The Internet of Things: Frequently Asked Questions

Summary: "Internet of Things" (IoT) refers to networks of objects that communicate with other objects and with computers through the Internet. "Things" may include virtually any object for which remote communication, data collection, or control might be useful, such as vehicles, appliances, medical devices, electric grids, transportation infrastructure, manufacturing equipment, or building systems.

Summary: In other words, the IoT potentially includes huge numbers and kinds of interconnected objects. It is often considered the next major stage in the evolution of cyberspace. Some observers believe it might even lead to a world where cyberspace and human space would seem to effectively merge, with unpredictable but potentially momentous societal and cultural impacts.

Summary: Two features make objects part of the IoT—a unique identifier and Internet connectivity. Such "smart" objects each have a unique Internet Protocol (IP) address to identify the object sending and receiving information. Smart objects can form systems that communicate among themselves, usually in concert with computers, allowing automated and remote control of many independent processes and potentially transforming them into integrated systems.

Summary: Those systems can potentially impact homes and communities, factories and cities, and every sector of the economy, both domestically and globally. Although the full extent and nature of the IoT's impacts remain uncertain, economic analyses predict that it will contribute trillions of dollars to economic growth over the next decade. Sectors that may be particularly affected include agriculture, energy, government, health care, manufacturing, and transportation.

Summary: The IoT can contribute to more integrated and functional infrastructure, especially in "smart cities," with projected improvements in transportation, utilities, and other municipal services. The Obama Administration announced a smart-cities initiative in September 2015.

Summary: There is no single federal agency that has overall responsibility for the IoT. Agencies may find IoT applications useful in helping them fulfill their missions. Each is responsible for the functioning and security of its own IoT, although some technologies, such as drones, may fall under the jurisdiction of other agencies as well. Various agencies also have relevant regulatory, sector-specific, and other mission-related responsibilities, such as the Departments of Commerce, Energy, and Transportation, the Federal Communications Commission, and the Federal Trade Commission.

Summary: Security and privacy are often cited as major issues for the IoT, given the perceived difficulties of providing adequate cybersecurity for it, the increasing role of smart objects in controlling components of infrastructure, and the enormous increase in potential points of attack posed by the proliferation of such objects. The IoT may also pose increased risks to privacy, with cyberattacks potentially resulting in exfiltration of identifying or other sensitive information about an individual. With an increasing number of IoT objects in use, privacy concerns also include questions about the ownership, processing, and use of the data they generate.

Summary: Several other issues might affect the continued development and implementation of the IoT. Among them are

Summary: the lack of consensus standards for the IoT, especially with respect to connectivity; the transition to a new Internet Protocol (IPv6) that can handle the exponential increase in the number of IP addresses that the IoT will require; methods for updating the software used by IoT objects in response to security and other needs; energy management for IoT objects, especially those not connected to the electric grid; and the role of the federal government, including investment, regulation of applications, access to wireless communications, and the impact of federal rules regarding "net neutrality."

Summary: No bills specifically on the IoT have been introduced in the 114th Congress, although S.Res. 110 was agreed to in March 2015, and H.Res. 195 was introduced in April. Both call for a U.S. IoT strategy, a focus on a consensus-based approach to IoT development, commitment to federal use of the IoT, and its application in addressing challenging societal issues. House and Senate hearings have been held on the IoT, and several congressional caucuses may consider associated issues. Moreover, bills affecting privacy, cybersecurity, and other aspects of communication could affect IoT applications.

T he Internet of Things (IoT) is a complex, often poorly understood phenomenon. The term is more than a decade old, but interest has grown considerably over the last few years as applications have increased. The impacts of the IoT on the economy and society more generally are expected by many to grow substantially. This report was developed to assist Congress in responding to some commonly asked questions about it:

" What Is the Internet of Things (IoT)? " " How Does the IoT Work? " " What Impacts Will the IoT Have? " " What Is the Current Federal Role? " " What Issues Might Affect the Development and Implementation of the IoT? " " What Actions Has Congress Taken? " " Where Can I Find Additional Resources on This Topic? "

When people talk about the Internet, they are usually referring to the electronic network that permits computers around the world to communicate with each other. What, then, is the IoT? There is no universally agreed-upon definition, but generally, the term is used to describe networks of objects that are not themselves computers but that have embedded components that connect to the Internet. "Things" may include, for example, smart meters, fitness trackers, personal vehicles, home appliances, medical devices, and even clothing used by individual consumers. They may also include embedded devices in roadways and in other components of infrastructure such as electric grids, manufacturing plants and other buildings, farms, and virtually any other object, element, or system for which remote communications, control, or data collection and processing might be useful.

