5G Presents Opportunities for Everyone, and That’s the Problem

I need a new phone, and I’m skeptical enough about 5G availability that I’m likely to not bother getting a 5G-enabled phone. I live at the periphery of Chicago, not the center, and the odds that my carrier—or any carrier—will build out a 5G microcell infrastructure in my neighborhood before a brand-new phone becomes obsolete are somewhere between zero and nil.

Having said that, 5G promises some remarkable, and problematic, opportunities. Let me start with opportunities for people in our line of business. Then I’ll get to the problems.

A brief review: 5G is an enabling technology for the Internet of Things—that is, devices that need decent high-speed connections to the internet. So-called smart devices include doorbells with video; thermostats programmable over the internet; and the example close to our hearts, two-way speakers that connect to Amazon and Google.

5G means many more devices with high-speed stable connections to the internet. These devices will be able to stream audio; this in turn means automatic speech recognition (ASR) can spread to devices that don’t currently have it. I’ll throw out a quick example: a home smoothie maker. You tell the smoothie maker what ingredients you’re adding, and it helps you track your calories, carbs, fiber—whatever you’re tracking.

The business implications are clear enough. I expect to see companies that provide cloud-based implementations of ASR optimized for 5G interactions, and a swarm of smaller companies that provide specialized services: start-up services, ASR optimization for noisy environments, voice user interface research, multi-vendor integration. The list is endless.

I’ll be happy to find a niche somewhere in there. But I won’t have any IoT devices in my house.

Security consultant Bruce Schneier recently published an article in Foreign Policy titled “5G Security” that discusses various known vulnerabilities of 5G along with structural problems that will bedevil 5G forever. I don’t agree with his solutions, but let’s take his article as a starting point.

I believe the combination of 5G and ASR enables large-scale criminal enterprises in ways that were never possible before. Current attacks against IoT devices were, in large part, directed at using them for another purpose. An attack against home security cameras was not used to steal video; the attack used the internet connection of the cameras to act as “bots” to attack other computers, e.g., to execute denial-of-service attacks. But what happens when we mix in ASR?

Ordinary computer viruses are successful because they can be focused on stealing certain categories of information: email addresses, credit card numbers, passwords, PINs, and the like. They’re so easy to steal that a valid credit card number costs only pennies to buy on the dark web. And they’re easy to steal because they have labels (PIN numbers go into little boxes marked “PIN”) or they follow certain patterns (e.g., email addresses). The criminal does not have to upload your entire drive; he can upload just some information.

Now imagine that a criminal compromises your 5G-enabled, speech-enabled IoT device. If he has to listen to the entire stream—and the streams of all the other devices he’s compromised—the task of finding “interesting” information is impossible. But perhaps the criminal has access to inexpensive ASR along with other speech tools. Now he can pick out key words and phrases, and some of them will be lucrative—a chat with your local bank, for example. Years ago I speculated that one day we’d see a subscription service for burglars, based on scanning radio-frequency identification chips from a distance in people’s homes (and I still think it will happen). With good enough ASR, maybe that service could also include notifications on when the home would be empty.

Many of my technically oriented friends and I just don’t buy streaming appliances. If we want a net-enabled thermostat or camera, we make certain to purchase ones that can be firewalled, i.e., that don’t require connection to a cloud-based server, or that have software we can wipe and replace. But with 5G, I expect appliances (such as washing machines) to have 5G chips that connect to the cloud whether I want them to or not.

I’m afraid there are no good solutions. I’m fairly confident I can maintain decent security for myself, but what about the small business that asks for my credit card number over the phone? Just like we’ve all grown used to a constant stream of major compromised computer systems and identity theft, the public at large may learn to accept that criminals overhear their most personal conversations. 

Moshe Yudkowsky, Ph.D., is the president of Disaggregate Consulting and author of The Pebble and the Avalanche: How Taking Things Apart Creates Revolutions. He can be reached at speech@pobox.com.