LAUSR

interconnected devices infected with malware mounted a " denial-of-service " cy-berattack on Dyn, a company that operates part of the Internet's directory service. Such attacks require us to up our technical game in Internet security and safety. They also expose the need to frame and enforce social and ethical behavior, privacy, and appropriate use in Internet environments. Social behavior and appropriate use become even more crucial as we build out the " Internet of Things " (IoT)—an increasingly interconnected cyber-physical-biological environment that links devices, systems, data, and people. At its best, the IoT has the potential to create an integrated ecosystem that can respond to a spectrum of needs, increasing efficiency and opportunity, and empowering people through technology , and technology through intelligence. At its worst, the IoT can open a Pandora's Box of inappropriate and unsafe behavior, unintended consequences , and intrusiveness. The difference between an IoT that enhances society and one that diminishes it will be determined by our ability to create an effective model for IoT governance. This model must guide social behavior and ethical use of IoT technologies while promoting effective security and safety. While we should not limit technology innovation too early with overly restrictive policy, neither should we leave the policy and governance discussion until the IoT is so mature that it cannot easily incorporate pro-tections. What Policy Will Be Needed for the IoT? Although much of the policy needed for the IoT may evolve from Internet gov-ernance, the scale, heterogeneity, complexity , and degree of technological autonomy within the IoT will require new thinking about regulation and policy and force new interpretations of current law. As an example of the complexity of the governance challenge, consider three key areas critical to ensure the positive potential of the IoT: 1. What are your rights to privacy in the IoT? The IoT will sharpen the tension between individual privacy and the use of personal information to promote effectiveness, safety, and security. Who should control information about you? Who should access it? Who can use it? The answer is not always clear-cut. Consider medical monitoring devices and the information they accumulate. Should your personal health information be shared when the Centers for Disease Control want to track a potential epidemic? When bio-medical researchers want to model potential treatment strategies on a richer dataset? When an employer is considering you for a job? At present, policy and …