This first step summarizes the scenario in question and explains its context – who are the main actors in the scenario, what happens to them or what they do, how far into the future is the scenario set, where it takes place and in what domain (home, office, on the move, shopping, etc). It identifies the type of scenario (trend, normative, explorative) and key assumptions (e.g. intelligent technologies will be embedded everywhere in rich countries, but not in poor countries).

Next, we identify the most important AmI technologies and/or devices used and/or implied in the scenarios.

We consider the applications that emerge in each scenario and that are supported by the technologies mentioned in the previous step.

At this step in the analysis, we identify the key drivers that impel the scenario or, more particularly, the development and use of the applications. Drivers are typically socio-economic, political or environmental forces (e.g. the Data Mining Corporation seeks a global monopoly, economic disparities are inflaming poor countries, the world is becoming a hothouse) or personal motivations (e.g. greed).

Next, we identify and explicate the major issues raised by the scenario. In the SWAMI scenarios, the issues of concern, as mentioned above, are privacy, identity, trust, security and inclusiveness (or its opposite, the digital divide). A discussion of the issues considers the threats and vulnerabilities exposed by the scenario as well as their impacts and legal implications.

The final step is a reality check of the scenario itself (how likely is it? are the technologies plausible?) and a consideration of what should be done to address the issues it raises. One might conclude, as the SWAMI partners did, that a range of socio-economic, technological and legal safeguards are needed in order to minimize the risks posed by the threats and vulnerabilities highlighted by the scenario.

In a world of ambient intelligence, the threats to our privacy multiply. In an AmI world, we can expect to be under surveillance (“transparent”) wherever we go because the permanent and real-time registration and processing of our presence and behavior is the precondition – the “code” – of ambient intelligence.

The threats to our privacy, however we define it, can come from many different sources. Here are some of the principal ones that affect us today and we can assume will still be threats in an AmI world. Many of these threats are also threats for identity and security:

• hackers and attackers;
• function creep, which occurs when data collected for one purpose are used for another;
• surveillance;
• profiling;
• lack of public awareness or concern about privacy rights;
• lack of enforcement and oversight of privacy rights;
• erosion of rights and values;
• uncertainties about what to protect and about the costs of protection;
• uncertainties about the economic costs of privacy erosion;
• lax security on our part or on the part of those who are supposed to be protecting our data; and
• government and industry are less than forthright about the personal data they collect and/or how they use that data.

Identity is associated with an individual as a convenient way to characterize that individual to others. The set of information and the identifier (name, label or sign) by which a person is known are sometimes referred to as that person's “identity”. The choice of information may be arbitrary, linked to the purpose of the identity verification (authentication) in any given context, or linked intrinsically to the person, as in the case of biometrics.

Threats to our identity can come from various sources, among which are the following:

• identity theft;
• function creep;
• exploitation of linkages by industry and government;
• penetration of identity management systems (hacking, spoofing, denial of service, etc);
• authentication may intrude upon privacy;
• complexity of identity management systems;
• failures in identity management systems & authentication systems;
• people do not take adequate care to protect their cyber identity(-ies); and
• misplaced trust in security mechanisms.

The issue of trust from the user's perspective would seem to merit greater consideration and more detailed study than heretofore has been the case. One of the most important inhibitors to public acceptance of the Internet for human interactions (commercial or otherwise) has been the lack of trust in the underlying cyber infrastructure and in other people whom we meet through that infrastructure.

SWAMI categorised threats to and vulnerabilities in trust in four areas: inadequate profiling, loss of control (which could be real or we believe we don't have control), service refusal and discrimination, and victimization. These areas are closely interrelated. For instance, poor profiling is a problem because the promised customization might be deficient and, at the same, because it represents a precondition for certain denials of services. Moreover, as the concept of trust is multi-dimensional, largely intangible and encompasses interdependent relationships, problems primarily related to privacy, identity, security and the digital divide are relevant for the issue of trust as well.

The traditional taxonomy of security threats distinguishes between three main aspects in which threats may appear: confidentiality, integrity and availability (Stajano and Anderson, 2002). Confidentiality implies protection of information from unauthorized use, integrity implies protection of information from unauthorized modification, and availability implies that the system is capable of providing a service when users expect it. The protection properties all rely on the distinction between authorized and unauthorized entities. Protecting confidentiality, integrity and availability is more difficult in a ubiquitous computing environment than in traditional networks for the following reasons:

• possible conflict of interests between communicating entities;
• network convergence;
• large number of ad hoc communications;
• small size and autonomous mode of operation of devices; and
• resource constraints of mobile devices.

