The Evenly Distributed Future: Joe Britt, Hugh Thompson and the Smart Device Revolution

Bret Jordan: We live in a modern hyper- connected world where everything is becoming smart and connected. Curious about what lies ahead and how this will impact your daily life? I'm Bret Jordan and this is Smarter Everything, a podcast on the future of connectivity powered by Afero. Back in 1999, Kevin Ashton, while working at Procter and Gamble, proposed putting radio frequency identifier chips, or what we now call RFID chips, on products so that they could be easily tracked while moving through the supply chain. Since then, the idea, the hype and the promise of smart and connected devices has grown and evolved dramatically. Well, the first smart devices were computers and then phones and then tablets. Today a smart device can be just about anything, so long as it can be connected to or use the internet in some way. It is important to note that smart devices are not limited to just this consumer space, but can be found in various sectors and verticals such as the medical world, supply chain, industrial applications, grid systems, critical infrastructure, and smart cities. Over the past few decades, there has been a lot of hype about what smart devices will be able to do for society. Unfortunately, the reality has not yet lived up to the hype despite a lot of work that has been done by hobbyists, technologists, and early adopters. In this first episode, we will explore where we are in the evolution of smart things and where we expect to be in the near future. We'll uncover the roadblocks to success and why this has not lived up to the hype. My guests today are Joe Britt, founder and CEO of Afero, and Dr. Hugh Thompson, a leader in the cybersecurity space globally. In today's first episode, we will talk about the exciting things about smart and connected devices and what that will mean for us going forward.

Hugh Thompson: I am Hugh Thompson, managing partner at Crosspoint Capital.

Joe Britt: I'm Joe Britt, one of the co- founders and the CEO of Afero.

Bret Jordan: Thank you both for joining today. This is going to be a wonderful discussion. I'd like to start with a question to both of you on what is the most exciting and intelligent, interactive, what is the thing that you've seen recently in the smart and connected world that you've just really been intrigued by?

Hugh Thompson: It's hard to pick. So it's a holiday season and I've got five young kids, and so just the toys that you never imagine would be connected are connected. I'll give you an example. My son is very excited about something that's the equivalent of a Rubik's Cube, that is using magnetism to get rid of the friction. So you can very quickly move these cubes around and solve them, but it's completely connected. It's tied in to an iPhone app, and in fact, there is this tiny robot that hooks into all four sides of it and can solve it for you right away. And what's sort of an interesting implication of this is that cube, even when you're outside of using it with the app that knows exactly where each square is and what's the optimized way to get it back, that will be connected and it's a Bluetooth as far as I can tell. We haven't actually opened it yet, but we've got so many things around us that are yearning to be further connected. The beaconing on Bluetooth, just being kind of one tiny example. But I think the thing that surprised me is how many devices that have some kinetic component to them are being connected so quickly, whether it's a heating element or moving, and I'm not talking about giant industrial control systems, I'm just talking about normal household items. And you think about that and there are some profound security implications, some profound risk implications, some of profound maybe even nation state attack implications to going after a bunch of kinetic devices at once and just causing chaos. So I think it continues to, I don't know, it continues to surprise me how connected we are becoming. And it's not one thing, it's everything. It's getting to the point where you're surprised that you buy something and it's not connected. Someday I'm going to get a pencil and pick it up and I'm like, " Why isn't this thing connected? What's wrong with this?" We're close to a tipping point.

