisy.  However, for the average person, burglary would seem to a more compelling motive even though there are probably easier and more accurate ways to find out if someone isn’t home.  There, of course, is the dignitary right to privacy that can’t be easily tied to economic value.  Us capitalist Americans tend to deride such sentiments as idle chatter standing in the way of progress.  Nonetheless, at some level, we all succumb to that luxury of privacy for privacy sake whether it is out of embarrassment that a parent, spouse, co-worker, neighbor, or Greenpeace activist finds out that we like to crank up the AC on days with energy shortages or partake in that guilty pleasure of a 30 minute shower.

But aside from those issues, survey after survey has shown that people will gladly give up some of their privacy for something in return.  That’s the dirty secret behind web news registrations, free samples, and loyalty cards.  While there are some die hard privacy proponents out there, most people are just trying to get the best deal for what they have to give up.  Hence, the lesson for utilities is to be responsible in how you protect information that you say you’re going to protect by putting in effective cyber security measures.  However, if you want to do some marketing with all that data you’re getting from your customer, make they know they’re getting a discount for all this personal information they’re supposedly giving up that never was available to sell before.  Isn’t capitalism wonderful.