Advanced metering systems inherently create data privacy and security risks because of the information they collect.  Utilities that fail to address these issues will find themselves constrained by consumer and political opposition, prevented from realizing the economic promise of AMI, and/or faced with liability to angry regulators and customers. 

What’s So Private About Meter Data?

In the advanced metering context, the “right to privacy” means the consumers’ ability to set a boundary between permissible and impermissible uses of information about themselves.  What is impermissible is a matter of culture as expressed in law, markets, and what individuals freely accept without objection (i.e., consensus values).

Advanced metering infrastructure (AMI) puts privacy interests at risk because its core purpose is to collect information related to a particular household or business.  Meters can already collect a unique meter identifier, timestamp, usage data, and time synchronization every 15 to 60 minutes.  Soon, they will also collect outage, voltage, phase, and frequency data, and detailed status and diagnostic information from networked sensors and smart appliances.  These data show directly whether people were present, when they were present, and what they were doing. 

How much privacy risk AMI creates depends on its design.  As Michael LeMay and colleagues at the University of Illinois discuss in An Integrated Architecture for Demand Response Communications and Control (see link below), AMI can employ various technologies, alone or in combination, such as sensors, wireless transfers, internet connections, mesh networks, and local and remote appliance and HVAC command and control systems.

What constitutes permissible uses of personally identifiable information varies from culture to culture and time to time; but what goes on inside a residence is generally an area of special privacy concern.   Even illicit activity within a home has special legal protection.  In the U. S., for example, law enforcement may not use sense-enhancing technology to reveal activity within a home if the technology is capable of revealing both illegal and legal activity and residents would not expect such technology to be used against them. Because AMI data reveal more about what goes on inside a residence than would otherwise be known to outsiders, the collection and use of such data reduce the scope of private information.  Although “privacy” is generally considered to be a personal right, businesses typically have analogous rights.

Who Else Wants Access?

Battering the walls protecting privacy interests are those who seek financial, political, or psychological value in AMI systems and data.  Obviously, the sponsoring utility wants advanced metering data to reduce costs and increase profits by enabling remote meter reading, outage management, load forecasting, workforce management, planning, peak load billing, etc.  In competitive markets, alternative service providers will want AMI data to identify and target the most profitable customers. 

Other businesses will also be interested in AMI data.  System sensors, smart appliances, sophisticated signal analysis techniques on voltage and current wave forms, unusual power consumption, or duty cycle characteristics could reveal information about the presence, absence, or use of systems as small as hair dryers, waterbeds, and individual burners on a stove.  Such data make it possible to monitor changes in the operating signature of individual appliances and therefore to predict their loss of efficiency or imminent failure. 

• Appliance manufacturers may therefore want AMI data to learn about how their products are actually operated. 
• Retailers of appliances, extended warranties, or repair services may want AMI data to provide advertising or discount offers days or hours before an appliance fails. 
• Insurers may want to look for evidence of unauthorized conduct, to determine when a loss occurred, or to deduce who was present. 

Surely, other valuable uses will emerge. Customers, utilities, vendors, and third party data brokers will want to position themselves to sell AMI data or analytics, just as credit reporting agencies have done.  If utilities want to capture this revenue, and/or to prevent others from capturing it, they will need carefully crafted contractual provisions that clearly define who owns the AMI data and what rights the consumer, utility, service provider, or other third parties have to use or transfer it. 

As Rod Dow and Fritz Vorlop have described in their article, Making the AMR Solution Your Solution, the final resolution of these issues must be part of a sophisticated approach to strategies, negotiation tactics, and contract terms in both acquired and outsourced AMI systems. (See link below.)  

Other private persons will covet AMI data. 

• Neighborhood “busy bodies” will want to know what their neighbors are doing for the sheer pleasure of knowing, or the greater pleasure of gossiping. 
• Vengeful ex-spouses, jealous paramours, determined stalkers, and civil litigants may want to know an individual’s whereabouts and activities. 
• Burglars could use intercepted data to determine when a location is unoccupied, what an occupant is doing,  and whether valuable electronics are inside. 
• A thief gaining access to AMI bi-directional communications or controls could activate or deactivate intrusion alarms to divert police from, or to facilitate unlawful access to, a target. 
• Vandals could manipulate environmental controls, fire suppression systems, etc., to damage property as an end in itself.

Law enforcement will also want on-demand access to AMI data.  In the U.S., law enforcement presently has limited access to meter data to establish ownership of a place involved in criminal activities or to obtain search warrants for facilities suspected of drug production.  Otherwise, the prohibition of unreasonable searches and seizures in the Fourth Amendment of the U.S. Constitution limits access to this data without first obtaining a warrant from a judge. 

However, because these protections generally do not apply to information revealed to third parties, a California Court of Appeals held that data collected from a specially installed surveillance electricity meter could be obtained by law enforcement without a warrant.  Because the metering equipment was outside and did not reveal information about activities within the home, the Court found no constitutional protection.

Sophisticated analysis of AMI data might reveal enough about in-home behavior to reverse this outcome.  On the other hand, as the use of such technologies becomes more common, consumer expectations may change, thereby placing law enforcement use of AMI data outside of Fourth Amendment protections.  As a result, AMI data revealed to a utility, billing agency, or other vendor may now be available to law enforcement without a warrant.  Utilities and others handling AMI data will need to understand what they may, or must, do when law enforcement agencies demand access.

Lastly, market manipulators, extortionists, terrorists, and others with political agendas could use unauthorized access to AMI command and control systems to disrupt the delivery of services to targeted facilities, create widespread blackouts, disrupt load balancing commands, or create fear and panic among the general population.  Crackers may be interested in compromising command and control systems for personal satisfaction or bragging rights.

What utilities can do about privacy and security issues will be the subject of Part 2 of this article.

An Integrated Architecture for Demand Response Communications and Control

Unified Architecture for Large-Scale Attested Metering

Making the AMR Solution Your Solution (EEI Subscription Req)