Joe Britt: I agree. And that is an incredibly cool use case about the Rubik's Cube with the magnetic bearings in the robot that can help solve it. I mean, what a time to be alive, but when I think about this, the question of what's the coolest connected thing that I've seen? I'm of two minds, really. There's cool devices like the one that Hugh mentioned. I recently got a dog, and there's a pet feeder that one of the features, it's got a camera and one of the features is that you can watch your pet on your phone and then remotely you can push a button and it'll actually push up a treat out, throw a treat out for the dog, right? Seems like a really cool idea. It's a really cool idea, I think for humans. Again, there's a kinetic component like Hugh was talking about. It's a little terrifying for dogs because they're not really accustomed to inanimate objects like just throwing treats. That's no problem. The dog is totally happy to accept the treat. But I think there's this interesting sort of tension between things that are techy cool for people, and then things that are cool in kind of a meaningful way to humanity. And I think that's getting back to the point that Hugh was talking about, about everything being connected. Before this show, I was trying to think of analogies for things that were techy and cool and advanced when they first came out, and now they're just table stakes. We take them for granted. And the first one I thought of was just running water. You would think it would be really strange if you went to your friend's house and they didn't have an indoor bathroom or they didn't have sinks with running water, but that did not become commonplace in the United States until the 1930s. So we've lived with that for a very, very long time. And so I think this is, there's two pieces that come away from this. One, things that we consider to be common today, used to be really techy and advanced, and that's where we're going with connected devices. To Hugh's point more and more and more things that you go and buy at the store, you're surprised if there's not a connected version. That's a great signal that we are approaching that period, where connected devices become, like running water, it's just an expectation. You go to somebody's house, you will at some point just expect to be able to talk to the house and have it respond to you. And I think we're kind of at the knee of this really powerful curve now, where certainly techy people have gotten a taste of that for a few years. But now with the emergence and commonplace nature of smartphones, smart speakers and every device that you buy, having the opportunity to get a connected version is a sign that we are very rapidly progressing into that future where connected stuff is not special, it's just expected, right? But I think there's other parallels as well. When you talk about the distribution of water, that's obviously a health issue as well. How do you make sure it's pure? How do you make sure it's clean? How do you process the water? How do you know that, that is safe? And these were really hard problems that had to be solved, and they're analogous to a lot of the hard problems that we're facing today, around security for these connected devices. How do we make it? So that not only can I enjoy the convenience of something that's connected, but trust it and know that it's not going to hurt me or my family. And I think that's really at the core of what's most exciting. Back to your question, Bret, about what's the most exciting thing I've seen? Well, the most exciting thing I've seen is the emergence of a recognition that taking the security of these connected products seriously is incredibly important and something that has to be paid attention to.

Bret Jordan: Yeah, I would agree. I've been banging on this drum for a long time that this is a risk, and clearly as you just mentioned, the technologists and the hobbyists have been exposed to this IoT environment for quite some time, but it's just recently over maybe the past year, year and a half, two years, that it's really starting to gain traction in the mass market. And so there's a part I want to come back to and there's a thread there that I want to pull on, but I just wanted to tell you the thing that I think is the most exciting, and it's kind of really simple, and it's the smart plug. I've been going around and buying these for my neighbors and I've been buying these Hubspace smart plugs, you get them at Home Depot, whatever. But my wife loves them and now it's like whenever we go we have to fill the shopping cart up because she's like, " I want to plug here and I want to plug there." And she wants to pull up her phone and be able to just say, " Turn on Christmas." And it just turns on like Christmas everywhere in the house and she doesn't have to think about it. She doesn't have to go crawl around on the floor and plug stuff in or worry about, " Well, I turned on the Christmas tree upstairs, but I forgot the one downstairs." And she's just hooked on the simplicity and the ease of this. And I think that is what makes me so excited is we've gone from a world where it was just hobbyists and technologists that were doing all of this. Coding and all this really weird if then statement things to make everything work, and they're building custom apps. And now the average person can just go by, like I said, these Hubspace light bulbs and smart plugs, plug them in, use your phone and it just works. And my wife and all my neighbors, I started going around and passing these out to my neighbors and everyone's Christmas tree is now has these little plugs. But I think that for me has been one of the coolest things that I've seen is just how easy and secure it is becoming.

Joe Britt: Bret, you're like the Johnny Appleseed of smart home. You're just traveling everywhere and throwing these smart plugs out and all the apple trees are growing, all the people are learning about this stuff. It's cool.

Bret Jordan: Well, and it's easy. I don't get questions and people coming back and saying, " Well, how does it work?" Or" I'm having issues." And I think that is the testament that we've matured from this technology space where you have to fiddle and tinker and do all these weird things to something that's just usable. You were talking about a little bit of a thread I'd like to pull on Joe, and that is about this evenly distributed technology, and maybe you could maybe talk a little bit about that. Maybe Hugh, you could comment from what you've seen. I know you run RSA Conference, you're part of all of these national security things, and what is that evenly distribution of technology, maybe why has it been a little slow to come to market? The blockers, the challenges?

Joe Britt: Yeah. I think you're referring to a William Gibson quote and he said that" The future's already here, it's just not evenly distributed." Right?

Hugh Thompson: Great quote.

