The Evolution of the Internet of Things

In 1982, in the computer science department at Carnegie Mellon University in Pittsburgh, a graduate student named David Nichols wanted a cold Coca-Cola and was tired of walking to the department's vending machine only to find it empty, or freshly refilled with warm bottles. According to an account published by IBM, he was joined by fellow graduate students Mike Kazar and Ivor Durham, and by John Zsarnay, a research engineer in the department. Carnegie Mellon's own history of the machine records that micro-switches were fitted to sense how many bottles sat in each of its six columns, and that the switches were wired to CMUA, the department's PDP-10 mainframe. Kazar wrote a program for a gateway, a small intermediary machine that translated between the switches and the network, which checked the state of each column several times a second. The group then modified the finger service on CMUA. Finger was a standard lookup tool on the ARPANET, the American research network from which the internet grew, normally used to check whether a given person was logged in, and the group arranged for a lookup of a user named [coke], who did not exist, to run the Coke status program instead. Typing [finger coke@cmua] on any machine on the department's Ethernet, its local wired network, and in principle on any machine on the ARPANET, therefore returned the state of the vending machine.

Everything that a modern deployment contains was already present: a sensor at the edge, a small gateway to translate its signals, an existing network protocol repurposed to carry the reading, and a remote query that needed nobody to be standing at the device. It was also a convenience for four people, and Kazar said later that it never occurred to him in the 1980s that anyone would ask about it thirty years on. The machine is usually described as the first internet-connected appliance. It is better understood as a late arrival in a much older story, because the idea of a machine reporting its own condition to a distant system had been developed for decades in industry, and the Carnegie Mellon students were working with an academic network that happened to be available.

The industrial lineage begins with supervisory control and data acquisition, or SCADA, the category of software used to gather data in real time from remote locations and to control equipment there. TechTarget's history of the Internet of Things describes the modern field as a natural extension of SCADA, and the claim holds up once the hardware is examined. In the late 1960s, Dick Morley, an engineer at the Massachusetts consultancy Bedford Associates, led the work on what is credited as the first programmable logic controller, or PLC. A PLC is a hardened industrial computer that repeatedly reads inputs such as switches and sensors and sets outputs such as motors and valves according to a stored program. This one was built for General Motors to replace the banks of electromechanical relays, switches wired together so that the state of one circuit controls another, that governed its assembly lines. The unit was designated the 084 because it was Bedford Associates' eighty-fourth project, and the company that grew from it was called Modicon. Its controllers were programmed in ladder logic, a notation deliberately drawn to resemble the relay schematics that electricians already read. In 1979 Modicon introduced Modbus, which is commonly described as the first industrial communications protocol, an agreed set of rules for how devices format and exchange messages, so that its controllers could talk to one another and to remote devices.

The design of Modbus explains a good deal about what followed. It uses a master and slave arrangement, in which a single controlling device, the master, starts every exchange, and the other devices on the line, the slaves, only ever answer. The master asks a slave, by its address number, to report a value or to change one, and the slave replies; a slave never speaks unprompted. The values sit in two kinds of slot: coils, which are single on or off bits such as whether a motor is running, and registers, which are 16-bit numbers such as a temperature or a counter. The Modbus Organization has since adopted the terms client and server for the two roles, which describe the same relationship. The protocol first ran over serial links, which carry data one bit after another down a wire. RS-232 connects exactly two devices, while RS-485 is a multidrop standard, meaning that many devices share one pair of wires and each listens for its own address. The protocol carries no concept of identity or permission, because the wire it travelled on belonged entirely to the factory, so any device that could reach the line could read or change any value on it. Modbus/TCP, which carried the same messages over Ethernet using the Transmission Control Protocol, the reliable delivery layer of the internet, appeared in 1999. In 2004 the Modbus Organization took over the specification and declared it open, and in 2018 it published Modbus Security, which wraps the protocol in Transport Layer Security, or TLS, the layer that encrypts a connection and confirms who is on the other end, as it does for web browsing. The authentication that Modbus lacked from the start therefore arrived thirty-nine years after the protocol itself, and the gap between those two dates is the subject of most of the security discussion in the second half of this essay.

A second lineage concerns identification. During the Second World War, British aircraft carried transponders, devices that automatically send a reply when a radar signal reaches them, so that friendly aircraft could be told from hostile ones. In 1948 the American engineer Harry Stockman published a paper titled [Communication by Means of Reflected Power], which set out how a device with no transmitter of its own could answer a radio signal by reflecting it back with its strength varied in a pattern that encodes information. That principle, backscatter, is how passive RFID tags, which carry no battery and run on energy taken from the reader's signal, still work. Their cost and reliability would take another fifty years to become tolerable, and the effort that finally got them there was a supply chain problem.

