America’s increasingly connected homes will soon be even more plugged in as electronic holiday gifts — smart speakers, TVs, thermostats, video doorbells, even smart pet feeders and litter boxes — are installed.
Because many of these Internet of Things (IOT) devices have microphones and cameras that are always online, they’re an inviting target for hackers who can use them to spy on us.
Related
This increasing connectivity also results in a growing loss of privacy, as these smart devices collect and share data with the manufacturer and others. It’s “a goldmine of data about how they’re being used — and increasingly who is using them,” digital security expert Adam Levin wrote in a recent article for Inc.
And that tradeoff is not always apparent or clearly understood by the person living with the device.
“It's incumbent upon consumers to recognize just how many different kinds of sensors they are bringing into their homes — whether it's microphones, video cameras or just devices that are capturing all sorts of data about them and their guests,” said Maurice Turner, deputy director of the Center for Democracy & Technology. “So, it's not just about one video doorbell or one Internet-connected TV; it's thinking about all of those devices working in concert. What information is being collected and who has access to either keep it, or more importantly, share it?”
Smart devices need to gather certain types of data to work properly and improve their performance. But in many cases, privacy experts argue, too much information is being collected and shared with third-party companies.
“We know there's a lot of money being made by collecting and packaging our data,” said Ashley Boyd, vice president for advocacy and engagement at the Mozilla Foundation. "Our position is: Let consumers opt in to that kind of data collection, rather than opt out. Our concern lies in the lack of transparency or even basic information about the data that's being collected.”
The Consumer Technology Association (CTA) acknowledges the growing concern about privacy and says steps are being taken to make people feel safe and comfortable using connected devices.
“The industry is committed to strong consumer data privacy protections and transparency,” said Mike Bergman, CTA’s vice president of technology and standards. “These devices do provide a lot of benefits, but we understand that consumers need to trust the products they're bringing into their homes.”
It's incumbent upon consumers to recognize just how many different kinds of sensors they are bringing into their homes — whether it's microphones, video cameras or just devices that are capturing all sorts of data about them and their guests.
Maurice Turner, deputy director of the Center for Democracy & Technology
That’s why manufacturers are giving users more control over the data that’s collected and how it’s used and stored, Bergman told NBC News BETTER.
RATING PRODUCTS FOR SECURITY AND PRIVACY
For its third annual Privacy Not Included report, Mozilla reviewed 76 popular connected gifts in six categories: smart home, entertainment, toys and games, wearables, health and exercise and pet products.
Researchers read privacy policies, looked at product and app specifications, and contacted companies about their encryption to answer these important questions:
- Is there a privacy policy and how accessible is it?
- Does the product require strong passwords?
- Does it collect biometric data?
- Are there automatic security updates?
Most of the products rated in this report met Mozilla’s minimum security standards. Eight did not:
- Artie 3000 Coding Robot
- Litter Robot 3 Connect
- OurPets SmartScoop Intelligent Litter Box
- Petsafe Smart Pet Feeder
- Ring Video Doorbell
- Ring Indoor Cam
- Ring Security Cams
- Wemo WiFi Smart Dimmer
While smaller companies often don’t have the resources to prioritize the privacy and security of their products, many of the big tech companies, such as Apple and Google, are “doing pretty well at securing their products,” the report concluded. “But even when devices are secure, they can still collect a lot of data about users.”
Related
PRIVACY POLICIES NEED IMPROVEMENT
Few of us read the privacy policies for the smart devices we buy. They’re way too long and difficult to read.
Jamie Boone, vice president for government affairs at the Consumer Technology Association, says the industry realizes this is a problem and is working to improve disclosures about notice, choice and consent.
“We’re seeing a concerted effort to update those policies and make them more readable and make them easier to find,” Boone told NBC News BETTER.
Mozilla agrees. Its study found that overall, manufacturers are “making strides” in how privacy information is presented. More privacy pages — such as those by Apple and Roomba — are being written in “simple, accessible language,” the report said.
But the researchers cautioned: Customer data is also “being used in ways users may not have anticipated,” even if it is stated in the privacy policy. For instance, people with video doorbells may not realize that all that video is stored on company servers, and may, in some cases, be shared with law enforcement.
In November, the Washington Post reported that Amazon, which owns Ring, has entered into agreements with more than 600 police departments across the country allowing them “to quickly request and download video” recorded by the Ring doorbell cameras.
DO YOU REALLY NEED A SMART DEVICE?
Connectivity sells products, so manufacturers are flooding the market with all sorts of household appliances and wearable devices that are web-enabled. You need to ask yourself, is the risk to your privacy or safety worth the benefits?
“In some cases, we're connecting stuff to the Internet that we don't necessarily need to connect,” said Charles Henderson, head of IBM’s X-Force Red security testing team. “Is the risk of compromise worth the reward of being able to see the inside of your refrigerator from across town?”
Henderson suggests doing this risk vs. reward analysis for all the smart technology you consider bringing into your home. You need to consider the increased risk to your privacy that comes from having devices with microphones and cameras spread throughout the house.
“You expect these devices to be used for the intended purposes, but they can certainly be abused — and you may not know it,” Henderson cautioned. “It's not like there’s a big light on top of your voice assistant that flashes red when a criminal is inside.”
Related
HOW YOU SET UP THE DEVICE CAN MAKE A BIG DIFFERENCE
When you get a new smart device, you want to have it up and running as quickly as possible. So, it’s easy to race through the settings, agreeing to various types of data collection, sharing and storage, without thinking about it.
Is the risk of compromise worth the reward of being able to see the inside of your refrigerator from across town?
Charles Henderson, head of IBM’s X-Force Red security testing team
Chances are you won’t read the entire privacy policy, but it’s important to check the default settings to find out what information is being collected and what’s being done with it.
“A lot of these devices do have options, but the defaults are often toward collection and sharing,” said Justin Brookman, director of consumer privacy and technology at Consumer Reports. “It’s worth taking five minutes when you set up these devices to check what you're agreeing to and try to find the settings to maybe turn some of this data sharing off. It’s a shame that it's incumbent upon each user to have to do that, but it’s worth the time.”
Consumer Reports has detailed instructions on How to Turn Off Smart TV Snooping Features.
NEXT: Want to spend less when shopping? Ditch the cellphone, study suggests
Want more tips like these? NBC News BETTER is obsessed with finding easier, healthier and smarter ways to live. Sign up for our newsletter and follow us on Facebook, Twitter and Instagram.