While fixed and mobile computing devices such as desktop computers, smartphones, and tablets are generally not considered to be IoT objects, smartphones in particular have features such as motion and position sensors that blur the distinctions. Some smartphone applications, for example, enable them to be used in fitness tracking and other health monitoring.

In other words, the IoT potentially includes huge numbers and kinds of interconnected objects. In practice, IoT refers not to a simple or uniform network of objects but rather to a complex collection of objects and networks. Specific dimensions of the IoT may be referred to by terms such as smart grid, connected cities, and Industrial Internet. Other terms may also be used in the context of IoT to denote related concepts such as cyber-physical systems and the Internet of Everything.

The IoT is often considered the next major stage in the evolution of cyberspace. The first electronic computers were developed in the 1940s, but 40 years passed before connecting computers through wired devices began to spread in the 1980s. The first decade of the 21 st century saw the next stage, marked by the rapid spread of smartphones and other mobile devices that use wireless communications, as well as social media, big-data analytics, and cloud computing. Building on those advances, connections between two or more machines (M2M) and between machines and people are expected by many observers to lead to huge growth in the IoT by 2020.

The IoT is not separate from the Internet, but rather, a potentially huge extension and expansion of it. The "things" that form the basis of the IoT are objects. They could be virtually anything—streetlights, thermostats, electric meters, fitness trackers, factory equipment, automobiles, unmanned aircraft systems (UASs or drones), or even cows or sheep in a field. What makes an object part of the IoT is embedded or attached computer chips or similar components that give the object both a unique identifier and Internet connectivity. Objects with such components are often called "smart"—such as smart meters and smart cars.

Internet connectivity allows a smart object to communicate with computers and with other smart objects. Connections of smart objects to the Internet can be wired, such as through Ethernet cables, or wireless, such as via a Wi-Fi or cellular network.

To enable precise communications, each IoT object must be uniquely identifiable. That is accomplished through an Internet Protocol (IP) address, a number assigned to each Internet-connected device, whether a desktop computer, a mobile phone, a printer, or an IoT object. Those IP addresses ensure that the device or object sending or receiving information is correctly identified.

What kinds of information do IoT objects communicate? The answer depends on the nature of the object, and it can be simple or complex. For example, a smart thermometer might have only one sensor, used to communicate ambient temperature to a remote weather-monitoring center. A wireless medical device might, in contrast, use various sensors to communicate a person's body temperature, pulse, blood pressure, and other variables to a medical service provider via a computer or mobile phone.

Smart objects can also be involved in command networks. For example, industrial control systems can adjust manufacturing processes based on input from both other IoT objects and human operators. Network connectivity can permit such operations to be performed in "real time"—that is, almost instantaneously.

Smart objects can form systems that communicate information and commands among themselves, usually in concert with computers they connect to. This kind of communication enables the use of smart systems in homes, vehicles, factories, and even entire cities.

Smart systems allow for automated and remote control of many processes. A smart home can permit remote control of lighting, security, HVAC (heating, ventilating, and air conditioning), and appliances. In a smart city, an intelligent transportation system (ITS) may permit vehicles to communicate with other vehicles and roadways to determine the fastest route to a destination, avoiding traffic jams, and traffic signals can be adjusted based on congestion information received from cameras and other sensors. Buildings might automatically adjust electric usage, based on information sent from remote thermometers and other sensors. An Industrial Internet application can permit companies to monitor production systems and adjust processes, remotely control and synchronize machinery operations, track inventory and supply chains, and perform other tasks.

IoT connections and communications can be created across a broad range of objects and networks and can transform previously independent processes into integrated systems. These integrated systems can potentially have substantial effects on homes and communities, factories and cities, and every sector of the economy, both domestically and globally.

The IoT may significantly affect many aspects of the economy and society, although the full extent and nature of its eventual impacts remains uncertain. Many observers predict that the growth of the IoT will bring positive benefits through enhanced integration, efficiency, and productivity across many sectors of the U.S. and global economies. Among those commonly mentioned are agriculture, energy, health care, manufacturing, and transportation. Significant impacts may also be felt more broadly on economic growth, infrastructure and cities, and individual consumers. However, both policy and technical challenges, including security and privacy issues, might inhibit the growth and impact of IoT innovations.