Joe Britt: It is. It's a great quote. It's a great idea. And I think if you look at history, you see that play out over and over again. Talking about the water analogy earlier, 1930s in the US. The first place that got water was a hotel in the 1830s. So it was possible a hundred years before everybody had it. And there were similar things with electricity. You were talking about the Christmas tree lights, right? I remember reading that when home electrification first came along, people were really concerned. They're like, " This could burn my house down. I don't understand how it works." And so there's this latency from technology being available to technology really being commonplace. And if you look at every kind of major consumer technology, whether it's radio or television or the telephone or the internet, there's these long lags and then there's this crazy exponential growth. And while people have been talking about smart home for a long time, there's a number of components that have to come together to create the perfect storm to allow that exponential curve to take off. And the really exciting thing is that it feels like based on experiences, you're having in handing out smart plugs because you as an experienced security researcher can feel confident in what you're giving to your friends and family to put in their homes because you understand how the technology works and the proliferation of Wi- Fi and high speed internet in the home and of smartphones, all the pieces are there. All we need now is the spark that's going to actually catalyze the reaction and make everything take off. So it's an incredibly, incredibly exciting time to be in this space and working on this stuff.

Hugh Thompson: And Joe, just to add to what you're saying and just think about the smartphone market as an example. There were some very interesting and innovative smartphones, say from Nokia. Years and years ago, foldable phones not in the same way that the screen folds on the Samsung Galaxy fold for example, but very innovative, very interesting and super high utility, but it took a learning curve. You would not enter using that phone lightly. The target market was somebody that was technically proficient, they felt very comfortable with it. They could do troubleshooting on their own. But when the iPhone came along, it was amazing how quickly the accessibility of this kind of technology became. My parents who I thought would never use a smartphone at that time. They picked it up. It was so intuitive to them. And I remember my mom getting frustrated with something and so just as a natural instinct, she shook the phone and so what happens that, that's the undo command on the phone. But think about the thought, the design, the elegance that had gone into it that made it, so you actually don't have to think about the technology, the troubleshooting. The, " How do I get these three different tech ecosystems to work together and maybe it'll be my project for the week I have off." I just plug it in. It works. There's a unified way to communicate and we're getting very, very close to that now with the smart home and that's incredibly exciting. There's going to be a lot of people that would've never imagined themselves being able to embrace this that can embrace it. I can't help Bret but also mention another piece to this, which is maybe the darker side of it. When things start to get easy, people always maximize for utility. It's, " Whatever's the fastest path, whatever's the easiest way for me to get it to work, I'll do it." And that's true, not a bug, but a feature of the human condition. That's just how it works. It turns out though, so often with technology it's easy to understand the utility when things are done well and it's highly usable, but it's so difficult to assess the risk. If I bring some new device into my home and it's got the capability to record audio or to record video or sensory things. Again, maybe there's some high utility to it, but I never think of the downside of, well actually who can listen to this audio, and where's that audio stored, and how's it get there and does it get to use Joe's water analogy? Does it flow from good pipes and can somebody just tap into one of those pipes and take a drink of it on its way out? These are the kinds of things that I think are going to come more and more center stage in connected home, connected devices. It's not just, " What's the utility? Am I adopting it? Can I say, " Make Christmas happen." And all the things turn on in the house?" I think serious questions will come up and it may not be from individuals, it may be from government agencies or Federal Trade Commission or just watch dogs on behalf of consumers and say, " Is this safe? It may be fun, but is it safe?" So I think we're going to head an epoch in the connected device for the average person where the security, the providence, what care is being taken after my data and this device on the backend is going to come into full focus, which that I think is fascinating.

Bret Jordan: Yeah. I think you both bring up some really interesting points and obviously on the security side and what do consumers need to understand, and how is that going to impact them, especially as the proliferation of devices grows exponentially. How does the consumer know? Is the IoT labeling mechanism a good option there? What happens with policy and regulation? What about the EU Cyber Resiliency Act? What about the stuff coming out of the UK from DCMS and Ofcom or the stuff out of the White House? What about the Singapore policies? So there's a lot I think that we can unravel there, but I was thinking as you were talking Joe, about a couple examples of this transformative nature and the two that I came up with, was this transition from token ring to ethernet and with the release of the 3COM, what was it? 3C905 network card. That just kind of revolutionized and you went from ATM and token ring and almost overnight we transitioned to ethernet. And is ethernet a really great protocol? Actually, it's quite terrible, but it would became so prolific and I see this happening with IoT devices. We've gone from this really technical, really kind of complicated solution to something that is pretty much turnkey. And the other analogy which fits in here too is this transition when Apple released the iPod and we went from MP3 players and all these different codex and all these different things and you had to really tinker and play around and recompile stuff in order to get your favorite codex work. Apple comes along and says, " Let's just make it super easy. Here's an iPod, put a bunch of music on. Everything just happens and works." And now that's the experience that I see as this distribution of technology. Back to that original question, how technology is being distributed, everybody can use this now. And so you can get to that point where you just walk into a home and people say, " Oh, turn on the lights." And you can just be, " Turn on the lights." Or I'm in the kitchen, " Turn on the lights in the kitchen." And it should just be that simple. And I think we're right at that cutting edge there when that's possible.

