The First Two Decades of Smart City Research from a Risk Perspective

: Although they o ﬀ er major advantages, smart cities present unprecedented risks and challenges. There are abundant discrete studies on risks related to smart cities; however, such risks have not been thoroughly understood to date. This paper is a systematic review that aims to identify the origin, trends, and categories of risks from previous studies on smart cities. This review includes 85 related articles published between 2000 and 2019. Through a thematic analysis, smart city risks were categorized into three main themes: organizational, social, and technological. The risks within the intersections of these themes were also grouped into (1) digital transformation, (2) socio-technical, and (3) corporate social responsibility. The results revealed that risk is a comparatively new topic in smart-city research and that little focus has been given to social risks. The ﬁndings indicated that studies from countries with a long history of smart cities tend to place greater emphasis on social risks. This study highlights the signiﬁcance of smart city risks for researchers and practitioners, providing a solid direction for future smart-city research. This study provides a comprehensive overview of the risk subject matter in the smart-city literature and a signiﬁcant understanding of smart-city risks. It establishes a practical guide for urban authorities to use in their governance processes and also lays the groundwork for future investigations in the ﬁeld. Future research should focus on exploring the relevant social risks and mitigation strategies, to assist governments in their decision-making processes. Furthermore, socio-technical risks need further examination, to ﬁnd the best match between the technological and social components of a smart city.


Introduction
Urbanization is defined as a multidimensional process in which large numbers of people rapidly and permanently concentrate in a relatively small geographic area to form cities [1]. Such rapid growth is the underlying source of urban issues, due to the additional pressure on urban infrastructure and natural resources [2]. The sustainable social, economic, and environmental development of cities and the provision of adequate resources for citizens can become a real challenge for governments [3]. Thus, governments and city authorities are now considering novel approaches to meet citizens' demands, focusing on the efficient utilization of resources while minimizing adverse impacts on the natural environment [4]. Approaches for a green city, sustainable city, carbon-neutral city, and smart city have been introduced to revolutionize the use of natural resources and urban infrastructure to address urbanization problems [5]. The smart-city concept-the latest trend-integrates information technologies into urban areas, to overcome urban challenges, improve sustainability in cities, and enhance citizens' quality of life [6].
The concept of a smart city was first introduced in the 1990s [7]. Since then, various scholars and industrial bodies have tried to develop a proper smart-city definition. Although there has not been a clear and comprehensive definition of a smart city established, some common characteristics exist among all smart cities. Nam and Pardo [8] emphasized that the smart city should consider technology, human, and institutional factors as its core components. Bergh and Viaene [9] further defined a smart city by suggesting two main types of a smart city: (1) technology-oriented infrastructure-intensive

Phase 1: Identification
The first stage of this review was the formulation of the problem, including the development of the research question and research aim and establishment of the research protocol and criteria [29]. The purpose of this study was clearly defined and discussed in the introduction section. A detailed protocol was structured to search the body of knowledge and achieve the research aim. The initial search was conducted in December 2019, using electronic databases, including Scopus and Web of Science. Since Scopus is the largest source of peer-reviewed articles, sourcing from more than 5000 publishers in various areas, it was a suitable database to search for this study [30]. Web of Science also includes more than 9000 of the most impactful journals across 178 disciplines, which encompasses over 35 million records [31].
To obtain the most relevant and accurate results, the following collection of keywords was used with the "OR" Boolean connector: "smart city", "smart cities", "digital city", "intelligent city", Records after duplication removed (n=234)

Phase 1: Identification
The first stage of this review was the formulation of the problem, including the development of the research question and research aim and establishment of the research protocol and criteria [29]. The purpose of this study was clearly defined and discussed in the introduction section. A detailed protocol was structured to search the body of knowledge and achieve the research aim. The initial search was conducted in December 2019, using electronic databases, including Scopus and Web of Science. Since Scopus is the largest source of peer-reviewed articles, sourcing from more than 5000 publishers in various areas, it was a suitable database to search for this study [30]. Web of Science also includes more than 9000 of the most impactful journals across 178 disciplines, which encompasses over 35 million records [31].
To obtain the most relevant and accurate results, the following collection of keywords was used with the "OR" Boolean connector: "smart city", "smart cities", "digital city", "intelligent city", "information city", "ubiquitous city", and "wired city". An "AND" Boolean connector was used to include the "risk" keyword and create an additional search string. Since the smart city concept was first Sustainability 2020, 12, 9280 5 of 20 introduced in the late 1990s and early 2000s [32], any publication before 2000 was excluded, and the search was limited to the papers published between 2000 and 2019. This resulted in a substantial number of articles, including 792 papers obtained through Scopus and 246 documents from the Web of Science.

