While DOD does not have a standard, department-wide definition of the IoT, the department has identified a number of existing definitions of it. As noted previously, a 2016 Defense Science Board study defined the IoT as the set of Internet Protocol-addressable devices that interact with the physical environment, noting that “IoT devices typically contain elements for sensing, communications, computational processing, and actuation.” The study identified that IoT devices span a range of complexity and size, including thermostats, traffic lights, televisions, mini-drones, and full-size vehicles. A 2016 DOD Chief Information Officer policy paper on the IoT cited a definition from a non-DOD organization. According to this definition, the IoT consists of two foundational things: 1) the Internet itself, and 2) semi-autonomous devices (the “things”) that leverage inexpensive computing, networking, sensing, and actuating capabilities in uniquely identified implementations to sense the physical world and act on it. Such devices have the capability to connect to the Internet, being Internet Protocol-based, but may also be deployed in stand-alone Internet Protocol networks. These DOD IoT definitions describe devices having the characteristics of sensing, communicating (or networking), computing (or processing), and actuating, and all leveraging the Internet Protocol. Figure 1 depicts typical data flows from a range of IoT devices— smartphones, smart watches, cars, buildings, and televisions—where data are collected, transmitted, and analyzed before leading to commands back to the devices or inputs to decision makers. Consumers and senior leaders in industry or public-sector organizations, such as DOD, can potentially act on IoT device data. In a 2016 report, we provided a primer on the IoT that highlighted key benefits of IoT devices, categories of devices, a future outlook for IoT, and security challenges posed by the devices. We reported that security vulnerabilities in many IoT devices can arise for several reasons, including (1) a lack of security standards addressing unique IoT needs; (2) a lack of better incentives for developing secure devices; and (3) the decreasing size of such devices—which limits the computational power that is currently available to implement security protections. The primer cites reports of wireless medical devices being taken over and controlled; of a widespread wireless standard for IoT devices used in smart energy being compromised; and of gas stations’ tank-monitoring systems having no passwords, thereby potentially exposing the pumps to a risk of being shut down. These security challenges could potentially impact DOD hospitals and facility energy and fuel systems where managers may consider using or deploying IoT devices. In May 2017, we issued a technology assessment on the IoT that defined the concept of the IoT, described its uses, highlighted its benefits, and discussed its potential implications, including security challenges. We reported that adoption of the IoT across the different sectors has amplified the challenge of designing and implementing effective security controls by bringing the potential effects of poor security into homes, factories, and communities. In addition, the technology assessment noted a security risk whereby unauthorized individuals or organizations might gain access to these devices and use them for potentially malicious purposes, including fraud or sabotage. The lack of attention to security in designing IoT devices and the predominant use of cloud computing to provide connectivity with these devices pose unique security challenges. These challenges have direct implications for DOD as the department considers how to develop and deploy these devices. As cyber threats grow increasingly sophisticated, the need to manage and bolster the cybersecurity of IoT products and services is increasingly critical, according to our technology assessment. According to the assessment, while many industry-specific standards and best practices address information security, standards and best practices that are specific to IoT technologies are either still in development or not widely adopted. Any device that is connected to the Internet is at risk of being compromised if it does not have adequate access controls. According to DOD officials, no one specific DOD office or entity is responsible for IoT security. Instead, various DOD organizations have roles and responsibilities related to IoT security risks. For example, Office of the DOD Chief Information Officer is charged with developing the department’s cybersecurity policy and guidance, as well as policy regarding the continuous monitoring of DOD information technology. The DOD Chief Information Officer has issued instructions on cybersecurity, a risk management framework for DOD information technology, and the use of Internet-based capabilities to collect, store, and disseminate information. Within the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics, the Office of the Assistant Secretary of Defense for Energy, Installations, and Environment oversees the cybersecurity of industrial control systems on DOD’s facilities— systems that contain IoT devices—and establishes design criteria for these systems that include cybersecurity requirements. Office of the Under Secretary of Defense for Intelligence establishes and oversees the implementation of policies and procedures for the conduct of DOD operations security, physical security, and information security. The office has established policy calling for all DOD missions, programs, functions, and activities to be protected by an