Why the Internet of Things Needs More Than Code: Inside the UK’s PETRAS Experiment

Billions of connected sensors now monitor traffic, manage waste, track logistics, and measure the air we breathe, and governments from London to Beijing have poured national budgets into making the Internet of Things the backbone of economic growth. Yet a growing body of evidence suggests that the hardest problems with this technology are not the ones engineers can patch. Weak passwords, undeveloped cybersecurity cultures within organisations, unclear splits in responsibility, and simple lack of awareness repeatedly cause technical safeguards to fail for social and behavioural reasons. A new review published in Frontiers in the Internet of Things argues that the way out of this impasse is to treat the IoT as what researchers call a socio-technical ensemble, a system in which human and non-human components interact toward a common goal, and to design research programmes around that principle from the start.

The review, led by Gideon Ogunniye, Amaya Hana, and Jeremy Watson of University College London’s Department of Science, Technology, Engineering and Public Policy, presents a case application of a socio-technical framework for IoT research and development in the United Kingdom. Its central claim is deceptively simple: IoT systems are highly dependent on data collection and sharing, constant connectivity, and remote control, which means their value is achieved through connected data that makes objects readable, recognisable, locatable, addressable, and controllable over a network. That same dependence creates privacy, ethics, trust, reliability, acceptability, and security issues for users and for those affected by the ecosystem, and the authors contend that technical solutions alone cannot adequately address these public concerns. The technical, social, cultural, and behavioural aspects of how we design, develop, manage, and evolve the IoT, they write, will be critical to its success.

The intellectual machinery behind the argument stretches back decades. Socio-technical systems theory holds that although technical and social subsystems are closely interrelated, they are distinct from each other: technical subsystems aim to achieve specified performance parameters, while social subsystems consist of human beings with unpredictable behaviour. The PETRAS framework follows an influential schema by Leavitt from 1965, developed through his experience of organisational change and focused on the relationships between people, tasks, structures, and technologies, later extended by Davis and colleagues in 2014 into a model of six interrelated elements embedded within an external environment. In this view, a work system has goals and metrics, people with varying attitudes and skills, a range of technologies and tools, a physical infrastructure, cultural assumptions, and processes and working practices, all operating within a wider context of regulation, stakeholders, and an economic environment whose importance varies with each system.

The framework’s real-world testbed is the PETRAS National Centre of Excellence for IoT Systems Cybersecurity, the world’s largest socio-technical research centre focused on the future implementation of the IoT. Its origins trace to a 2014 UK government Blackett Review on the Internet of Things, which identified socio-technical challenges concerning privacy, trust, and security that needed to be addressed to release market opportunity for the technology. The PETRAS research hub, established in 2016 and jointly funded by the UK Engineering and Physical Sciences Research Council and user partners, was a consortium led by University College London with Imperial College London, the University of Oxford, Warwick University, and Lancaster University. It brought together 12 UK academic institutions, 51 projects, six medium-scale demonstrators, and more than 110 user partners from industry, government agencies, and NGOs. In 2019, the PETRAS Centre was created under the Strategic Priorities Fund, growing to 24 UK research institutions, over 120 user partners, and 63 projects.

On the technical side, the Centre concentrates on how the interactions between IoT, artificial intelligence, and machine learning produce cybersecurity challenges that must be addressed if society and the economy are to harness their full potential benefits. According to the IBM Institute for Business Value, the full potential of IoT can only be realised with the introduction of AI, and machine learning, deep learning, and artificial neural networks are used to analyse and learn from collected data to create public services and values. Several PETRAS projects have modelled AI-based anomaly detection for consumer and industrial IoT: the ELLIOT project developed an early anomaly detection model that can be applied to industrial processes to detect early signs of cyber-attacks, while the PSWaRMS project developed an AI-based randomised target defence approach to reduce the risk of severe consequences from attacks aimed at IoT assets. Other projects investigated how AI techniques enable ubiquitous data collection, from machine learning behaviour patterns for driver profiles in autonomous vehicles to the PPIEM project’s implementation of ML techniques to evaluate the accuracy of occupancy estimates and future carbon dioxide predictions in smart buildings.

But the convergence of these technologies also introduces new privacy, security, and ethical issues, since threat actors may exploit AI to identify vulnerabilities and attack surfaces in IoT systems. The Centre’s answer is to combine social and technical expertise in the co-creation of new solutions, approaches, tools, and techniques that address both kinds of challenges simultaneously. Its goals include providing strategic advice and policy insight as the go-to resource on securing digital technologies at the periphery for the public and private sector, increasing the early adoption of new methods and technologies by its industry, service, and government user partners, and functionally improving the capacity of government to rise to the challenge of an arms race of ever more complex socio-technical systems and threats. The Centre operates in responsive pull and proactive push modes, co-creating immediately useable research with user partners while maintaining the capacity for fundamental challenges and emerging issues not yet apparent to partners.

