Using smart meter data constitutes a search, but court allows them anyway | Cyber Security

US cities using smart meters narrowly escaped a legal problem this month when a court decided that the benefits of these IoT devices outweighed the privacy issues created by collecting detailed home energy data.

The US Court of Appeals for the Seventh Circuit, a federal court that oversees appeals for Illinois, Indiana and Wisconsin, ruled against a privacy advocacy group called Naperville Smart Meter Awareness (NSMA). The group had sued the Illinois City of Naperville over its smart meter program, arguing that the devices give up too much information about residents.

Utilities have been busy installing smart meters across the US for several years now. The US Energy Information Administration counted 70,833,000 in the US in 2016, of which 88% were residential.

While traditional electricity meters gather energy consumption data in a single figure on a monthly basis, smart meters are far more granular. They collect thousands of readings per month, which provide a clearer profile of when and how residents are using electricity. This lets utilities manage their energy flow and improve grid reliability.

However, this increased visibility brings its own concerns for privacy-conscious consumers. Each home appliance has its own energy load signature, which creates a unique fingerprint for it and enables those collecting the energy to understand what people are doing at home.

The data collection creates a privacy issue, said the NSMA. Naperville's meters read energy usage data every 15 minutes and store it for up to three years. Privacy advocates argued that people with access to that information could tell when a home is vacant, when people eat and sleep, and what appliances are in the home. It might even be possible to check electric vehicle charging times to find out about people's travel patterns, it said.

These concerns led the NSMA to claim that smart meter data collection violated the Fourth Amendment of the US Constitution, which prohibits unreasonable searches and seizures.

That data collection isn't something that people can opt out of. In its decision, filed last week, the court said:

While some cities have allowed residents to decide whether to adopt smart meters, Naperville's residents have little choice. If they want electricity in their homes, they must buy it from the city's public utility. And they cannot opt out of the smart-meter program.

It's a search, but is it fair?

The court asked two questions in assessing NSMA's appeal: is the collection of data from smart meters a search, and is it reasonable?

It ruled that using technology to peek in detail at goings-on inside peoples' homes every 15 minutes does constitute a search, but decided that the search was reasonable.

US law decides whether a search is reasonable by balancing its intrusion on Fourth Amendment rights against how much it serves the government's interests, the court said. It decided that smart meter data collection is not very intrusive because the data isn't used to prosecute people.

Conversely, because the collection of smart meter data allows utilities to reduce costs, provide cheaper power to consumers, encourage energy efficiency and increase grid stability, it is very much in the government's interest and can be allowed.

The court had a caveat, though, and warned the City that the balance could change. It concluded:

We caution, however, that our holding depends on the particular circumstances of this case. Were a city to collect the data at shorter intervals, our conclusion could change. Likewise, our conclusion might change if the data was more easily accessible to law enforcement or other city officials outside the utility.

Follow @DannyBradbury
Follow @NakedSecurity