Several economic analyses have predicted that the IoT will contribute significantly to economic growth over the next decade, but the predictions vary substantially in magnitude. The current global IoT market has been valued at about $2 trillion, with estimates of its predicted value over the next 5 to 10 years varying from $4 trillion to $11 trillion. Such variability demonstrates the difficulty of making economic forecasts in the face of various uncertainties, including a lack of consensus among researchers about exactly what the IoT is and how it will develop.

The IoT can be leveraged by the agriculture industry through precision agriculture, with the goal of optimizing production and efficiency while reducing costs and environmental impacts. For farming operations, it involves analysis of detailed, often real-time data on weather, soil and air quality, water supply, pest populations, crop maturity, and other factors such as the cost and availability of equipment and labor. Field sensors test soil moisture and chemical balance, which can be coupled with location technologies to enable precise irrigation and fertilization. Drones and satellites can be used to take detailed images of fields, giving farmers information about crop yield, nutrient deficiencies, and weed locations. For ranching and animal operations, radio frequency identification (RFID) chips and electronic identification readers (EID) help monitor animal movements, feeding patterns, and breeding capabilities, while maintaining detailed records on individual animals.

Within the energy sector, the IoT may impact both production and delivery, for example through facilitating monitoring of oil wellheads and pipelines. When IoT components are embedded into parts of the electrical grid, the resulting infrastructure is commonly referred to as the "smart grid." This use of IoT enables greater control by utilities over the flow of electricity and can enhance the efficiency of grid operations. It can also expedite the integration of microgenerators into the grid.

Smart-grid technology can also provide consumers with greater knowledge and control of their energy usage through the use of smart meters in the home or office. Connection of smart meters to a building's HVAC, lighting, and other systems can result in "smart buildings" that integrate the operation of those systems. Smart buildings use sensors and other data to automatically adjust room temperatures, lighting, and overall energy usage, resulting in greater efficiency and lower energy cost. Information from adjacent buildings may be further integrated to provide additional efficiencies in a neighborhood or larger division in a city.

The IoT has many applications in the health care field, in both health monitoring and treatment, including telemedicine and telehealth. Applications may involve the use of medical technology and the Internet to provide long-distance health care and education. Medical devices—which can be wearable or nonwearable, or even implantable, injectable, or ingestible —can permit remote tracking of a patient's vital signs, chronic conditions, or other indicators of health and wellness. Wireless medical devices may be used not only in hospital settings but also in remote monitoring and care, freeing patients from sustained or recurring hospital visits. Some experts have stated that advances in healthcare IoT applications will be important for providing affordable, quality care to the aging U.S. population.

Integration of IoT technologies into manufacturing and supply chain logistics is predicted to have a transformative effect on the sector. The biggest impact may be realized in optimization of operations, making manufacturing processes more efficient. Efficiencies can be achieved by connecting components of factories to optimize production, but also by connecting components of inventory and shipping for supply chain optimization. Another application is predictive maintenance, which uses sensors to monitor machinery and factory infrastructure for damage. Resulting data can enable maintenance crews to replace parts before potentially dangerous and/or costly malfunctions occur.

Transportation systems are becoming increasingly connected. New motor vehicles are equipped with features such as global positioning systems (GPS) and in-vehicle entertainment, as well as advanced driver assistance systems (ADAS), which utilize sensors in the vehicle to assist the driver, for example with parking and emergency braking. Further connection of vehicle systems enables fully autonomous or self-driving automobiles, which are predicted to be commercialized in the next 5-20 years.

Additionally, IoT technologies can allow vehicles within and across modes—including cars, buses, trains, airplanes, and unmanned aerial vehicles (drones)—to "talk" to one another and to components of the IoT infrastructure, creating intelligent transportation systems (ITS). Potential benefits of ITS may include increased safety and collision avoidance, optimized traffic flows, and energy savings, among others.

The capabilities of the smart grid, smart buildings, and ITS combined with IoT components in other public utilities—such as roadways, sewage and water transport and treatment, public transportation, and waste removal—can contribute to more integrated and functional infrastructure, especially in cities. For example, traffic authorities can use cameras and embedded sensors to manage traffic flow and help reduce congestion. IoT components embedded in street lights or other infrastructure elements can provide functions such as advanced lighting control, environmental monitoring, and even assistance for drivers in finding parking spaces. Smart garbage cans can signal waste removal teams when they are full, streamlining the routes that garbage trucks take.