The framework’s social subsystem is equally deliberate. The Centre is designed to accommodate transdisciplinary research spanning physical and behavioural sciences, bringing together experts from business schools, policy and governance programmes, and computer science to research new market models for raw and inferenced IoT data that may be mediated through technologies such as distributed ledger technologies, standards, and social incentive schemes. Its people element comprises governing components, including a governing board with industrial advisory, public sector, user research, and research excellence sub-groups, and administrative components such as the management team and an ethics review sub-group, working in synergy with an operations group of principal investigators, co-investigators, and research partners. The management team provides a single point of contact and works with academic researchers to ensure that research outputs are synthesised and communicated in a way that is translatable to industry, government, and broader non-technical audiences. The Centre’s culture of agility and collaboration has generated over 467 peer-reviewed articles in its publication database.

Perhaps the most vivid illustration of the framework in action is the P-PITEE project, which tackled a problem most city dwellers never notice: when IoT sensors are deployed in public spaces, the technology might not be visible at first sight to local residents and community groups. In partnership with Lancaster City Council, the project used design methods to develop new policies for transparent and ethical deployment of secure IoT sensors in public spaces, covering the collection, use, and sharing of data, considerations of data transfer versus edge processing, and cybersecurity questions related to data storage and sharing. The team developed a novel walking workshop approach, Taking IoT for a walk, in which members of the public were guided on a walkshop around Lancaster, encountering real and fictional instances of IoT deployment and discussing the benefits, risks, and language. The method, funded through the UK Economic and Social Research Council’s Festival of Social Sciences and later EPSRC Telling Tales of Engagement funding, spread to Leeds, East Riding, Dorset, and the London Borough of Hounslow, and the project launched an interactive tool called TrustLens to help organisations use technology in public spaces.

The review also maps the socio-technical requirements that any IoT deployment must satisfy, organised around the themes that give PETRAS its acronym: Privacy, Ethics, Trust, Reliability, Acceptability, and Security. On adoption and acceptability, a nationally representative survey of over 2,000 UK smart home consumers, built on the Unified Theory of Acceptance and Use of Technology 2, revealed that trust is fundamental to consumer technology in which transmission of personal and sensitive information is involved, and preliminary findings suggested that the most significant way to make IoT more acceptable is by reducing anxieties stemming from user concerns about privacy, trust, and security. On safety and security, findings point to the need for Security Ergonomics by Design, implementing safety and security requirements from the design phase throughout the lifetime of a device, dynamic risk assessment to cope with the dynamic nature of IoT, and study of emerging security and trust economics. On privacy and trust, a meta-analysis of social science and humanities research identified wide-ranging ethical issues including control and oversight of data flows, the balance between authentication and privacy, trade-offs between identification and privacy, the limits of the GDPR, transparency and auditing of autonomous and machine learning algorithms, and consent mechanisms, with trust negotiation, identity management, and fine-grained but not burdensome access control identified as technical trustworthiness requirements.

The governance picture is sobering. A review conducted with BSI and the Department for Digital, Culture, Media and Sport identified a fragmented and complex regulatory landscape in which IoT security standards have been developed by industry consortia with varying and possibly conflicting motivations, difficulty in monitoring the adoption and effectiveness of standards, and difficulty in establishing a security baseline across all application domains. The IoT Multidisciplinary Standards Platform project, collaborating with BSI, the Institution of Engineering and Technology, Digital Catapult, and GCHQ, surveyed the main barriers to navigating, adopting, and implementing relevant IoT standards, informing further investigation into the key challenges that small and medium-sized enterprises face in designing secure IoT products. The Centre’s influence reaches into legislation: its report on the UK Code of Practice for Consumer IoT Security was highlighted in a parliamentary debate on an amendment to strengthen cybersecurity in children’s products in the Product Security and Telecommunications Infrastructure Bill. The authors argue that the strategy of co-designing IoT research with critical stakeholders is a balanced approach that can help set more realistic expectations for all stakeholders, with significant implications for eliciting socio-technical requirements and for addressing public concerns about acceptability and adoption, safety and security, privacy and trust, standards, governance, and policy, and harnessing the economic benefits of IoT. For anyone developing new research centres or seeking to reinvigorate existing ones, the PETRAS experiment offers a guide: build the synergies between collaborators in from the start, and treat the humans as part of the system, not an afterthought.

Subject of Research: Internet of Things

Article Title: PETRAS: a socio-technical framework for Internet of Things research and development

Article References: Ogunniye, G., Hana, A., & Watson, J. (2024). PETRAS: a socio-technical framework for Internet of Things research and development. Frontiers in the Internet of Things, 3, Article 1336564. https://doi.org/10.3389/friot.2024.1336564

Image Credits: AI Generated

DOI: 10.3389/friot.2024.1336564

Keywords: Internet of Things, IoT security, socio-technical systems, PETRAS, cybersecurity, privacy, trust, AI, socio-technical, framework, Internet, Things