Phase 2: Eligibility
In this stage, adequate inclusion/exclusion criteria were outlined to ensure that the research question boundaries were distinctly defined [33]. Table 1 outlines these inclusion/exclusion criteria, which were utilized as a checklist throughout the research process. Any publication in a language other than English was eliminated from further review. In addition, the search was restricted to peer-reviewed journal articles, to ensure the quality and reliability of the publications [30]. The outcome of this refinement process was 199 articles gathered from Scopus and 113 papers gathered from the Web of Science.

Phase 3: Screening
In the screening phase, the reviewers decided which studies should be considered for review. The first step in the screening process was to remove duplications of articles, which led to a total number of 234 peer-reviewed journal articles from both databases for further investigation to assess their relevance to the research question [34]. The titles, abstracts, and keywords of the articles were then manually screened, to exclude irrelevant papers. Some of the papers were eliminated because they were outside the scope of this research (e.g., smartphone, smart toys, smart home, chronic disease risk, and cancer risks), and this process resulted in the identification of 30 irrelevant articles. The authors then carefully read the full texts of the remaining 204 studies, to ensure the alignment of the articles with the research question. The focus of this reading was to identify the types of risks in smart cities. At the end of the screening process, only 85 papers met the inclusion and exclusion criteria, which are listed in Table 2.

Phase 4: Analysis
In this stage of the review process, information was systematically taken from the remaining 85 articles, for a quantitative and then a thematic analysis. The former involved considering each article as a separate case that has a particular variable, such as publication date, context, and method [35]. The latter analysis included mapping all the information provided within the articles, to identify research gaps in the smart-city risk and provide an outline for future research. In a broad sense, the thematic analysis involved the processes of reading the selected literature and extracting their common themes [36]. All 85 articles were read thoroughly and in detail, to extract their mutual themes.  The √ specifies the research methods and risk categories of the papers. The bold is to emphasize on this row since it shows the total number of papers in each category.

Results
The selected studies have a wide range of diversity among publication years, context, and research methods. For the quantitative analysis, data from the identified articles were summarized in a numerical format, according to their publication date, country, and research method [121]. The articles were also thematically analyzed to identify their common themes and categories. To achieve this goal, the authors labeled the recorded articles based on their proposed smart-city risks and classified them into three different categories, namely technological risks, organizational risks, and social risks [122].

Quantitative Analysis
The descriptive statistics for the 85 identified articles are shown in Table 2. This table outlines the quantitative data, including publication date, context, and method. The publication trend from 2000 to 2019 is depicted in Figure 2. The table and the graph collectively reveal that the oldest study was conducted in 2000 and that the number of articles has gradually increased since 2012. The figure shows that more than 65% of the articles were published in the last two years, and almost 90% of the studies were published in the last five years. For a decade, from 2000 to 2010, no publication addressed the subject of smart city risks.

Results
The selected studies have a wide range of diversity among publication years, context, and research methods. For the quantitative analysis, data from the identified articles were summarized in a numerical format, according to their publication date, country, and research method [121]. The articles were also thematically analyzed to identify their common themes and categories. To achieve this goal, the authors labeled the recorded articles based on their proposed smart-city risks and classified them into three different categories, namely technological risks, organizational risks, and social risks [122].

Quantitative Analysis
The descriptive statistics for the 85 identified articles are shown in Table 2. This table outlines the quantitative data, including publication date, context, and method. The publication trend from 2000 to 2019 is depicted in Figure 2. The table and the graph collectively reveal that the oldest study was conducted in 2000 and that the number of articles has gradually increased since 2012. The figure shows that more than 65% of the articles were published in the last two years, and almost 90% of the studies were published in the last five years. For a decade, from 2000 to 2010, no publication addressed the subject of smart city risks.
The selected articles are also very distinct in terms of their context, and a total of 25 different countries were identified. The number of studies in each country was counted, and the results show that more than 42% of the papers were published in the UK (14 articles), US (13 articles), and China (10 articles).  2 also indicates that the research methods in the included papers are varied. This variation is because the studies were included subject to the inclusion criteria, regardless of their research methodology. The analysis of the results, which is illustrated in Figure 3, shows that 36% of the identified articles used empirical methods, while 33% utilized theoretical methods. Qualitative methods are presented in 21% of the studies, and quantitative and mixed methods, respectively, are found in 5% and 4%. The selected articles are also very distinct in terms of their context, and a total of 25 different countries were identified. The number of studies in each country was counted, and the results show that more than 42% of the papers were published in the UK (14 articles), US (13 articles), and China (10 articles). Table 2 also indicates that the research methods in the included papers are varied. This variation is because the studies were included subject to the inclusion criteria, regardless of their research methodology. The analysis of the results, which is illustrated in Figure 3, shows that 36% of the identified articles used empirical methods, while 33% utilized theoretical methods. Qualitative methods are presented in 21% of the studies, and quantitative and mixed methods, respectively, are found in 5% and 4%.

