Alphabet's plans to track people in its 'smart city' ring alarm bells

Washington, DC(CNN Business) Alphabet's plans to develop a Toronto neighborhood could set a dangerous precedent for the future of data-driven cities, according to data governance experts.

Last month, Sidewalk Labs, the urban innovation arm of Google's parent company Alphabet, released a 1,524-page report detailing plans for developing a portion of Toronto's waterfront.

The report, weighing more than 14 pounds, exhaustively detailed the perks of Alphabet's vision, including streets without traffic congestion and air pollution, as well as inventive ways of dealing with harsh weather.

But when it came to discussing the handling of people's data, Alphabet offered only a handful of pages with few new details. Sidewalk Labs describes the creation of an independent agency to manage data collection agreements with companies and make sure the collection is beneficial for the community.

Pedestrians walking in the neighborhood shortly after it launches will likely be tracked as they walk down streets, enter certain stores and spend time in parks.

But it's not just about the data that will be collected about any given visitor on day one. It's the risks we don't even know about yet, the ones that may accrue over time as data collection broadens and gets more powerful. Innovations such as self-driving cars and drones will create new ways to collect data. Businesses, including Sidewalk Labs and others, will want even more data, and it's difficult to predict what all of the new, data-collecting innovations will be.

Recent scandals, from the Equifax hack to Facebook's Cambridge Analytica debacle, have highlighted the importance of protecting data. Sidewalk Labs plans to build a neighborhood "from the Internet up," adding sensors that will turn streets and sidewalks into a digital space, increasing the opportunity for privacy issues, discriminatory algorithms and data breaches. Sidewalk Labs describes data being collected everywhere from building lobbies and retail stores to ride-hail vehicles, parks and markets, but no way to opt out entirely.

Sidewalk Labs outlines a list of initial data plans, including transportation data from cars, bikes and pedestrians to optimize parking prices, traffic lights and vehicle speeds. It also plans to collect data on foot traffic in retail stores, weather, air quality, waste classification, and other uses it expects can benefit the neighborhood. Sidewalk Labs would dot the neighborhood with a standardized physical mount, what it calls an "urban USB port," to make it easy and affordable for other companies to deploy additional sensors such as cameras for digital innovations. The independent agency governing data would approve companies to do so.

Critics say this data could create hardships for marginalized groups if used in certain ways, such as law enforcement more easily tracking and deporting undocumented immigrants.

They also warn there's a wide gap in technological expertise and financial resources between Alphabet (GOOG) and Toronto. The city risks agreeing to a neighborhood that favors Alphabet's business interests and will feel more like a surveillance state than a smart city.

Alphabet needs to win the approval of the city council and Waterfront Toronto, the government agency overseeing the development. To do so Sidewalk Labs committed more than $50 million to creating its massive plan in the last 18 months. Toronto expects to spend up to $800,000 evaluating the plan, including only $50,000 on data governance.

"Civil society is outgunned," Alex Ryan, vice president of the Mars Solutions Lab, a Toronto technology incubator, told CNN Business. "There is this asymmetry in being able to approach this topic, and as a result, we're ending up with a very unbalanced conversation."

Sidewalk Labs said in a statement to CNN Business that the project is not about data, and that the governing body handling data must be independent and set its own policies and rules.

"We don't pretend to have all the answers and the proposals in the [plan] are not final," said Alyssa Harvey Dawson, general counsel and head of data governance at Sidewalk Labs. "But we think that Toronto and Canada are well positioned to work with Waterfront [Toronto] and Sidewalk Labs on determining the optimal outcome for this district."

Toronto's city government said in a statement that additional resources, if required, could be requested by staff in future budgets.

Sidewalk Labs envisions a smart city that sets a standard for urban life in the 21st century, which could be replicated worldwide. But critics are more cautious about the impact of Sidewalk Labs' innovations. Karissa McKelvey, a fellow at the Aspen Tech Policy Hub, a San Francisco policy incubator, says we're living in times akin to the car industry in the early 20th century when there were no seat belt laws or government agency setting vehicle safety standards.

"We're really in the infancy of it," McKelvey said. "There's lots of asbestos in all the walls of these databases and we just haven't figured it out yet."

