Big Brother in Your Living Room: Smart Device Surveillance

Embracing Technology and Confronting Smart Device Surveillance

We have embraced technology, seamlessly integrating it into our homes in our quest for convenience. Yet, as we invite these smart devices into our sanctuaries, we must confront an unsettling reality: smart device surveillance. The tools designed to enhance our lives may also compromise our privacy in profound and dangerous ways.

The Modern Robot Vacuum: A Double-Edged Sword

Consider the case of the modern robot vacuum, an unassuming appliance designed to keep our floors spotless. This device, equipped with cameras and sensors, is much more than a simple cleaner. It maps your home in detail, capturing not just the layout but the location of your furniture and even the people in the house. These maps, stored and updated regularly, can be a treasure trove of information if they fall into the wrong hands.

A Scandalous Exposé

In December 2022, MIT Technology Review published a scandalous exposé revealing how the mundane routines of people’s everyday lives were exposed online without their consent. One image captured a woman in a compromising situation, using the bathroom. Another showed a child sprawled on the ground, his face fully visible. These photos, taken by development versions of iRobot’s Roomba J7, were posted by data labellers in private groups on social media, highlighting a significant breach of privacy.

The Global Supply Chain for Data

The images captured by the Roomba were sent to Scale AI, a startup that contracts workers worldwide to label data used to train artificial intelligence. This practice highlights a sprawling global supply chain for data from our devices, creating significant privacy risks. Consumers regularly consent to having their data monitored on various devices without fully understanding the implications, often due to vaguely worded privacy policies that permit broad use of data.

Unawareness and Data Misuse

The risks associated with these devices are exacerbated by the fact that many users are unaware of how much of their data is being collected and potentially misused. For instance, a beta tester for iRobot revealed that the robot vacuums not only vacuum up dust but also collect footage that is sent out for data labelling. Workers then manually label these images, sometimes leading to inadvertent privacy breaches.

Data Annotation and Privacy Violations

Data annotation involves human reviewers who categorize and label the data, sometimes leading to uncomfortable situations where sensitive images are viewed and potentially shared. Capturing faces, especially those of minors, is inherently privacy-violating. Faces can be used to identify individuals across different contexts, posing long-term privacy risks. Using biometric data like faces is subject to stricter privacy laws, and collecting such data from children raises additional legal and ethical concerns.

Potential for Remote Hacking

Additionally, research by the University of Maryland, described in full below, turned a robot vacuum’s navigation sensor into a microphone. That suggests other devices with lidar sensors could be repurposed to collect sound, posing further privacy threats.

Sensitive Areas and Corporate Risks

The trend of placing these devices in sensitive areas such as meeting rooms and bedrooms is even more concerning. A robot vacuum in a corporate boardroom could inadvertently record confidential discussions, while one in a bedroom might capture the most private moments of our lives. Despite vendor assurances of robust encryption and security, instances have shown these devices transmitting data to external servers without user consent.

Beyond Robot Vacuums: Broader Privacy Concerns

Robot vacuums are just the tip of the iceberg. In 2020, multiple class-action lawsuits were filed against Amazon after users discovered their Ring smart cameras had been hacked. Hackers were recorded talking through the camera’s speakers to the users, subjecting them to slurs and taunts. A Texas couple was asked for $350,000 in Bitcoin, while children were targeted with frightening messages.

The Commercial Exploitation of Data

The implications extend beyond personal privacy to targeted marketing. Data collected by smart home devices can be analyzed to discern our consumption patterns and preferences. Marketers can use this information to bombard us with tailored advertisements, exploiting our private data for commercial gain. The notion that our refrigerator or air conditioner could inform marketing strategies is a chilling reminder of how our personal lives are increasingly commodified.

Risks of the Secondary Market

Moreover, the secondary market for these devices poses additional risks. Purchasing used smart devices from online platforms like Amazon can be a gamble. These gadgets can be easily rooted, allowing malicious actors to gain control with something as simple as a USB drive. Once compromised, a device that appears to function normally can become a spy, sending valuable data to unscrupulous entities.

“Raspberry Pi on Wheels”

As researchers have highlighted, many of these devices, including robot vacuums, can be thought of as “Raspberry Pi on wheels.” They are essentially compact computers with cameras and sensors capable of extensive data collection and processing. Hackers find it relatively easy to gain root access to these devices, often without disassembling them. This access allows them to control the device, stop it from “phoning home,” and redirect its data streams.

Euphemistic Terms and Privacy Concerns

The vendors are aware of privacy concerns and often attempt to downplay the risks by using euphemistic terms. Instead of calling these features “cameras,” they refer to them as “optical sensors.” However, these optical sensors function like cameras, capturing detailed images and videos that can be misused. An example from Roborock demonstrates this: the device takes “selfies” with its optical sensors, which are essentially real photos from a camera.

Intensified Privacy Concerns with Amazon’s Planned Acquisition

Amazon’s planned acquisition of iRobot, announced in August 2022, further intensified privacy concerns. Amazon, known for its extensive data collection practices, would have gained detailed maps of users’ homes. This information could be used to infer home sizes, income levels and even daily routines, allowing for even more precise targeted advertising. The deal was abandoned in January 2024, but the question it raised remains: whoever owns the vacuum company owns the maps.

Public Information vs. Private Details

Some people argue that their home layout is already public information on real estate websites or city planning. However, the details gleaned from an internal house plan can reveal much more. Amazon could have gained home size, income level, daily routines and lifestyle information from robot vacuums. The company could determine if the home has a crib or a dog bed, then focus targeted advertisements, including baby products or dog toys, on the user.

Validating Concerns Through Research

A team of researchers from the University of Maryland tested the validity of concerns about robot vacuums listening in on users. They remotely hacked into a robot vacuum to collect audio using its navigation system, which employs Lidar technology. By applying signal processing and deep learning techniques, they could recover speech and identify TV series playing in the room and human voices with 90% accuracy. This shows that a lidar sensor can be turned into a microphone.

Hacking and Privacy Issues

Other users worry that the Roomba’s camera could be hacked. A Redditor claiming to be a beta tester revealed that live streaming was one of the features they could test, posting the camera footage and some stills. These concerns highlight the broader issue of privacy and security in smart home devices.

Security Certifications and Persistent Risks

Despite certifications from respected organizations, many smart devices still pose significant security risks. For example, Roborock claims that its devices do not send camera pictures to the cloud, but the same devices offer a feature to watch pets remotely. This contradiction illustrates the need for skepticism when evaluating vendor claims. iRobot claims to have implemented privacy and security measures such as encryption and regular security patches. However, the leak of sensitive images indicates gaps in these protections.

Proactive Privacy Protection

With the increasing reliance on smart devices in our daily lives, steps must be taken to protect user data. A more proactive approach to user privacy could include increased data collection and usage transparency, regular security audits, and more robust data processing agreements involving third-party companies.

Consumer Responsibility and Privacy

As consumers, we must also consider our privacy and how our data is used when selecting home devices. Phones raise the same questions, as I found in The Mirage of Privacy. After all, we don’t want to be left in the dust when protecting our privacy. The onus is on companies to clean up their act and consumers to make informed decisions.

Conclusion

In an era of unprecedented technological capability, the potential for misuse is equally unprecedented. As we embrace the benefits of smart devices, we must also remain vigilant against their risks. Our privacy, security, and, ultimately, our way of life depend on it.