Thematic Analysis
The selected publications determine different types of risks for smart-city development. Vidiasova, Cronemberger, and Vidiasov [122] categorized smart city risk factors as organizational, social, and technological. Table 3 represents the risk factors under each category. Table 3. Smart-city critical risk factors (modified from Vidiasova et al. [122]).

Resistance to the Citizens' Participation in Political Decision-Making
Organizational Risks Absence of required competencies of authorities in a smart city Over technologized organizations Complication of city-management processes

Social Risks
Stakeholders' conflict Mistrust of society to new technologies Lack of citizens' participations in smart city Disappearance of many professions and growth of unemployment Digital divide and inequality between citizens due to different level of competences in the Information and Communication Technologies (ICT) Gentrification due to higher cost of living in smart cities

Technological Risks
Cyber security Treat of data loss Incompatibility between smart systems and less developed areas Repair and maintenance of smart technologies Accordingly, the identified articles were categorized thematically under three different groups, including "organizational risks", "social risks", and "technological risks", based on the type of risk that they address. The majority of the papers, which accounts for 52% of the studies, investigates technological risks, while only 16% of the articles consider social risks in smart-city development programs. The remaining articles, comprising 32% of the total, address organizational risks.
Organizational risks are most frequently mentioned in the studies conducted in China (n = 6), the US (n = 4), and India (n = 4)While social risks are mostly discussed in the UK (n = 3) and Italy (n = 3), technological risks are mainly addressed by the UK (n = 9) and the US (n = 7).

Organizational Risks
The first theme focuses on organizational risks for smart-city development programs, and 28 papers were identified within this theme. This group of papers is divided into two subcategories. The first subset introduces different types of potential hazards to smart-city governance, strategies, decision-making, coordination processes, and business environments. For example, Brous, Janssen and Herder [105] examine the risks associated with the adoption of the Internet of Things (IoT) in smart-city organizations. They identify a number of organizational risks, such as "high implementation cost", "low-quality service", "lack of sufficient legal framework", and "inaccurate data on which decisions are made". Javidroozi, Shah and Feldman [49] also highlight some additional organizational risks and challenges, including "complexity", "efficiency", "agility and flexibility", "monitoring", and "standardization". Correspondingly, Wu, Zhang, Shen, Mo, and Peng [68] investigate the organizational risks embedded in the development of smart cities with Chinese characteristics and highlight a few risks, mainly including the "incapability of dealing with an emergency" and "lack of independent research on smart cities".
The second subset in this theme includes articles that propose an organizational solution to overcome smart-city risks. De Nicola, Melchiori, and Villani [83] present a framework to deal with risks and consequences of an emergency situation in smart cities, to support decision-makers in developing emergency plans. Similarly, Mustafa and Kar [84] identify and prioritize different risk dimensions, to help smart-city risk managers decide which dimensions of risk are more critical for digital-service delivery in smart cities. They also argue that performance and financial risks are the most significant organizational risks across digital services in smart cities. Safransky [58] proposed a decision-making supporting algorithm, via a case-study simulation, for authorities to identify potential areas of high risk in violence.