Joe Britt: This is super fascinating. As I was listening to Hugh talk about the iPhone and making things simpler. Yes, that is what has to happen for technologies to be adopted on mass so that everybody can use it. Bret, I mean, you were talking about networking and people who like to tinker with stuff. We remember what it was like when you still had to configure PPP or if you had a network in your house, nothing auto- configured, and you had to map out what the network was going to be and configure everything manually, and if you got one thing wrong, it just didn't work. This is not a consumer- friendly experience. It's an experience for a skilled tradesman, really, right? Somebody who understands that technology deeply and when things go wrong, can figure out what went wrong. But we have examples of this through history as well. I mean, you were talking about coming in the house and saying, " Okay, turn on the lights." And the lights come on. Yes. That is actually an echo of another technology. So getting to the point where you could turn the lights on in your house even manually with a switch and have it be safe, that took a while to figure out. And it definitely required things like standards bodies and government regulation to actually make it happen. I mean, we have things like Underwriters Laboratory that gives consumers confidence that the heater that they're about to plug in their house is not going to burn the place down. And so I think anytime you've got a revolutionary technology, it's like the saying, right? " With great power comes great responsibility." And that who does that responsibility fall upon? I think it's unreasonable to expect the consumer who's adopting this stuff just because it was made simple to have a deep, deep understanding of how it works. They shouldn't need to. The same way that they don't need to understand how the electricity, that powers their houses generated or how the heater that makes their room warm works. That's the responsibility of ultimately governments and the companies that build those products. And the companies that build those products benefit from governmental guidance that can come in the form of carrots or sticks to help make sure that they are aligned with the best interests of the population at large, the ordinary people that are actually using the products.

Hugh Thompson: And Joe, I think you make such a great point, and some of it I think certainly will come down to regulation, so that there is at least a minimum bar of safety when something is inside your home, when something's impacting maybe your body and it's an insulin pump that's hooked up to you. Geez, I would really love it if some third party was looking at and regulating those kinds of pieces of technology. And then you have things where maybe the product isn't regulated, but you want to put as much power in the consumer's hands as possible to make an informed choice. And that's what I think things get really interesting, and Bret alluded to it earlier, the IoT labeling discussions that are going around both in the US and Europe and in other places. A lot of the discussion is coming down to design of the labels. So what does it look like to a consumer? It's about to pick up a connected dinosaur toy. And I say this as someone who just recently purchased such an item. All right, all right. That right now, I'm maximizing for utility, like" Wow." I press a button to roar, sounds really good. I can kind of move it around the house. It's, can track it, that's great. But what I don't have any sense of is the sensory capabilities it has, I don't even know. Does it have a microphone built into it? Not sure. Is there a way that you could present this to the user where at least they would consider it? And there might be some degree of hope in the sense that we have other areas where people are making similar kinds of choices. I truly enjoy a very good fried chicken, but when I go into a food store, I can look at the nutrition label and see that, " Wow." One of my favorite frozen microwaveable fried chicken delights has a saturated fat content that's 300% of the recommended daily value. Now, I may have on occasion continued to purchase said chicken, but at least I understand that maybe I shouldn't do that very often or it's having some negative impact on me. I think today, there is no concept of that. It's a pure utilitarian, " Am I going to get the connected one or the not connected one?" Even if I don't know if I'll ever connect it, of course, I should get the connected one if they're the same price. That's the thinking. Hopefully we can at least innovate in the design of the way that we can communicate to a consumer so that they can understand that that utility may come at a cost of risk and let us help you understand what that risk may look like.

Joe Britt: Yeah. I mean the big challenge is how to distill a complex risk down into a form that an average consumer can consume and understand. And it's a hard thing to do.

