devices with patches and updates leaves more than 87% of active android devices vulnerable. privacy, autonomy, and control philip n. howard, a professor and author, writes that the internet of things offers immense potential for empowering citizens, making government transparent, and broadening information access. howard cautions, however, that privacy threats are enormous, as is the potential for social control and political manipulation. concerns about privacy have led many to consider the possibility that big data infrastructures such as the internet of things and data mining are inherently incompatible with privacy. key challenges of increased digitalization in the water, transport or energy sector are related to privacy and cybersecurity which necessitate an adequate response from research and policymakers alike. writer adam greenfield claims that iot technologies are not only an invasion of public space but are also being used to perpetuate normative behavior, citing an instance of billboards with hidden cameras that tracked the demographics of passersby who stopped to read the advertisement. the internet of things council compared the increased prevalence of digital surveillance due to the internet of things to the conceptual panopticon described by jeremy bentham in the 18th century. the assertion was defended by the works of french philosophers michel foucault and gilles deleuze. in discipline and punish: the birth of the prison foucault asserts that the panopticon was a central element of the discipline society developed during the industrial era. foucault also argued that the discipline systems established in factories and school reflected bentham's vision of panopticism. in his 1992 paper "postscripts on the societies of control," deleuze wrote that the discipline society had transitioned into a control society, with the computer replacing the panopticon as an instrument of discipline and control while still maintaining the qualities similar to that of panopticism. peter-paul verbeek, a professor of philosophy of technology at the university of twente, netherlands, writes that technology already influences our moral decision making, which in turn affects human agency, privacy and autonomy. he cautions against viewing technology merely as a human tool and advocates instead to consider it as an active agent. justin brookman, of the center for democracy and technology, expressed concern regarding the impact of the iot on consumer privacy, saying that "there are some people in the commercial space who say, 'oh, big data – well, let's collect everything, keep it around forever, we'll pay for somebody to think about security later.' the question is whether we want to have some sort of policy framework in place to limit that." tim o'reilly believes that the way companies sell the iot devices on consumers are misplaced, disputing the notion that the iot is about gaining efficiency from putting all kinds of devices online and postulating that the "iot is really about human augmentation. the applications are profoundly different when you have sensors and data driving the decision-making." editorials at wired have also expressed concern, one stating "what you're about to lose is your privacy. actually, it's worse than that. you aren't just going to lose your privacy, you're going to have to watch the very concept of privacy be rewritten under your nose." the american civil liberties union (aclu) expressed concern regarding the ability of iot to erode people's control over their own lives. the aclu wrote that "there's simply no way to forecast how these immense powers – disproportionately accumulating in the hands of corporations seeking financial advantage and governments craving ever more control – will be used. chances are big data and the internet of things will make it harder for us to control our own lives, as we grow increasingly transparent to powerful corporations and government institutions that are becoming more opaque to us." in response to rising concerns about privacy and smart technology, in 2007 the british government stated it would follow formal privacy by design principles when implementing their smart metering program. the program would lead to replacement of traditional power meters with smart power meters, which could track and manage energy usage more accurately. however the british computer society is doubtful these principles were ever actually implemented. in 2009 the dutch parliament rejected a similar smart metering program, basing their decision on privacy concerns. the dutch program later revised and passed in 2011. data storage a challenge for producers of iot applications is to clean, process and interpret the vast amount of data which is gathered by the sensors. there is a solution proposed for the analytics of the information referred to as wireless sensor networks. these networks share data among sensor nodes that are sent to a distributed system for the analytics of the sensory data. another challenge is the storage of this bulk data. depending on the application, there could be high data acquisition requirements, which in turn lead to high storage requirements. currently the internet is already responsible for 5% of the total energy generated, and a "daunting challenge to power" iot devices to collect and even store data still remains. data silos, although a common challenge of legacy systems, still commonly occur with the implementation of iot devices, particularly within manufacturing. as there are a lot of benefits to be gained from iot and iiot devices, the means in which the data is stored can present serious challenges without the principles of autonomy, transparency, and interoperability being considered. the challenges do not occur by the device itself, but the means in which databases are warehouses are set-up. these challenges were commonly identified in manufactures and enterprises which have begun upon digital transformation, and are part of the digital foundation, indicating that in order to receive the optimal benefits from iot devices and for decision making, enterprises will have to first re-align their data storing methods. these challenges were identified by keller (2021) when investigating the it and application landscape of i4.0 implementation within german m&e manufactures. security security is the biggest concern in adopting internet of things technology, with concerns that rapid development is happening without appropriate consideration of the profound security challenges involved and the regulatory changes that might be necessary. the rapid development of the internet of things (iot) has allowed billions of devices to connect to the network. due to too many connected