Social Risks
The second category which focuses on social risks for smart cities is the least researched area, and only 14 publications were identified in this theme. This theme included articles that discuss possible threats of smart cities to individuals, societies, and communities, as well as solutions to mitigate these concerns. For example, Galdon-Clavell [92] argues that citizen empowerment and bottom-up approaches are neglected in smart cities' programs. The author also identifies other problems, including discrimination and uninformed consent. In another study, White [113] challenges the claimed social benefits of smart cities, including their role as a solution for rapid-urbanization social issues. The researcher then asserts that smart cities do not tend to address any causes of these social problems. Trivellato [76] also investigates social sustainability risks in smart cities and identifies a low level of citizen participation and involvement in urban decision-making processes as one of the social risks for smart cities. McGuire [39] goes even further and warns about stupefaction and stultification in smart cities. Stupefaction is defined as the risk of losing control over how we use technology, while stultification is described as the risk of new technologies making citizens more stupid because people might lose their ability to engage in inference and reasoning.
Another subset of publications in this category proposes a method, tool, or technique to manage social risks in smart cities. Di Bella et al. [73] develop a multi-indicator approach for measuring urban crimes in smart cities. This study categorizes different landscapes of public safety and risk of crime into five groups of indicators, namely crime count, population-based crime rate, risk-based crime rate, crime density, and crime-location proportions. Grimaldi et al. [96] also develop a method to manage the opening of new shops to decrease the risk of uniformity in communities and gentrification in smart cities. Their model is based on some business and social criteria, such as the flow of people, the localization of shops, and the neighborhood's culture.

Technological Risks
The third theme includes 45 publications that address technological risks for smart cities and is the most abundantly researched area among the identified literatureWhile the articles in this group mainly focus on cybersecurity, there is a secondary subset that considers other types of technological risks for smart cities. Vassilaras and Yovanof [97] provide an overview of some technological risks and challenges for smart cities, including cybersecurity and privacy, as well as interoperability among different technologies. Subsequently, Zhu and Zuo [64] present a system security mode to unravel the cybersecurity problems of smart cities. The study suggests some measures to consolidate information security in smart cities, including enhancing citizens' information security literacy, improving information management regulations, and reinforcing physical equipment and infrastructure. Kitchin and Dodge [48] investigate the current status of information security in smart cities, as well as existing mitigation strategies, and then propose a set of systematic interventions to enhance cybersecurity. The suggested solutions include security-by-design, corrective security patching and replacement, the establishment of a security emergency response team, modification of the procedures of procurement, and continuing professional development.
The second category of publications in this theme addresses technological risks other than cybersecurity challenges. Lee et al. [87] introduce a new smart water grid to decrease the water infrastructures' failures in smart cities. In this study, ICT and water-management solutions are integrated to increase water security, as well as the safety of water quality. In another study, Bartoli et al. [74] created an IT platform to monitor, predict, and manage technical risks in smart cities. The proposed system integrates ICT infrastructures and analysis methods to manage the flow of information among first responders, city authorities, and smart city residents. In another study, Spiliotis et al. [99] designed a framework to track the performance of photovoltaic systems, to minimize the risk of malfunction and mitigate the effects of uncertainty related to the monitoring and maintenance of photovoltaic systems in a smart city.

Co-Related Themes
While these three themes may seem independent of each other on the surface, there are some overlaps among them. The identified articles can be primarily categorized into one of the "Organizational Risks", "Social Risks", or "Technological Risks" themes; however, they can be further classified into one of three co-related themes: (1) "Digital Transformation Risks" [123], (2) "Socio-Technical Risks" [124], and (3) "Corporate Social Responsibility Risks" [125]. Figure 4 illustrates these overlaps among smart-city risks.
The results of this thematic analysis revealed that the most frequent overlapping theme is "Socio-Technical Risks" (see Table 4). Not everyone is proficient in utilizing digital technologies or fully aware of the available smart technologies, as digital illiteracy remains present in current society, and not everyone is given sufficient access to digital technologies. As a result, there is a high probability that technology-vulnerable people will be neglected and thus be unable to receive the full benefits of a smart city. As socio-technical systems comprise both human and technological elements, there are corresponding dynamic "Socio-Technical Risks" for these systems [124]. Technological and organizational factors are linked together by the digital transformation concept, as not all organizations are ready to adopt new changes or are aware of the need for technological changes. Furthermore, not every business is able to invest in advanced digital technologies to change its current processes and older digital technologies. Thus, the correlated risk can be considered "Digital Transformation Risk" [123]. Finally, corporate social responsibility is at the intersection of the organizational and social aspects, and the risks at this conjunction are defined as "Corporate Social Responsibility Risks" [125]. The cutting-edge technologies driving current cities to smart cities have been developed maintenance of photovoltaic systems in a smart city.