This integration of infrastructure and service components is increasingly referred to as smart cities, or other terms such as connected, digital, or intelligent cities or communities. A number of cities in the United States and elsewhere have developed smart-city initiatives.

As with IoT and other popular technology terms, there is no established consensus definition or set of criteria for characterizing what a smart city is. Specific characterizations vary widely, but in general they involve the use of IoT and related technologies to improve energy, transportation, governance, and other municipal services for specified goals such as sustainability or improved quality of life. The related technologies include

social media (such as Facebook and Twitter), mobile computing (such as smartphones and wearable devices), data analytics (big data—the processing and use of very large data sets; and open data—databases that are publicly accessible), and cloud computing (the delivery of computing services from a remote location, analogous to the way utilities such as electricity are provided).

Together, these are sometimes called SMAC.

The IoT may create webs of connections that will fundamentally transform the way people and things interact with each other. The emerging cyberspace platform created by the IoT and SMAC has been described as potentially making cities "like 'computers' in open air," where citizens engage with the city "in a real-time and ongoing loop of information."

Some observers have proposed that the growth of IoT will result in a hyperconnected world in which the seamless integration of objects and people will cause the Internet to disappear as a separate phenomenon. In such a world, cyberspace and human space would seem to effectively merge into a single environment, with unpredictable but potentially substantial societal and cultural impacts.

There is no single federal agency that has overall responsibility for the IoT, just as there is no one agency with overall responsibility for cyberspace. Federal agencies may find the IoT useful in helping them fulfill their missions through a variety of applications such as those discussed in this report and elsewhere. Each agency is responsible under various laws and regulations for the functioning and security of its own IoT, although some technologies, such as drones, may also fall under some aspects of the jurisdiction of other agencies.

Various agencies have regulatory, sector-specific, and other mission-related responsibilities that involve aspects of IoT. For example, entities that use wireless communications for their IoT devices will be subject to allocation rules for the portions of the electromagnetic spectrum that they use.

The Federal Communications Commission (FCC) allocates and assigns spectrum for nonfederal entities. In the Department of Commerce , the National Telecommunications and Information Administration (NTIA) fulfills that function for federal entities, and the National Institute of Standards and Technology (NIST) creates standards, develops new technologies, and provides best practices for the Internet and Internet-enabled devices. The Federal Trade Commission (FTC) regulates and enforces consumer protection policies, including for privacy and security of consumer IoT devices. The Department of Homeland Security (DHS) is responsible for coordinating security for the 16 critical infrastructure sectors. Many of those sectors use industrial control systems (ICS), which are often connected to the Internet, and the DHS National Cybersecurity and Communications Integration Center (NCCIC) has an ICS Cyber Emergency Response Team (ICS-CERT) to help critical-infrastructure entities address ICS cybersecurity issues. The Food and Drug Administration (FDA) also has responsibilities with respect to the cybersecurity of Internet-connected medical devices. The Department of Justice (DOJ) addresses law-enforcement aspects of IoT, including cyberattacks, unlawful exfiltration of data from devices and/or networks, and investigation and prosecution of other computer and intellectual property crimes. Relevant activities at the Department of Energy (DOE) include those associated with developing high-performance and green buildings, and other energy-related programs, including those related to smart electrical grids. The Department of Transportation (DOT) has established an Intelligent Transportation Systems Joint Program Office (ITS JPO) to coordinate various programs and activities throughout DOT relating to the development and deployment of connected vehicles and systems, involving all modes of surface transportation. DOT mode-specific agencies also engage in ITS activities. The Federal Aviation Administration (FAA) is involved in regulation and other activities relating to unmanned aerial vehicles (UAVs) and commercial systems (UAS). The Department of Defense was a pioneer in the development of much of the foundational technology for the IoT. Most of its IoT deployment has related to its combat mission, both directly and for logistical and other support.

In addition to the activities described above, several agencies are engaged in research and development (R&D) related to the IoT.