The vocabulary of the field began to form at the start of the 1990s. Mark Weiser, a computer scientist at Xerox PARC, had developed the idea he called ubiquitous computing in the late 1980s, and in 1991 he set it out in Scientific American in an article titled [The Computer for the 21st Century]. His proposal was that computing would disappear into the environment as large numbers of cheap devices at three scales, which he called tabs, pads and boards, roughly an inch, a foot and a yard across. The proposal was a statement about interface and about number, and it did not mention radios or protocols, but it established the premise that the interesting computers of the future would be the ones nobody noticed.

The working demonstrations of that decade were more modest and more entertaining. John Romkey, an American engineer who had written early TCP/IP software, connected a toaster to the network for the Interop conference in 1990, as the episode is usually recounted, and could switch it on and off using the Simple Network Management Protocol, a standard for monitoring and controlling network equipment remotely. In 1991 two researchers at the University of Cambridge Computer Laboratory, Quentin Stafford-Fraser and Paul Jardetzky, pointed a camera, connected to a frame grabber that digitised its video into still images, at the communal coffee pot in a room called the Trojan Room, so that colleagues on other floors could check whether there was coffee before making the trip. Stafford-Fraser wrote the client, the program that displayed the images on a colleague's screen using the X Window System, a networked display system common on Unix workstations, and Jardetzky wrote the server, the program that captured the pictures and supplied them on request. The images were small greyscale frames. In November 1993, once web browsers could display images, the laboratory's Martyn Johnson and Daniel Gordon put the camera onto the public internet, and the coffee pot became one of the early attractions of the web. It was switched off on 22 August 2001, and the pot itself was later sold on eBay. Like the Coke machine, it was a sensor whose value came from the fact that a person elsewhere could read it.

The phrase that gave the field its name came from a different direction. Kevin Ashton, a British brand manager at Procter & Gamble, had become interested in radio-frequency identification in the late 1990s, and RFID Journal's 2002 profile of him recounts that the interest began with a shade of Oil of Olay lipstick that was persistently out of stock in shops. In 1999 he prepared a presentation for Procter & Gamble's senior management arguing for RFID in the supply chain, and he titled it [Internet of Things] to attach the proposal to the most fashionable technology of the year. He was not working alone or from nothing. Neil Gershenfeld, a physicist at the Massachusetts Institute of Technology who led a research programme called Things That Think, published the book [When Things Start to Think] in the same year, and the Auto-ID Center that Ashton helped to found at MIT in 1999 drew on the work of two engineering professors there, Sanjay Sarma and David Brock, who wanted to attach cheap RFID tags to objects and link them to data held in internet databases.

That last point is the architectural idea that survived. The Auto-ID Center was funded by Procter & Gamble and Gillette, with the Uniform Code Council, which administered the barcode standard in the United States, also contributing. Its purpose, according to the MIT Auto-ID Laboratory that succeeded it, was to develop the Electronic Product Code, an item identification system intended to replace the Universal Product Code, the standard black and white barcode. A barcode identifies a type of product, so every tin of the same beans carries the same number. An Electronic Product Code identifies the individual tin. Crucially, the tag was meant to hold little more than that number, while the information about the item lived on the network and was looked up when needed. The tag was therefore cheap and the intelligence was elsewhere, which is the same division of labour that a present-day temperature probe and its cloud platform follow. By the time the centre closed in October 2003, handing its work to Auto-ID Labs and a standards body called EPCglobal, ethw.org's profile of Ashton records that it had attracted 103 sponsors from around the world.

The same year, 1999, produced the protocol that most connected devices now use to report. Andy Stanford-Clark of IBM and Arlen Nipper, who was then at Arcom Control Systems, wrote the first version of MQTT to monitor oil pipelines inside a SCADA system. Their devices were connected by satellite, which at the time was priced steeply by the byte, so the protocol had to be economical with both bandwidth and battery. It uses a publish and subscribe model in which devices send messages on named topics to a central broker, which routes them to whichever clients have subscribed, so a sensor in a remote field never needs to know how many systems want its readings. A minimal control message can be as small as two bytes. The original name stood for MQ Telemetry Transport, after the IBM message queuing product line, although the protocol has not stood for anything since IBM submitted version 3.1 to the OASIS standards body in 2013. Andy Stanford-Clark has said that the tipping point for adoption came around 2008, when the open source broker Mosquitto was released, and version 5 of the specification followed in March 2019. The default port, 1883, is unencrypted (a port is a numbered entry point on a networked machine that directs traffic to a particular service), and a TLS variant uses port 8883, which is a reminder that the protocol was designed for a pipeline and not for the open internet.

The commercial test of the tag-and-database model came in 2003, when Walmart announced that its top one hundred suppliers would be expected to apply RFID tags to cases and pallets by January 2005. The mandate made the logistics industry take the technology seriously, and it also exposed the physics. Ultra-high-frequency passive tags work at frequencies that metal reflects and water absorbs, so their read range suffers on cans, bottles and metal packaging. The second-generation UHF specification that EPCglobal ratified in 2004, which was later incorporated into the ISO/IEC 18000-6 standard as Type C, improved read rates considerably, and RFID settled into the places where its limits mattered least, such as apparel, pallets and returnable assets. Tag cost remained the persistent constraint on item-level tagging of low-value goods.