Security threats and vulnerabilities fall into two major groups: malicious and unanticipated system behavior. Malicious system behavior can be caused by viruses, worms, Trojans, phishing, denial of service attacks or physical tampering. Unanticipated system behavior or failure is due to inadequate design, e.g. internal complexity and lack of user-friendliness.

Apart from the ISTAG scenarios, the digital divide issue has scarcely figured in any AmI-related projects, although the EC has initiated a significant eInclusion programme[4].

In general, it seems that AmI will narrow some gaps while widening existing or creating new ones at the same time. Physical access to AmI equipment and infrastructure is likely to improve, since AmI applications will form an intrinsic part of our every day lives and the basic infrastructure is bound to envelop the majority of the people. The AmI infrastructure will become cheaper and more affordable for larger parts of society (although it could also be argued that the network will be more complex, thus the cost higher for the providers). Furthermore, because of the envisioned user friendliness of AmI technology, the required skills and knowledge for its use will be less than that required today to use mobile phones, personal computers and the Internet, thus enabling more people to use its applications and receive the expected benefits. The majority of people are expected to be at least moderately computer literate, especially given the extent of use of technologies in everyday life.

On the other hand, there will still be a percentage of the population that will not have access to AmI applications and even a greater percentage that will have access only to basic infrastructure and not to more sophisticated devices, thus excluding them from accessing the full benefits of the AmI environment. Moreover, skills and knowledge remain a limiting factor. In a society with extreme levels of technology pervasiveness, people who do not possess the knowledge or the skills to use AmI will be more seriously excluded than today.

Serious concerns exist about the persistence of digital divides with regard to income, education and specific age groups, as well as gender and race / ethnicity. The global dimension of the digital divide between developed and developing countries is likely to remain the same or even grow. As long as the gap between developing and developed nations in general does not close, the digital divide will also widen, especially as new technologies emerge, which the under-developed societies do not have access to or cannot use. In effect, certain regions will most likely face the problem of accumulated digital divides.

The main privacy-protecting principles in network applications are:

• anonymity (possibility to use a resource or service without disclosure of user identity);
• pseudonymity (possibility to use a resource or service without disclosure of user identity, but still be accountable for that use);
• unlinkability (possibility to use multiple resources or services without others being able to discover that these resources were used by the same user); and
• unobservability (possibility to use a resource or service without others being able to observe that the resource is being used) (ISO, 1999).

A second important difference between existing network applications and emerging AmI applications is that neither mobile devices nor web usage penetrates through such strong privacy protecting borders as walls (it is rarely 100 per cent certain who sends a request from a particular IP address or uses a mobile device) and the human body, while physiological, video and audio sensors, proposed for AmI applications, will have much stronger capabilities to identify a person and to reveal personal activities and feelings.

Consequently, future AmI applications in smart environments will require stronger safeguards, many of which are not yet fully developed. In our third SWAMI report[5], we proposed research directions for developing privacy-protecting safeguards in future AmI settings, among which are the following:

• communication protocols which either do not require a unique device identifier at all or which require authorization for accessing the device identifier;
• network configurations that can hide the links between senders and receivers of data;
• improving access control methods by multimodal fusion, context-aware authentication and unobtrusive biometric modalities (especially behavioral biometrics, because they pose a smaller risk of identity theft) and by liveness detection in biometric sensors;
• enforcing legal requirements and personal privacy policies by representing them in machine-readable form and attaching these special expressions to personal data, so that they specify how data processing should be performed, allow a privacy audit and prevent any other way of processing;
• developing fast and intuitive means of detecting privacy threats, informing the user and configuring privacy policies;
• increasing hardware and software capabilities for real-time data processing in order to minimize the lifetime and amount of raw data in a system;
• developing user-friendly means to override any automatic settings in a fast and intuitive way;
• increasing security by detection of unusual patterns;
• increasing software intelligence by developing methods to detect and to hide sensitive data; to understand ethics and etiquette of different cultures; to understand and translate human speech in many languages, including a capability to communicate with the blind and deaf; and
• developing user-friendly means for recovery when security or privacy has been compromised.