Like NIST, the National Science Foundation (NSF) engages in cyber-physical systems research and other activities that cut across various IoT applications. The Networking and Information Technology Research and Development Program (NITRD), under the Office of Science and Technology Policy (OSTP) coordinates federal agency R&D in networking and information technology. The NITRD Cyber Physical Systems Senior Steering Group "coordinates programs, budgets and policy recommendations" for IoT R&D. Other agencies involved in such R&D include the Food and Drug Administration (FDA), the National Aeronautics and Space Administration (NASA), the National Institutes of Health (NIH), the Department of Veterans Affairs (VA), and several DOD agencies. The White House has also announced a smart-cities initiative focusing on the development of a research infrastructure, demonstration projects, and other R&D activities.

What Issues Might Affect the Development and Implementation of the IoT?

The Internet of Things is often lauded for its potentially revolutionary applications. Indeed, IoT devices are today being implemented in many different sectors for a vast array of purposes. However, it is still unclear how IoT will progress due to challenges associated with both technical and policy issues .

Prominent technical limitations that may affect the growth and use of the IoT include a lack of new Internet addresses under the most widely used protocol, the availability of high-speed and wireless communications, and lack of consensus on technical standards.

A potential barrier to the development of IoT is the technical limitations of the version of the Internet Protocol (IP) that is used most widely. IP is the set of rules that computers use to send and receive information via the Internet, including the unique address that each connected device or object must have to communicate . Version 4 (IPv4) is current ly in widest use. It can accommodate about 4 billion addresses, and it is close to saturation, with few new addresses available in many parts of the world.

Some observers predict that Internet traffic will grow faster for IoT objects than any other kind of device over the next five years, with more than 25 billion IoT objects in use by 2020 , and perhaps 50 billion devices altogether. I Pv4 appears unlikely to meet that growing demand, even with the use of workarounds such as methods for sharing IP addresses.

Version 6 (IPv6) allows for a huge increase in the number IP addresses . With IPv4 , the maximum number of unique addresses , 4.2 billion, is not enough to provide even one address for each of the 7.3 billion people on Earth. IPv6 , in contrast, will accommodate over 10 38 addresses—more than a trillion trillion per person .

It is highly likely that to accommodate the anticipated growth in the numbers of Internet-connected objects, IPv6 will have to be implemented broadly. It has been available since 1999 but was not formal ly launched until 2012. In most countries, fewer than 10% of IP addresses were in IPv6 as of September 2015 . Adoption is highest in some European countries and in the United States , where adoption has doubled in the past year to about 20% . Globally, adoption has doubled annually since 2011, to about 7% of addresses in mid-201 5 . While growth in adoption is expected to continue, it is not yet clear whether the rate of growth will be sufficient to accommodate the expected growth in the IoT. That will depend on a number of factors, including replacement of some older systems and applications that cannot handle IPv6 addresses , resolution of security issues associated with the transition, and availability of sufficient resources for deployment .

Efforts to transition federal systems to IPv6 began more than a decade ago. According to estimates by NIST, adoption for public-facing services has been much greater within the federal government th an within industry or academia. However, adoption varies substantially among agencies, and some data suggest that federal adoption plateaued in 2012. Data were not available for this report on domains that are not public-facing, and it is not clear whether adoption of IPv6 by federal agencies will affect their deployment of IoT applications.

Use and growth of the IoT can also be limited by the availability of access to high-speed Internet and advanced telecommunications services, commonly known as broadband, on which it depends. While many urban and suburban areas have access, that is not the case for many rural areas, for which private-sector providers may not find establishment of the required infrastructure profitable, and government programs may be limited.

Many observers believe that issues relating to access to the electromagnetic spectrum will need to be resolved to ensure the functionality and interoperability of IoT devices. Access to spectrum, both licensed and unlicensed, is essential for devices and objects to communicate wirelessly. IoT devices are being developed and deployed for new purposes and industries, and some argue that the current framework for spectrum allocation may not serve these new industries well .

Current ly, there is no single universal ly recognized set of technical standard s for the IoT, especially with respect to communication s , or even a commonly accepted definition among the various organizations that have produced IoT standards or related documents . Many observers agree that a common set of standard s will be essential for interoperability and scalability of devices and systems. However, other s have expressed pessimism that a universal standard is feasible or even desirable , given the diversity of objects that the IoT potentially encompasses. Several different sets of de facto standard s have been in development, and some observers do not expect formal standards to appear before 2017. Whether conflicts between standards will affect growth of the sector as they did for some other technologies i s not clear.