operations security program. Office of the Principal Cyber Advisor to the Secretary of Defense is responsible for overall supervision of cyber activities related to, among other things, defense of DOD networks, including oversight of policy and operational considerations. Joint Staff provides guidance on mission assurance assessments— installation-level assessments that integrate information on asset criticality, area-specific hazards and threats, and vulnerabilities to be exploited—and consolidates reporting. The assessments should include benchmarks for the cybersecurity of wireless and portable electronic devices. Military services and DOD agencies are to conduct assessments and surveys of their operations security. Additionally, military services and DOD agencies are to delegate responsibilities for mission assurance assessments and to ensure that information technology under their authority complies with the department’s risk management framework. Defense Information Systems Agency provides security guidance for DOD-owned smartphones and wireless systems. Command Cyber Readiness Inspection teams conduct oversight and assess implementation of this guidance, according to DOD officials. DOD documents and officials identified numerous security risks with IoT devices—as highlighted in table 1—that can generally be divided into risks with the devices themselves and risks with the devices’ operational implications. IoT devices pose numerous risks by how they are designed, manufactured, and configured. According to DOD officials, there is little incentive for manufacturers to design security functions into the software or hardware of their products, resulting in little thought or effort given to security. A DOD Chief Information Officer policy paper also states that IoT devices may be subverted during their manufacture and distribution at various points in the supply chain—thereby rendering the cyber attacker’s job easier. With respect to IoT configuration, a DOD report in 2016 notes that IoT devices are often sold with old and unpatched software that can lead to the device being exploited as soon as it is taken out of the box. Poor password management is another cybersecurity risk. According to the DOD report, a majority of IoT cloud services allow the user to choose weak passwords—such as “1234”—and, in some cases, prevent the user from using strong passwords. Given their functionality and capabilities, IoT devices also pose security risks with their operational implications. DOD officials told us that rogue wireless devices in secure areas could provide a pathway for adversaries to collect classified or sensitive information. For example, a cell phone could be concealed and “pocket dialed” such that ambient conversations are recorded or transmitted. Similar to rogue wireless devices, rogue applications also pose risks. According to a DOD report, in 2016 a smartphone gaming application was released that makes use of the global positioning system and the camera of the device on which it is installed. The report cautions that installing the game may lead to the application gaining full access to a user’s email account. Whether on personal or DOD-issued devices, the potential of such applications to collect location and photographic data on DOD personnel or units and communicate this data to third parties has raised DOD operations security risks. DOD’s 2016 DOD Policy Recommendations for the Internet of Things (IoT) also laid out operations security implications of IoT devices, particularly with the expanded aggregation of information. Specifically, it discussed how information collected through various IoT devices and then aggregated could inform adversaries about DOD capabilities or deployments. For example, an adversary could gather information related to which people were present or which organizations were working overtime. The department has also identified notional threat scenarios that exemplify how these security risks could adversely impact DOD operations, equipment, or personnel. DOD documents and officials from a number of organizations—including the Office of the Secretary of Defense, Joint Force Headquarters-DOD Information Networks, and the Navy—discussed with us a number of notional threat scenarios. Figure 2 highlights a few examples of these scenarios. The first notional IoT scenario, the “sabotage of mission,” illustrates a few security risks that could adversely impact DOD operations. The increase of IoT devices used to monitor and control DOD infrastructure could increase the number of attack points through which a network or system could be attacked. Many of these devices are insecure because of a limited ability to patch and upgrade devices, or due to poor security design. As a result, the successful penetration of a smart electrical meter could lead to cascading effects that negatively impact an industrial control system and degrade an ongoing mission. In the second notional IoT scenario, “sabotage of equipment,” the combination of poor password management and an insider threat could lead to unauthorized access to a utility system, such as a water system in a dry dock. The insider threat could then manipulate the water control system to flood the dry dock and damage the ship, according to Navy officials. The third notional IoT scenario, “operations security and intelligence collection,” illustrates the adverse impacts on operations security that can emerge from smart televisions. The scenario involves a television with limited cybersecurity controls being targeted by commercial providers or adversaries to collect information for malicious purposes.