Today most of the so-called operational technologies or technologies that are out of IT, such as sensors or computerized medical equipment are managed by their own areas of business. And these business areas do not have the culture and IT experience in terms of access security (IBM). In this view, is possible see the the care and the concern that it will be/is necessary.

@Fabricio Herpich: Thank you so much for your answer. So what I got from your answer is that convergence is the problem. In other words, brining non-IT technologies to the cyber-world by connecting them to the internet. The security issues is not in the core technologies, but the threat is from within the internet. Is that right?

Basically IoT is going to face the same problems as traditional Internet, since it is likely to use similar technologies. The problem arises from the need of absolute security in certain operations, such as life critical applications, e-health and so on. Almost any standard and platform in the IoT arena is facing this topic and jotting down their requirements but they are not neither easy to implement nor to satisfy due to the heterogeneity involved.

Gilad Rosner just wrote today an article on that subject (see link below)

'There is room for global thinking in IoT data privacy matters' :

(...)

For many years, there have been three core security objectives for information systems: confidentiality, integrity, and availability — sometimes called the CIA triad. (...) European data protection experts have been seeking to complement the CIA triad with three additional goals:

> Transparency

> Unlinkability

> Intervenability

(...)'

http://radar.oreilly.com/2015/02/there-is-room-for-global-thinking-in-iot-data-privacy-matters.html

The privacy issue in the IoT may be the subject of a little academic debate, but not much thought in commercial industry.  For example, Google’s director of engineering, Scott Huffman, has stated Google is interested in voice-activated house control systems because Google wants to monitor all conversations and “interrupt with useful information.” He said Google’s ultimate aim is to “read your thoughts and send results directly to microchips implanted in the brain” (Guardian, Dec 10 2013).  

LG TV's were found to be transmitting all the details of TV watching patterns, in a user-identified fashion, back to LG servers even when people opted out and the TV's said they weren't doing this.  The plan was to sell this data to advertisers.  LG said is was a "technical accident."

In many cases more money can be made selling the user data than selling the device.  Google have shown how to make billions by giving the product away for free then monetizing the user data.  Who could resist a free fridge which was financed by gathering and selling your consumption patterns?  Evidence is only about 10% of people.

Over half of UK drivers under 25 now have monitoring devices in their cars from insurance companies, who will increase premiums if they think you are driving too fast, breaking too violently, or turning corners too quickly.  Not having such a device adds around 60% to your insurance premiums.  There is a commercial push to put such devices in all cars.  I expect that once that happens, governments will then demand access so they can automatically fine you for speeding.  And there's nothing to stop that information then being used when assessing your job application.

On a security level, there is concern that many internet enabled devices built in China automatically relay all data via chinese survelliance servers because such traffic routing is built in at chip level.

Another concern is the need for patching and updating.  Most of the current range of smart fridges have no security patch systems.  The average lifetime of a fridge is 15 years.  Imagine how secure your PC systems would be if they were using security from 1999?  When questioned about this, one manufacturer said they simply expected people to replace their fridge every 2 years, just like a phone.

IoT devices are all interconnected, and people have already shown how you can access one system by hacking another.  Cars have already been hacked via their diagnostic software and it has been shown you can then make them accelerate, brake or (in the case of self-drive cars) change direction.  

In addition to the individual devices, there is also the issue of cloud storage of the data and who has access to it and how secure it is.  

I could go on and on but a simple search of institutions like Future Tense, or the Berkman Center, or the EFF, will identify hundreds of such issues.  I recommend the ETICA research findings, which identified more than 400 ethical issues on the horizon from emerging ICT's.

This site documents issues on this:

https://www.iamthecavalry.org

Here's a sample:

A security vulnerability in BMW’s Connected Drive system allowed researchers to imitate BMW servers and send remote unlocking instructions to vehicles. The problem was discovered by the Allgemeiner Deutscher Automobil-Club (ADAC), a German motoring association, and was verified on several models of BMW cars. The attack took advantage of a feature that allows drivers who have been locked out of their vehicles to request remote unlocking of their car from a BMW assistance line.  “They were able to reverse engineer some of the software that we use for our telematics,” said Dave Buchko , a BMW spokesman. “With that they were able to mimic the BMW server.”

@ Alessio Meloni and @  Diogo Pereira Henriques Thank you so much for your valuable comments.

@Martin Henze: I agree but don't you think that if the users want to control over their data (for obvious reasons), then they should compromise on the quality of the service they are provided with? Clearly if they are reluctant to give away their data OR selectively provide the data, then their service will be affected and the service to others will be affected. There is a tussle here as well between the level of privacy and the granularity of the service. So do you think we can work out that as well? Thinking of some tradeoff solution would be an answer.

@Brandt Dainow: Thank you so much for such a detailed answer. You cleared the picture so well but again I would repeat that in order to get the service, users are compelled to agree on such privacy breaches (In some cases). Ofcourse not in the case of LG who deliberately abused user privacy. Do you think the problem of the privacy is a 'semi-black hole' where only a decent compromise on something will work?

I see absolutely no reason why people need to accept the possibility of privacy breaches in order to obtain data-based services. 

Privacy breaches are not essential functionality required to make systems work, they are failures in design.  It is possible to make some cars accelerate by hacking into their bluetooth phone systems.  This is poor design - there is no need for a bluetooth phone system to be connected to the accelerator in the first place.  Facebook do not need to profile my behaviour and sell that to others in order to make their website operate.  They have made a decision to finance their operations that way, but it is not necessary for IT functionality to work.  They could have just as easily chosen a non-tracking subscription model.  Or be funded by the government out of taxation as a social service.

Privacy is not violated when an IT system uses personal data to deliver a service.  Privacy is violated when personal data is seen by humans, or when it is used in a manner which the person was unaware of and would have objected to had they known, or when service providers fail to build adequate security into their systems.

LG TV's, and the Samsung voice activated TV now in the news, do not NEED to use a client-server architecture in which all data is routed through central servers.  They could have embedded that processing in devices within the TV.  This may have made the devices more expensive, or maybe not, but it would have been technically possible.  Similarly, they do not need to keep this process secret in order for it to work.  They do not need to hold the data after processing it for the system to work.  They do not need to bury information about this deep into obscure T&C's for their technology to function.  They do not need to make this data inaccessible to the users for their systems to work.  They certainly do not need to sell this data to others in order for their TV's to function.  Samsung have said they want to pass the voice data to Nuance so they can use it in research to improve the technology.  That is nice, but not needed to keep existing TV's working.  Furthermore, Nuance managed to develop their voice recognition systems without accessing user data, so even Samsung's research aims could have been accomplished without privacy violations.

There is absolutely no technical reason why any ICT requires privacy breaches or reductions in privacy or the centralised storing of personal data after it has been used in order to deliver the desired functionality.  These are choices in design or business model and there are plenty of alternatives to both which can deliver the same services.

In general then, the link between the ethical status of a digital service and its functionality is always arbitrary, always a choice made by the designers or business owners.  The issue is not technical requirements but lack of concern.  It is always possible to deliver any service to people in a manner which does not violate their privacy, either through alternative designs or alternative business models.  We do not need to balance harms and benefits when it is technically feasible to build systems which deliver benefits without any harm. 

This links to a report from the office of USA's Senator Markey into security and privacy risks in new car technologies:

http://www.markey.senate.gov/imo/media/doc/2015-02-06_MarkeyReport-Tracking_Hacking_CarSecurity%202.pdf