By: Mark Cummings, Ph.D., William Yeack, CSE

Economic, social, and technological pressures are moving us to smart cities. If the world follows a common technology implementation path of focusing on capability, and only on security as an afterthought, the world could get into serious trouble. People in Australia recognized the potential for this possibility and have started an interesting approach, a cooperative effort between government and industry to model and test smart cities. 

The Australian experience is very instructive. There may be other approaches developed to plan and test smart city use cases (applications, devices, and more). However, any effort to develop plans and tests for smart cities should integrate the results of the Australian experience.

The pressures are real. Cities around the world are growing at a rapid pace. Today 55 percent of the world’s population lives in urban areas. By 2050, this proportion is forecast to jump to 68 percent. As urbanization rises, the demand for resources and services to support cities grows. We see this reflected in the major areas of social contention today:

• Energy management to control global warming
• Disease monitoring and control
• Maintaining social – order policing, social services, and so on
• Social equity – such as reducing quality of life gaps

Cities have to deal with these environmental, economic and social challenges. At the same time, wireless technology has evolved from smartphones for people to networking devices (IoT or Internet of Things). One of IoT’s earliest big pushes was into the ‘smart home.’ Unfortunately, this initiative followed the old pattern of capability first. The result has been a large installed base of insecure devices with no clear path for how to secure them.  

Smart cities and the security stakes

This convergence of urbanization and technology evolution is creating pressure for the development of smart cities as a way to increase efficiency while deploying innovative services that can resolve the areas of social contention. Many experts wonder whether smart cities will follow the path of smart homes to great capabilities with little security. If so, this will be a real problem. It is not good when the security of a home is compromised, but the damage is relatively contained.  For a fully interconnected city with large arrays of sensors and actuators affecting all aspects of life, the consequences of compromise are much greater. It can become a survival issue for substantial portions of society.

This raises the question of whether we can make smart cities safe. It is important that we ask and answer this question now, before we end up with large deployments with no clear path to safety.

Australia: leading the way

Australia has emerged as a leader in this area. The country has created a unique partnership between public, private and classified agencies. The premise of its work is that good intentions are necessary but not sufficient. It is not enough to try to design safe deployments; they must be tested, retested, and then tested again. The leaders of Australia’s effort have even gone one step further: they have decided they need to train the defenders in the testing phase.

Their focus is to aggressively train the defenders. As part of this organized effort, the Australian government hosts an invitation-only Cyber War Games to test the current state of smart cities. These are live fire tests against a synthetic city with kinetic properties.

To be effective, it has to be ‘live fire’ testing. But using a real city is dangerous. The use of a synthetic city for testing is important. The experience at Fort Bragg in North Carolina shows that unintended consequences are too likely and too severe to test on real cities. In this case, the military felt they needed to test the base’s infrastructure. In the process, they inadvertently brought down the local community for 12 hours. As William Ratcliffe, former member of the Australian Navy and current CEO TLR Communications Australia says, “You absolutely need to test, but in a controlled environment. Crashing a real city is the worst case.”