Co-operation between producers and users of AmI technology in all phases from R&D to deployment is essential to address some of the threats and vulnerabilities posed by AmI. The integration of or at least striking a fair balance between the interests of the public and private sectors will ensure more equity, interoperability and efficiency. Governments, industry associations, civil rights groups and other civil society organizations can play an important role in balancing these interests for the benefit of all affected groups.

Among the socio-economic safeguards we propose are those involving:

• standards, such as ISO 15408 and ISO 17799 on IT privacy and security respectively;
• privacy audits;
• codes of practice;
• trust marks and trust seals;
• reputation systems and trust-enhancing mechanisms;
• service contracts with strong privacy protections;
• guidelines for ICT research;
• emphasis on security and trustworthiness in public procurement;
• accessibility and social inclusion;
• raising public awareness;
• including privacy, identity and security issues in the professional education curriculum of computer scientists; and
• media attention, bad publicity and public opinion.

SWAMI identified some serious legal problems when applying the existing legal framework to address the intricacies of an AmI environment. We found that most of the challenges arising in the new AmI environment should be addressed by transparency tools (such as data protection and security measures). Transparency should be the default position, although some prohibitions referring to political balances, ethical reasons or core legal concepts should be considered too[6].

A set of rules needs to be envisaged to guarantee procedural safeguards similar to those currently applicable to the protection of our homes against state intervention (e.g. requiring a search warrant). Technical solutions aimed at defending private digital territories (the private sphere of the individual no matter where he is) against intrusion should be encouraged and, if possible, legally enforced. The individual should be empowered with the means to freely decide what kind of information he or she is willing to disclose. Such protection could be extended to the digital movement of the person, that is, just as the privacy protection afforded the home has been or can be extended to the individual's car, so the protection could be extended to home networks, which might contact external networks.

All employees should always be clearly and a priori informed about the employee surveillance policy of the employer (when and where surveillance is taking place, what is the finality, what information is collected, how long it will be stored, what are the (procedural) rights of the employees when personal data are to be used as evidence, etc.).

The status of pseudonymity under the law needs further clarification. A pseudonym prevents disclosure of the real identity of a user, while still enabling him to be held responsible to the other party if necessary. It may provide a privacy tool, and remedy against profiling. Using different pseudonyms also prevents the merging of profiles from different domains. It is, however, unclear what is the legal status of pseudonyms (whether they should be regarded as anonymous data or as personal data falling under the data protection regime).

The obligation of data protection law to inform the data subject about when and which data are collected, by whom and for what purpose gives the data subject the possibility to react to mistakes (and thus to exercise his right to rectification of data) or abuses, and enables him to enforce his right in case of damage. It would be desirable to provide the individual not only with information about what data relating to him are processed, but also what knowledge has been derived from the data. This might imply a rethinking of data protection law.

A means to prevent data laundering could be envisaged which would create an obligation for those who buy or otherwise acquire databases, profiles and vast amounts of personal data, to check diligently the legal origin of the data. Without checking the origin and/or legality of the databases and profiles, one could consider the buyer equal to a receiver of stolen goods and thus held liable for illegal data processing. An obligation could be created to notify the national Data Protection Officers when personal data(bases) are acquired. Those involved or assisting in data laundering could be subject to criminal sanctions.

Profiling practices and the consequent personalization of the ambient intelligence environment lead to an accumulation of power in the hands of those who control the profiles and should therefore be made transparent.

The Commission should ensure that privacy, identity, trust, security and digital divide issues are taken into account in any project it supports.

Research on technologies that could help protect our privacy and strengthen the security of networks and devices (against attackers and other vulnerabilities), and that could help to minimize the digital divide should be increased.

Consultations like that undertaken by the EC on RFIDs[7] should be considered with regard to other relevant technologies and concepts, e.g. biometrics and interoperability. The implications for privacy caused by other technologies, such as location-tracking systems, physiological sensors, video and audio sensors should be evaluated, and good practices in use of these technologies should be developed and widely promulgated.

