Morin: I’ve never thought smart cities were necessarily a bad idea by design. The thing is — just go to DefCon once, through this swarm of conferences, and you’ll realize what’s going on. Every time you’re sitting in a room at DefCon, they’ll start demonstrating whatever they want to do. Always, every single conversation, there’s this moment where they go — I remember one where a guy demonstrated how a certain system for traffic lights could be hacked. I was interested in that because we were exploring the same idea for the game. He had his backpack and his laptop, he’s pointing at an intersection in I forget which U.S. city, and suddenly he’s connected to every traffic light and controlling them. With his laptop.
Right there he called up the company that made the sensor for these traffic signals. “Hey, your product says it’s encrypted, but it’s not.” Everyone in the room starts laughing. It’s a running joke with these guys. Companies always say, “Sure, it’s encrypted,” and 99 percent of the time it’s either poorly done or not done at all. In this case it wasn’t encrypted at all. Open to connections.
So the guy on the other end says, “No, it’s encrypted,” arguing on the phone. Then he calls again and gets one level up in management, again and again. Eventually he gets a response. “Yeah, we did focus groups, and the connection was too slow with the encryption. It was a better product without it.” You focus-grouped security? And they kept claiming it was encrypted anyway. Of course the people in the cities that bought the product didn’t test it enough to notice. They just installed it. And that’s why DefCon exists. People go there and show off these things and they all find it really funny.
The thing about smart cities is, how can you secure something that isn’t just one product? A smart city isn’t a product. A smart city is an OS, an infrastructure of computers. You look back at the DDoS attack a couple of weeks ago, it’s a similar problem. All these things are connected to the internet. If one of those things is flawed — and all of them are different products from different companies, some of them that aren’t that great – the whole thing is flawed. Someone can get into the entire infrastructure and control the entire thing.
I feel like every time we create a game or a story or a universe, we want it to be relatable. A good way to make it relatable is to make people think about their own lives.