Sidewalk Labs proposes a new and largely untested solution to handling collected data — an urban data trust, which would provide independent stewardship of data and approve how it is collected and used. Independent data experts tell CNN Business that data trusts are a promising solution to the drawbacks of the digital age. They could give citizens more understanding and control over how information about them is used. But they also caution that there's also no guarantee the trusts will succeed in addressing commons issues surrounding privacy, data breaches and biased algorithms.

Sidewalk Labs says the data trust it proposes would be independent, controlled by neither it nor the Canadian agency overseeing the new development. The not-for-profit data trust would create a charter to guide agreements with companies, including Sidewalk Labs, that collect data in the neighborhood.

Sylvie Delacroix, a Birmingham Law School professor in the UK who co-authored a paper on data trusts, views them as critical to empowering citizens.

"Our future will be shaped by data governance choices," Delacroix said. "At the moment these choices are mostly made from the top down."

It's difficult for a person walking on a Toronto sidewalk to grant informed consent to companies like Sidewalk Labs that will position cameras and sensors on streets, and then use that data for commercial gain. Data trusts, in theory, will solve that problem.

A person visiting Alphabet's neighborhood in Toronto would have their data protected to a degree by the data trust, which would strike data agreements with companies. The trust could perform audits after suspected violations and pursue legal remedies to protect people.

But Delacroix described Sidewalk Labs's proposal for its data trust as being an afterthought and insufficient.

Delacroix believes cities should be home to multiple trusts with each one focused on various topics, such as on transportation research or using data to develop treatments for a medical condition such as diabetes. Residents and visitors could opt in to trusts that they wanted to share their data with. She envisions data trustee as a new profession with specialized training no different than going to law or medical school.

But a single trust makes it difficult for trustees to weigh competing interests in a diverse city, so that each person's data is only used in a way they desire. Some residents might want their data to inform health care innovation but not transportation research, and vice versa. Sidewalk Labs calls for the data trust to be governed by a board of five people, including one community representative in a city of six million people.

Ryan, the Vice President at a Toronto tech incubator, believes a lack of civic participation is a weakness in Sidewalk Labs' vision for the data trust.

Sidewalk Labs described its proposal in a statement as based on extensive consultation and that multiple trusts could be possible.

Peter Wells, head of policy at Open Data Institute, a London nonprofit dedicated to using data for good, favors multiple trusts for a single city. His organization has piloted data trusts and expects to have one operational next year in Britain. The topic hasn't yet been revealed.

Wells said the pilots have taught him that people are desperate for better solutions to data, but it will take a couple years after implementation to know if the trust is succeeding because people's behavior changes after a new tool arrives.

"It makes me cautious of people wishing for something when we don't actually know whether it will work or not," Wells said. "A few years ago, people were saying Facebook was making the world a great and brilliant place. Now the tone has changed dramatically."

Philip Dawson, public policy lead at Element AI, a Canadian software company, told CNN Business that it's critical for a data trust to have a fiduciary obligation to protect people. Sidewalk Labs doesn't include a fiduciary obligation in its proposal, instead describing how companies could be legally held accountable for breach of contract. Dawson said this approach has drawbacks for individuals, because the leaders drafting the contracts will have to forecast all potential misuses of data. This can be especially challenging in the fast-moving technology sector, where new products emerge quickly, Dawson said.

"It was disappointing to not see more information on data trusts and a more clear concept of what type of data trust they're talking about," Dawson said. "It could've set a different precedent for a proposal on data management in the context of smart cities."

Ryan, who also believes a fiduciary obligation is important, added that any breach of contract lawsuit would have to come from the data trust, not the public. And if residents felt the trust had become corrupt, they would not be able to sue it without a fiduciary responsibility.

Sean McDonald, co-founder of Digital Public, a US organization devoted to digital governance, said that Sidewalk Labs fails to dig into critical issues, such as what citizens can do if they feel their data has been misused, or how the trust will remain independent and unswayed by Alphabet and Canada's government.

"It is an awkward reincarnation of Silicon Valley's blind techno-optimism, dystopically proposed three years after everyone knows better," McDonald said.