The Industrial Internet of Things (IIoT) is an increasingly vital part of utility infrastructure. While the IIoT has received substantial attention within the context of cybersecurity and grid reliability, there has been little work done on the array of legal issues associated with the IIoT, many of which have little or nothing to do with cybersecurity. The interconnected and networked nature of the IIoT presents issues related to intellectual property, liability and risk sharing, and ownership interests. What will be the likely regulatory and legislative responses to an increasingly IIoT-dependent electricity grid? How can interconnected utilities share the costs of a largely digital control system that transcends the traditional generation, transmission and distribution systems?
There has been surprisingly little attention given by the legal community to the issues and implications associated with the IIoT, either generally or within the utility industry. Discussion of the IIoT in the electric industry has been the province of operational and engineering experts. But IIoT operational and engineering challenges will inevitably present novel and difficult legal issues.
Most people are now familiar with the Internet of Things (IoT), the network of physical objects, embedded sensors, connections and computers that permeates much of our everyday life. Encompassing the mundane (smart refrigerators and toasters), the vital (medical devices), the amusing (smart toilets) and the creepy (tracking and shopping monitors), the IoT has become both a buzzword and a way of life. We live among it.
The IoT continues to evolve within a largely consumer-driven digital ecosystem. As a result, IoT operating systems often have a shared heritage with the array of personal computing devices with which we are familiar. IoT devices, and the software that manages and maintains the communication networks between those devices, evolved alongside our phones, tablets and PCs. One can trace the IoT's lineage back to Gates, Jobs and Wozniak, and the IoT is part of the extended family whose patriarchs are Apple, Microsoft and IBM. Your smart fridge may have code deep inside it that traces back to a fabled Palo Alto garage.
The Industrial Internet of Things, on the other hand, while similar in name, is different in fundamental ways.
First, to continue the familial taxonomic metaphor, if the IoT is made up of numerous first cousins, all related to your home computer and phone, the IIoT is made up of second and third cousins. The IIoT grew not out of the consumer electronics explosion, but alongside large-scale industrial control hardware. Much of the software behind the IIoT was custom-developed (often decades ago) as an adjunct to big, expensive pieces of industrial hardware: switches, valves, pumps and other heavy machinery. If those pieces of hardware are the bones and joints of industry, the IIoT is the quickly evolving nervous system knitting them together. But that evolution has proceeded on a separate track from the IoT, and thus has different capabilities, structure and vulnerabilities.
Second, the IoT is focused on individuals; it is consumer-oriented and its end users are people ― families, small businesses and enterprises. The IIoT (as its name suggests) is directed to serve machines and industrial systems.
How important is the IIoT? It is now a fundamental part of the nation's critical infrastructure. It runs our oil fields, our gas pipelines, our water systems, our dams and heavy industry; it underpins the electricity grid, our train systems, our highways and our ports.