Several other technical issues might impact the development and adoption of IoT. For example, if an object's software cannot be readily updated in a secure manner, that could affect both function and security. Some observers have therefore recommended that smart objects have remote updating capabilities. However, such capabilities could have undesirable effects such as increasing power requirements of IoT objects or requiring additional security features to counter the risk of exploitation by hackers of the update features.

Energy consumption can also be an issue. IoT objects need energy for sensing, processing, and communicating information. If objects isolated from the electric grid must rely on batteries, replacement can be a problem, even if energy consumption is highly efficient. That is especially the case for applications using large numbers of objects or placements that are difficult to access. Therefore, alternative approaches such as energy harvesting, whether from solar or other sources, are being developed.

The security of devices and the data they acquire, process, and transmit is often cited as a top concern in cyberspace. Cyberattacks can result in theft of data and sometimes even physical destruction. Some sources estimate losses from cyberattacks in general to be very large—in the hundreds of billions or even trillions of dollars. As the number of connected objects in the IoT grows, so will the potential risk of successful intrusions and increases in costs from those incidents.

Cybersecurity involves protecting information systems, their components and contents, and the networks that connect them from intrusions or attacks involving theft, disruption, damage, or other unauthorized or wrongful actions. IoT objects are potentially vulnerable targets for hackers. Economic and other factors may reduce the degree to which such objects are designed with adequate cybersecurity capabilities built in. IoT devices are small, are often built to be disposable, and may have limited capacity for software updates to address vulnerabilities that come to light after deployment.

The interconnectivity of IoT devices may also provide entry points through which hackers can access other parts of a network. For example, a hacker might gain access first to a building thermostat, and subsequently to security cameras or computers connected to the same network, permitting access to and exfiltration or modification of surveillance footage or other information. Control of a set of smart objects could permit hackers to use their computing power in malicious networks called botnets to perform various kinds of cyberattacks.

Access could also be used for destruction, such as by modifying the operation of industrial control systems, as with the Stuxnet malware that caused centrifuges to self-destruct at Iranian nuclear plants. Among other things, Stuxnet showed that smart objects can be hacked even if they are not connected to the Internet. The growth of smart weapons and other connected objects within DOD has led to growing concerns about their vulnerabilities to cyberattack and increasing attempts to prevent and mitigate such attacks, including improved design of IoT objects. Cybersecurity for the IoT may be complicated by factors such as the complexity of networks and the need to automate many functions that can affect security, such as authentication. Consequently, new approaches to security may be needed for the IoT.

IoT cybersecurity will also likely vary among economic sectors and subsectors, given their different characteristics and requirements. Each sector will have a role in developing cybersecurity best practices, unique to its needs. The federal government has a role in securing federal information systems, as well as assisting with security of nonfederal systems, especially critical infrastructure. Cybersecurity legislation considered in the 114 th Congress, while not focusing specifically on the IoT, would address several issues that are potentially relevant to IoT applications, such as information sharing and notification of data breaches.

Given that smart objects can be used both to monitor conditions and to control machinery, the IoT has broad implications for safety, with respect to both improvements and risks. For example, objects embedded in pipelines can monitor both the condition of the equipment and the flow of contents. Among other benefits, that can help both to expedite shutoffs in the event of leaks and to prevent them through predictive maintenance. Connected vehicles can help reduce vehicle collisions through crash avoidance technologies and other applications. Wireless medical devices can improve patient safety by permitting remote monitoring and facilitating adjustments in care.

However, given the complexities involved in some applications of IoT, malfunctions might in some instances result in catastrophic system failures, creating significant safety risks, such as flooding from dams or levees. In addition, hackers could potentially cause malfunctions of devices such as insulin pumps or automobiles, potentially creating significant safety risks.

Cyberattacks may also compromise privacy, resulting in access to and exfiltration of identifying or other sensitive information about an individual. For example, an intrusion into a wearable device might permit exfiltration of information about the location, activities, or even the health of the wearer.

In addition to the question of whether security measures are adequate to prevent such intrusions, privacy concerns also include questions about the ownership, processing, and use of such data. With an increasing number of IoT objects being deployed, large amounts of information about individuals and organizations may be created and stored by both private entities and governments.