devices and the limitation of communication security technology, various security issues gradually appear in the iot. most of the technical security concerns are similar to those of conventional servers, workstations and smartphones. these concerns include using weak authentication, forgetting to change default credentials, unencrypted messages sent between devices, sql injections, man-in-the-middle attacks, and poor handling of security updates. however, many iot devices have severe operational limitations on the computational power available to them. these constraints often make them unable to directly use basic security measures such as implementing firewalls or using strong cryptosystems to encrypt their communications with other devices - and the low price and consumer focus of many devices makes a robust security patching system uncommon. rather than conventional security vulnerabilities, fault injection attacks are on the rise and targeting iot devices. a fault injection attack is a physical attack on a device to purposefully introduce faults in the system to change the intended behavior. faults might happen unintentionally by environmental noises and electromagnetic fields. there are ideas stemmed from control-flow integrity (cfi) to prevent fault injection attacks and system recovery to a healthy state before the fault. internet of things devices also have access to new areas of data, and can often control physical devices, so that even by 2014 it was possible to say that many internet-connected appliances could already "spy on people in their own homes" including televisions, kitchen appliances, cameras, and thermostats. computer-controlled devices in automobiles such as brakes, engine, locks, hood and trunk releases, horn, heat, and dashboard have been shown to be vulnerable to attackers who have access to the on-board network. in some cases, vehicle computer systems are internet-connected, allowing them to be exploited remotely. by 2008 security researchers had shown the ability to remotely control pacemakers without authority. later hackers demonstrated remote control of insulin pumps and implantable cardioverter defibrillators. poorly secured internet-accessible iot devices can also be subverted to attack others. in 2016, a distributed denial of service attack powered by internet of things devices running the mirai malware took down a dns provider and major web sites. the mirai botnet had infected roughly 65,000 iot devices within the first 20 hours. eventually the infections increased to around 200,000 to 300,000 infections. brazil, colombia and vietnam made up of 41.5% of the infections. the mirai botnet had singled out specific iot devices that consisted of dvrs, ip cameras, routers and printers. top vendors that contained the most infected devices were identified as dahua, huawei, zte, cisco, zyxel and mikrotik. in may 2017, junade ali, a computer scientist at cloudflare noted that native ddos vulnerabilities exist in iot devices due to a poor implementation of the publish–subscribe pattern. these sorts of attacks have caused security experts to view iot as a real threat to internet services. the u.s. national intelligence council in an unclassified report maintains that it would be hard to deny "access to networks of sensors and remotely-controlled objects by enemies of the united states, criminals, and mischief makers... an open market for aggregated sensor data could serve the interests of commerce and security no less than it helps criminals and spies identify vulnerable targets. thus, massively parallel sensor fusion may undermine social cohesion, if it proves to be fundamentally incompatible with fourth-amendment guarantees against unreasonable search." in general, the intelligence community views the internet of things as a rich source of data. on 31 january 2019, the washington post wrote an article regarding the security and ethical challenges that can occur with iot doorbells and cameras: "last month, ring got caught allowing its team in ukraine to view and annotate certain user videos; the company says it only looks at publicly shared videos and those from ring owners who provide consent. just last week, a california family's nest camera let a hacker take over and broadcast fake audio warnings about a missile attack, not to mention peer in on them, when they used a weak password." there have been a range of responses to concerns over security. the internet of things security foundation (iotsf) was launched on 23 september 2015 with a mission to secure the internet of things by promoting knowledge and best practice. its founding board is made from technology providers and telecommunications companies. in addition, large it companies are continually developing innovative solutions to ensure the security of iot devices. in 2017, mozilla launched project things, which allows to route iot devices through a safe web of things gateway. as per the estimates from kbv research, the overall iot security market would grow at 27.9% rate during 2016–2022 as a result of growing infrastructural concerns and diversified usage of internet of things. governmental regulation is argued by some to be necessary to secure iot devices and the wider internet – as market incentives to secure iot devices is insufficient. it was found that due to the nature of most of the iot development boards, they generate predictable and weak keys which make it easy to be utilized by man-in-the-middle attack. however, various hardening approaches were proposed by many researchers to resolve the issue of ssh weak implementation and weak keys. iot security within the field of manufacturing presents different challenges, and varying perspectives. within the eu and germany, data protection is constantly referenced throughout manufacturing and digital policy particularly that of i4.0. however, the attitude towards data security differs from the enterprise perspective whereas there is an emphasis on less data protection in the form of gdpr as the data being collected from iot devices in the manufacturing sector does not display personal details. yet, research has indicated that manufacturing experts are concerned about "data security for protecting machine technology from international competitors with the ever-greater push for interconnectivity". safety iot systems are typically controlled by event-driven smart apps that take as input either sensed data, user inputs, or other external triggers (from the internet) and command one or more actuators towards providing different forms of automation. examples of sensors include smoke detectors, motion sensors, and contact sensors. examples of actuators include smart locks, smart power outlets, and