Bret Jordan: Well, and I think it's hard to not make it so overly complicated. We've seen this with various other government regulations. We see it on the cyber warfare, cybersecurity side. Even with the release of the CMMC version one, it was really complicated or common criteria. It was really complicated, and now they're learning, well actually what we need to do is just make it really simple. And so you need to have a base level of security. And I think that's where people have gotten hung up, is trying to tell manufacturers that there's a certain level of security that you have to have and it's just table stakes. And if you can't do it, then you can't sell product. And here point Joe about electricity, the Underwriters Laboratory, you couldn't sell outlets and switches for electrical current or breakers that don't meet that requirement because it'll cause people's houses to burn down. And I think we need to get to that point, whether it's based on the EN 303 645 specification out of ETSI or if it's based on something out of ISO 27400 series or anything along those lines. But I think we really do need some base table stakes where everything is end- to- end encrypted. And there's all devices can be OTA updated and that they are supported for a minimum of three years or five years. And you have vulnerability disclosure policies and I think there's some basic things that every product needs to, otherwise the consumer's just not going to know what to do. So shifting gears a little bit, let's talk a little bit about the usability and the concerns around usability of some of these smart and connected things. We've hinted around a couple of these, Hugh, you've talked a little bit about it, Joe, you've talked a little bit about it, but what can users do today versus what do they really want to be able to do?

Joe Britt: Well, everybody probably has a story of a friend, a relative who had trouble pairing a Bluetooth device with their phone or with their headset. It's a very kind of techy process, right? At an engineering level, it makes sense what's going on, but back to your point about usability. For the case of Bluetooth hands free in the car, the person just wants to safely talk on their phone while they're driving. That's what they want to do. They don't want to understand how Bluetooth works. And so the challenge for engineers and developers, think about how non- engineers and non- developers use this stuff. And I go back to the example Hugh gave before about the iPhone. I mean, that was obviously a masterclass in figuring out what to not include in the product. And I think that's a really hard discipline for many because the temptation is there. It's so easy to just add this feature or that feature, but ultimately it has to come down to what is the use case for this thing? What is somebody actually going to want to do with it? Person who's paying for it? And when we think about smart home, we think about lights and switches and thermostats. These are all varied pedestrian products. I want my room to have light. I want to be able to change the color when I have a party or I want to be able to have the temperature in the house, be comfortable. And so the challenge for any smart home product maker or developer is to strip away all of the technology, make it go away, and always just stay laser focused on what that use case is, and then do the hard work of making the connectivity, so trivial that it fades into the background and the user doesn't even think about it, which is not the case with Bluetooth pairing like we were talking about a second ago. And also provide a credible approach to securing the connectivity for those devices.

Bret Jordan: What would be the one thing you would like people to take away from our discussion today?

Hugh Thompson: I would say that this is an incredible time just to be alive. You look at what is happening and how more interconnected we are, first of all with each other. It's incredible. And the fact to make, that you can make those relationships even with each other more intimate by having these connected devices that maybe they give you peace of mind, maybe they help you share experiences. Amazing. And this is something that can provide incredible utility. It can open new doorways and pathways to people that have limited abilities or folks that maybe otherwise wouldn't be able to stay in their home because they didn't have somebody else, like a loving relative or child to help watch after them. That's amazing. I mean, it's just so heartwarming to see, and we were only scratching the surface. So it's a very exciting time to attract this space. It's a very exciting time to learn and jump into it and experience the utility of it. But it's also important on the other side to think about as you're gaining that utility, as you're bringing and welcoming these devices into your home, into your lives, that there are risks associated with it. And at the end of the day, I do think it's going to fall heavily upon regulators and testing authorities standards to come in, so that we don't have to think about those risks. But we're still early in the space. So it is something that the average person needs to have at least some awareness of in the back of their mind, but exciting time. Super exciting.

Joe Britt: Super, well- put Hugh. I mean, I'm struck by how I think this conversation is tying back very neatly with the quote that Bret brought up at the beginning, about how the future's already here, just not evenly distributed. And the challenge on technologists, product developers, retailers, governments, regulators, everyone, is to ensure that this very powerful technology is packaged and distributed in the appropriate forms. And those are forms that are above all else safe and trustworthy and then useful and practical and always keeping in mind what it is that the user really cares about. And not getting too infatuated with the technology and always thinking about what the real world use case is. But as we've discussed, there are so many ways that this stuff can be used for good and for bad. And so the onus is really on us as creators and technologists to make sure that we're always thinking about it with the benefits of a user in mind. And that is a really powerful responsibility, a really important responsibility. And so I'm really glad that we were able to have this conversation today because I think it's just sort of underscored a number of things that we've all been thinking about for a while, and it's really great to be able to put them out there and sort of see them in this new context as we kind of share our thoughts on it together.

Bret Jordan: Thank you so much for joining us today for this episode of Smarter Everything. We really love feedback. So please consider taking a moment to send us a comment or a rating on Apple Podcasts. And if you have time and you like this episode, please consider subscribing. We'll see you next time for Smarter Everything.