With respect to government data collection, the U.S. Supreme Court has been reticent about making broad pronouncements concerning society's expectations of privacy under the Fourth Amendment of the Constitution while new technologies are in flux, as reflected in opinions over the last five years. Congress may also update certain laws, such as the Electronic Communications Privacy Act of 1986, given the ways that privacy expectations of the public are evolving in response to IoT and other new technologies. IoT applications may also create challenges for interpretation of other laws relating to privacy, such as the Health Insurance Portability and Accountability Act and various state laws, as well as established practices such as those arising from norms such as the Fair Information Practice Principles.

As described in the section, " What Is the Current Federal Role? " many federal agencies are involved in different aspects of the IoT. Some business representatives and others have stressed the role of effective public/private partnerships in the development of this technology space. However, observers have also expressed concerns about the role of government regulations and policy, as discussed further in sections below, and about the degree and effectiveness of coordination among the involved federal agencies. Concerns of some extend beyond the federal role to that of state, local, and foreign governments.

Given the eclectic nature of the IoT, overall coordination of federal efforts may be challenging with respect to identification of both the goals of coordination and the methods for achieving them. Nevertheless, several observers have argued in favor of a national strategy for the IoT, including in resolutions considered in the 114 th Congress (see " What Actions Has Congress Taken? ").

Some interagency initiatives have been established with respect to specific aspects of the IoT. For example, in addition to the R&D coordination activities for cyber-physical systems under the NITRD program, a specific framework has been developed for smart cities as part of the overall White House initiative involving several federal agencies, local governments, and the private sector.

Radio frequency (electromagnetic) spectrum is widely regarded as a critical link in IoT communications, with reliable and affordable access to it required to accommodate the billions of new IoT devices projected to go online over the next decade. New technology for mobile communications is predicted to allow devices to operate on any available radio frequency and potentially permit communications technologies and cyber-physical systems to converge further. Concerns have been raised that current spectrum policy may favor consumer-oriented mobile services and the wireless industry, rather than emerging markets for IoT devices, such as transportation and manufacturing. Congress may therefore be faced with decisions about whether the current policy needs to be revised.

The concept of "net neutrality" includes the two general principles that owners of the networks that comprise and provide access to the Internet should not control how end users lawfully use that network, and that they should not be able to discriminate against content provider access to that network. The FCC adopted an order in February 2015 that established regulatory guidelines to protect the marketplace from potential abuses that could threaten the net neutrality concept. The order bans broadband Internet access providers (both fixed and wireless) from blocking and throttling lawful content, and it prohibits paid prioritization of affiliated or proprietary content. The order also creates a general conduct standard that Internet service providers cannot harm consumers or providers of applications, content, and services. These rules went into effect, with limited exceptions, on June 12, 2015, but have been challenged in the U.S. Court of Appeals for the D.C. Circuit.

It remains unclear how the FCC order will affect IoT devices and services. Some observers view the implementation of FCC regulations as a positive development. They believe that it will ensure openness and nondiscrimination for service providers, leading to the growth of new services and consumer demand. Others have expressed concerns that the regulations will stifle investment and innovation to the detriment of the expansion and growth of Internet deployment and services. Furthermore, the rules are subject to "reasonable network management," as defined by the FCC, and a category of "specialized services" defined as those that "do not provide access to the Internet generally" are exempt from the rules established by the order. Depending on how individual IoT services and devices are categorized and the degree of network management such specialized services may need, the order could also affect IoT applications on a case-by-case basis.

No bills have been introduced in the last two Congresses relating specifically to the IoT. However, many bills have been introduced with provisions related to aspects of the IoT such as connected vehicles, cyber-physical systems, smart cities, and the smart grid. None of those bills were enacted as of September 2015, although some bills with provisions on applications and appropriations relating to telehealth and telemedicine were enacted in both the 113 th and 114 th Congresses. Several bills in the 114 th Congress would address issues that are potentially relevant to IoT applications, such as information sharing in cybersecurity, privacy, and notification of data breaches.

Two similar resolutions on the IoT have been submitted in the 114 th Congress, one in the House ( H.Res. 195 /Lance, introduced April 13, 2015) and one in the Senate ( S.Res. 110 /Fischer, introduced and passed March 24). Both call for

a U.S. strategy for development of the IoT to improve social well-being while allowing for innovation and protecting against misuse, recognition of the importance of a consensus-based approach and the role of businesses in that development, federal government commitment to use the IoT, and a U.S. commitment to use the IoT for developing new technologies to address challenging societal issues.