Co-Related Themes
While these three themes may seem independent of each other on the surface, there are some overlaps among them. The identified articles can be primarily categorized into one of the "Organizational Risks", "Social Risks", or "Technological Risks" themes; however, they can be further classified into one of three co-related themes: (1) "Digital Transformation Risks" [123], (2) "Socio-Technical Risks" [124], and (3) "Corporate Social Responsibility Risks" [125]. Figure 4 illustrates these overlaps among smart-city risks. The results of this thematic analysis revealed that the most frequent overlapping theme is "Socio-Technical Risks" (see Table 4). Not everyone is proficient in utilizing digital technologies or fully aware of the available smart technologies, as digital illiteracy remains present in current society, and not everyone is given sufficient access to digital technologies. As a result, there is a high probability

Discussion
This systematic review shows that "Technological Risks" is the most commonly researched theme, while social risk is the least studied area. Since some of the articles belonged to more than one theme, they were further classified into the overlapping themes of "Corporate Social Responsibility Risks", "Digital Transformation Risks", and "Socio-Technical Risks". Among these categories, "Socio-Technical Risks" was the most frequent theme.
Although the first article to address smart-city risks was published in 2000, no paper on this topic was published between 2000 and 2010. In contrast to the significant promotion of smart cities within the ICT industry, only a few scholars paid attention to smart-city risks until 2010. This is because the effects of any changes in urban systems take considerable time to appear [126]. Moreover, the proper establishment of smart-city research as a new scientific area goes back to 2009 [127]. Therefore, the implementation of well-established knowledge areas, such as risk management, to the smart city concept was delayed until 2010, making this topic a relatively new research discipline.
The review shows that the United Kingdom (UK) has the highest number of studies in the area of smart-city risk. This result was predictable, since both the first smart city, Bletchley Park [128], and the most advanced smart city, London [129], are located in the UK. Furthermore, the UK has the highest number of smart cities among European countries [130]. All of these factors can reasonably explain the large number of publications in the UK.
The most obvious finding to emerge from this review is that technological risks have been widely investigated in the literature, while social risks have been largely overlooked, even though Vidiasova et al. [122] noted that social risks for smart cities are as significant as technological risks. Technological risks may be overemphasized because technology is the main driver of smart-city development [14], and the concept is primarily promoted by leading ICT corporations, such as IBM, Cisco, and Siemens [131]. An alternative explanation is that, while technical challenges are detectible during the implementation stage, the social effects of smart cities might take considerably more time to appear in societies. Therefore, social risks have not yet emerged as a critical issue over an extended period and, consequently, have not been investigated as frequently as technological risks.
Another important finding is that, along with the UK, Italy has the highest number of studies on smart-city social risks. This result can be explained by the fact that Italian citizens are actively engaged with city governance and decision-making processes, and ICT technology is utilized only to enhance residents' quality of life and resolve social problems [130]. The government has also implemented various programs to reduce social risks in their smart cities [130]. These attributes highlight the significance of social aspects in Italian smart cities, so it is hardly surprising that Italy has the highest number of articles on the "social risk" theme.

Conclusions and Future Work
The integration of risk management into smart-city strategic plans is vital, as transitioning from a traditional to a smart city is a complex and uncertain process. Various reviews have been conducted on different domains of the smart city. However, there has not yet been a comprehensive overview of the current publications on smart-city risks. Therefore, this study set out to explore the existing literature, to identify the origin, trends, and types of risks in smart-city research studies over the past two decades. Through a systematic literature review, this study identified 85 articles related to smart-city risks. The selected articles were analyzed, interpreted, and categorized, to recognize their common and overlapping themes.
The results reveal that risk is a relatively new topic in the smart-city discipline, which is mostly discussed in the context of countries that have the highest number of existing smart cities. This review determined the three different categories for smart cities: technological, organizational, and social risks. It also identified some overlapping groups, including digital transformation, socio-technical, and corporate social responsibility risks. The review findings suggest that, although various studies address smart-city technological risks, little focus is given to the related social aspects. The reason for the lack of such studies is partially because the primary driving force of smart cities is the technology promoted by major ICT corporations. An alternative explanation is that, unlike technical problems, social issues take a long time to appear. Another major finding is that studies from countries that have a long history of smart cities, such as the UK and Italy, have paid more attention to these social risks.
This study provides a comprehensive overview of the risk subject matter in the smart-city literature and a significant understanding of smart-city risks. It establishes a practical guide for urban authorities to use in their governance processes and also lays the groundwork for future investigations in the field. Future research should focus on exploring the relevant social risks and mitigation strategies, to assist governments in their decision-making processes. Furthermore, socio-technical risks need further examination, to find the best match between the technological and social components of a smart city.
A limitation of this review is that only peer-reviewed articles were selected. Secondly, this study reviewed only publications under the smart-city domain in the Scopus and Web of Science databases. Finally, although the focus of this review was on risks, it does not mean that other aspects of smart cities are fully understood by the research community.