By the 2010s the components had become cheap enough to change who could build a connected device. The TechTarget history attributes the field's emergence to the convergence of wireless technologies, microelectromechanical systems (tiny mechanical sensors built into silicon chips), microservices (software assembled from small independent services) and the internet, and the practical consequences were visible on a hobbyist's desk. The Arduino board appeared in 2005 and the Raspberry Pi in 2012, and sensors that once required an industrial supplier arrived as parts costing a few rand. What remained unsolved was connectivity. Wi-Fi and Bluetooth have short range and draw more power than a sensor on a coin cell can afford, while second and third generation cellular modules were expensive and drained batteries quickly. The answer was a family of low-power wide-area networks. Sigfox used ultra-narrowband radio, which squeezes each transmission into a very thin slice of spectrum, and accepted very small messages, with an uplink payload of twelve bytes and a daily cap of 140 messages. LoRa, a technique for encoding data onto radio waves that favours long range at low power, was paired with an open networking layer called LoRaWAN. The mobile operators pursued two standards of their own, NB-IoT (narrowband IoT) and LTE-M (LTE for machines), both low-power variants of the 4G mobile standard that were completed in 2016 in Release 13 of the specifications maintained by 3GPP, the standards body for mobile networks. A Dataweek review of the South African market notes that the two cellular options offer similar range and power consumption, with LTE-M supporting higher speeds. By mid-2019, an Analysys Mason survey counted 112 announced NB-IoT networks and 103 using LoRaWAN, with Sigfox accounting for fewer deployments than either.

The assumption that had held since Modbus, that these devices lived on private wires, failed in the autumn of 2016. On 20 September the website of the security journalist Brian Krebs was hit by a distributed denial-of-service attack, in which many hijacked machines flood a target with traffic until it cannot respond, at roughly 620 gigabits per second, nearly double the largest attack his mitigation provider had previously handled. At the end of that month the source code of the malware responsible, Mirai, was published online, and on 21 October a Mirai variant disrupted Dyn, a major provider of Domain Name System services, the lookup that translates website names into network addresses, which made sites such as Twitter, Netflix and Reddit unreachable for many users. Mirai is a botnet, a network of compromised devices under one operator's remote control, and it grew by scanning the internet for devices with Telnet, an old text-based remote login service, left open and trying a list of more than sixty factory default usernames and passwords. Researchers at the security firm Flashpoint told Krebs that many of the infected boards shared a default login of [root] and [xc3511], and that the credential was hardcoded in the firmware, the permanent software built into the device, so that an owner who wanted to change it could not. The Chinese component maker Xiongmai acknowledged that its recorders and cameras were involved, and Dyn reported tens of millions of distinct addresses associated with the botnet during the attack. The security technologist Bruce Schneier argued at the time that the economics of the Internet of Things meant the devices would stay insecure unless governments intervened, since neither the buyer nor the manufacturer bore the cost of a compromised camera.

Set beside the earlier material, the episode has a clear lineage. Modbus assumed a private wire and carried no authentication. MQTT on its default port assumed a controlled environment. Consumer devices were shipped with fixed credentials on the assumption that they would sit behind a household router and be used by their owner. Each assumption was reasonable in the setting for which the technology was designed, and each stopped being reasonable when the device was connected to a routable network, which is what the word Internet in the field's name describes.

In South Africa the question of connectivity has a local answer, and it is a commercial one. Vodacom and MTN each announced late in 2016 that they would deploy commercial NB-IoT networks in 2017. TechCentral reported that Vodacom, working with Huawei, upgraded an existing LTE site by software alone to carry NB-IoT on its licensed 900 megahertz spectrum, radio frequencies that the operator holds exclusive rights to use, and that the first demonstration was a water meter on the operator's own campus in Midrand. MTN, according to the same publication, began rolling out LoRaWAN alongside NB-IoT and LTE-M. A different route was taken by SqwidNet, which built a nationwide Sigfox network under Dark Fibre Africa's parent company, CIVH. Dataweek reported that the Sigfox network covered more than 85 per cent of the population within its first years, while a competing provider ran what it described as the largest open LoRaWAN network in Africa. TechCentral's interview with Sumeshin Naidoo, the chief commercial officer of Sigfox South Africa, records that SqwidNet later ran into difficulties and that its customers, among them Discovery Insure and Fidelity ADT, backed a rescue, after which the network continued as Sigfox South Africa with CIVH as a minority shareholder.

For any South African organisation that deploys connected sensors, the history above has a practical reading. A device has to report through some network, and the choice of radio is also a choice of operator, with its own terms and its own prospects of survival. The Sigfox episode shows that a network can be technically sound and still change hands, and the Mirai episode shows that a device can be commercially successful and still be a liability. Every device in this account, from the vending machine in Pittsburgh to the water meter on a campus in Midrand, reported a state to a system that had to decide what that state meant.