The House version also calls for the use of cost-benefit analysis to determine when federal action is needed to address "discrete harms" in the marketplace. It also refers explicitly to energy optimization and the need for cybersecurity.

Both the House and the Senate have held hearings on the IoT in 2015. In the Senate, the Committee on Commerce, Science, and Transportation held a hearing on February 11. In the House, one was held by the Energy and Commerce Committee on March 24, and another by the Subcommittee on Courts, Intellectual Property, and the Internet of the Committee on the Judiciary on July 29. The hearings featured witnesses from businesses and associations who discussed the growth, uses, and economic potential of the IoT, as well as some of the issues described in this report, such as privacy, regulation, security, spectrum management, and standards.

There are several congressional caucuses that may consider issues associated with the IoT. Among them are caucuses on cloud computing, cybersecurity, the Internet, and high-performance buildings. In addition, new caucuses announced in this session included one expressly on the Internet of Things, and one on smart transportation.

Where Can I Find Additional Resources on This Topic?

For additional assistance on the IoT and related topics, see CRS Report R44225, The Internet of Things: CRS Experts , by [author name scrubbed] and [author name scrubbed]. Congressional offices may also contact CRS by placing a request via telephone or online through the CRS website (see http://www.crs.gov/AboutCRS/Contact-Us ).

Question: What makes objects part of the IoT?

Answer: Two features make objects part of the IoT—a unique identifier and Internet connectivity.

Question: What do these objects have?

Answer: Such "smart" objects each have a unique Internet Protocol (IP) address to identify the object sending and receiving information.

Question: What can smart objects do?

Answer: Smart objects can form systems that communicate among themselves, usually in concert with computers, allowing automated and remote control of many independent processes and potentially transforming them into integrated systems.

Question: What can IoT impact?

Answer: Those systems can potentially impact homes and communities, factories and cities, and every sector of the economy, both domestically and globally.

Question: What do economic analyses predict about IoT's impact?

Answer: Although the full extent and nature of the IoT's impacts remain uncertain, economic analyses predict that it will contribute trillions of dollars to economic growth over the next decade.

Question: What will loT impact the most?

Answer: Sectors that may be particularly affected include agriculture, energy, government, health care, manufacturing, and transportation.

What Impacts Will the IoT Have?
Economic Growth

Question: How can agencies find loT applications helpful?

Answer: Agencies may find IoT applications useful in helping them fulfill their missions.

Question: What are agencies responsible for with regards to loT?

Answer: Each is responsible for the functioning and security of its own IoT, although some technologies, such as drones, may fall under the jurisdiction of other agencies as well.

Question: What other responsibilities do agencies have?

Answer: Various agencies also have relevant regulatory, sector-specific, and other mission-related responsibilities, such as the Departments of Commerce, Energy, and Transportation, the Federal Communications Commission, and the Federal Trade Commission.

Question: What are the main issues for IoT?

Answer: Security and privacy are often cited as major issues for the IoT, given the perceived difficulties of providing adequate cybersecurity for it, the increasing role of smart objects in controlling components of infrastructure, and the enormous increase in potential points of attack posed by the proliferation of such objects.

Question: How can IoT increase risks to privacy?

Answer: The IoT may also pose increased risks to privacy, with cyberattacks potentially resulting in exfiltration of identifying or other sensitive information about an individual.

Question: What specific concerns about privacy are there?

Answer: With an increasing number of IoT objects in use, privacy concerns also include questions about the ownership, processing, and use of the data they generate.

What Issues Might Affect the Development and Implementation of the IoT?

Question: What bills were agreed to with regards to IoT?

Answer: No bills specifically on the IoT have been introduced in the 114th Congress, although S.Res. 110 was agreed to in March 2015, and H.Res. 195 was introduced in April.

Question: What do these bills call for?

Answer: Both call for a U.S. IoT strategy, a focus on a consensus-based approach to IoT development, commitment to federal use of the IoT, and its application in addressing challenging societal issues.

Question: What have the house and senate done with regards to IoT?

Answer: House and Senate hearings have been held on the IoT, and several congressional caucuses may consider associated issues.

Question: What could affect loT applications?

Answer: Moreover, bills affecting privacy, cybersecurity, and other aspects of communication could affect IoT applications.

What Actions Has Congress Taken?
Legislation
Bills

What Actions Has Congress Taken?
Legislation
Resolutions

What Actions Has Congress Taken?
Hearings