A legal framework for sharing knowledge from AmI-generated profiles should be developed, as well as legal protection of technical solutions enabling such information management. A legal framework is needed to cover automated protocols for privacy policy negotiations as well as automated schemes that imply the consent of the data subject. The legal framework should cover situations wherein the explicit consent of the data subject for each collection of data is replaced by a “consent” given by an intelligent software agent.

The Commission should consider development of legal rules with regard to issues that are specific to AmI. In that respect, we propose that legal schemes be developed for digital territories as an important safeguard of privacy in the digital world of AmI. Especially, we propose that such territories be protected against unlawful and unnecessary interference. The specific legal schemes would also be necessary to address the use of software agents and privacy-enhancing technologies (PETs).

The Commission should take steps to ensure that the consumer is always aware of any potentially privacy-threatening software or device embedded in any product he purchases. Product warnings and consumer notifications should always be in place.

In the procurement of ICT products or services, Member States should give emphasis to critical issues such as security and trustworthiness.

Member States should consider introducing legislative prohibitions on the admissibility (or general acceptance of the exclusionary rule) of evidence obtained through privacy and/or data protection law infringements.

Appropriate authorities (e.g. the Data Protection Officer) should control and authorize applications of implants after the assessment of the particular circumstances in each case. When an implant enables tracking of people, people should have the possibility to disconnect the implant at any time and they should have the possibility of being informed when a (distant) communication (e.g. through RFID) is taking place.

Governments that have not yet done so should ratify the Cybercrime Convention. The Convention should have a “revision” mechanism so that signatories could negotiate and include in the convention definitions of new, emerging cybercrimes. Specific provisions criminalizing identity theft and (some forms of) unsolicited communication could be included within the scope of the convention.

A means to prevent data laundering could be an obligation imposed on those who buy or otherwise acquire databases, profiles and vast amounts of personal data, to check diligently the legal origin of the data.

Following the subsidiarity principle, Member States and/or regional or local authorities should take responsibility for improving citizen awareness and education in regard to privacy, identity, security and trust issues associated with AmI.

Industry should recognize that it is in their interest to reduce consumer distrust by enhancing transparency by effectively informing users about system procedures, purposes and responsibilities about latent operations and what measures they have put in place to avoid data misuse. Industry should take the initiative to ensure that any networked device, particularly those used by consumer-citizens, comes with a privacy warning much like the warnings on tobacco products.

All employers should clearly inform employees about their employee surveillance policy.

Organizations that compile databases with personal data (even if such compilation is incidental to their primary lines of business) should state on their websites and on their products to what extent they are compliant with ISO 17799 (ISO, 2005) and/or how they have implemented the standard. An organization could also mention to what extent they follow other guidelines dealing with privacy and security, such as those produced by the OECD[8].

Industry should expend less effort on fighting new regulations and more effort on involving stakeholders in the assessment and management of risks to privacy, identity, trust, security and inclusiveness. Involving stakeholders at an early stage will minimize downstream risks.

An alternative to peer-rating systems are credibility-rating systems based on the assessment of trusted and independent institutions, such as library associations, consumer groups or other professional associations with widely acknowledged expertise within their respective domains. Ratings should be based on systematic assessments against clearly defined quality standards.

Consumer associations and other civil society organizations (CSOs) could play a useful role as a mediator between service providers and individual consumers and, more particularly, in forcing the development of service contracts (whether real or implicit) between the service provider and the individual consumer. Consumer organizations could leverage their negotiating position through the use of the media or other means of communication with their members. CSOs could position themselves closer to the industry vanguard as represented in platforms such as ARTEMIS[9] by becoming members of such platforms themselves. Within these platforms, CSOs could encourage industry to develop “best practices” in terms of provision of services to consumers.

Institutes of higher education should ensure that courses in ICT-relevant disciplines address:

• impacts of ICT on society;
• knowledge from technology assessment or from “impact and design research”; and
• promotion of awareness of development potential for health and the environment in the development phase of new technologies.

Users cannot be innocent bystanders and expect others to look after their interests with regard to privacy and security aspects of the emerging AmI world. We concur with the OECD when it says “Participants [including individual users] should be aware of the need for security of information systems and networks and what they can do to enhance security … Participants should be aware of the … good practices that they can implement to enhance security, and the needs of other participants” (OECD, 2002, p. 10). At the same time, we recognize that such good advice will not (cannot) be taken onboard by all users, children and the elderly being the most obvious example.