A WORD TO THE NERD

THE TELLTALE TOILET: AN IoT HORROR STORY

“I'm your best friend,” said the man's voice in eight-year-old Alyssa LeMay's bedroom. “I'm Santa Claus.” Then the song “Tiptoe through the Tulips” began playing through the Ring security camera that her parents had installed above her dresser.

It had surely never occurred to Alyssa—before she ran screaming for her parents that night in December 2019—that a stranger might be spying on her through her nanny cam. But Mr. and Mrs. LeMay thought they had taken precautions: strong passwords, a secure network. The one protection they didn't set up—two-factor authentication—might be the reason their daughter refuses to sleep in her bedroom now. But there's really no way to know.

Stranger (Internet of) Things

“Internet of Things” might be the stupidest name in technology, but it's a pretty simple concept: stuff that didn't use to have an Internet connection but does now. Many industrial machines send data to the cloud as part of normal operation these days. But most of us are more familiar with IoT on the consumer side—smart TVs, smart fridges, even smart socks and toothbrushes. If you are wearing a smartwatch, you yourself are a thing on the Internet of Things.

But should you be?

So far, a lot of the stuff we've discussed in this book has been pretty abstract: virtual machines, availability zones. IoT is more fraught because a malfunctioning IoT device can have immediate and disturbing consequences in the physical world.

Security Concerns

In 2015, security researchers remotely stopped a Jeep on a St. Louis highway by hacking in through the car's entertainment system. A few years earlier, a disgruntled former used-car-lot employee had shut down hundreds of cars in Texas via an insecure vehicle-immobilization system.

The point is that when life and death are on the line, you'd better hope that your online devices are secure. And a lot of IoT devices aren't. Gadget companies are mostly incentivized to sell new, shiny toys—not to close security loopholes, and certainly not to keep up with security updates on older versions of their products. Researchers from Stanford University recently found that two-thirds of American households have at least one smart device, and millions of these devices are vulnerable to simple hacks over the Internet.

And if you're thinking, “Well, a hacker can't do much harm by compromising my Keurig machine,” remember that these devices are usually on the same home WiFi network as your cameras, phone, and computer. Once the hackers get in, they've got all sorts of fun targets to explore.

Not every Thing has a bad security pedigree, though, so do your research before you buy—and even then, you may not have a full picture of what you're letting yourself in for.

Privacy Violations

If cloud security is about protecting your data from bad guys, privacy is about controlling what data you hand over to the cloud in the first place. Unfortunately, IoT takes a lot of that control out of your hands.

Most of the big tech companies make their money by selling your data to advertisers. So it's in their interest to collect as much information about you as possible—what we call “big data.” And most of us have no idea how much is possible.

Smart TVs are such a bad offender in this category that the FBI has started posting warnings about them. These days, your fancy 75-inch monitor likely comes with a hidden but equally fancy camera and microphone: performing facial recognition to figure out what you've been watching, whether you like it, and maybe even what you're eating in front of the TV. This might not bother you. But if it does, there's not really any way to disable the tracking, or even complain.

Ever seen an ad for sunscreen right after talking to someone about your beach vacation? You're not crazy or paranoid—your smartphone really is listening to you and sends keywords back to the cloud for marketing purposes. (If you don't like this, turning off voice assistants might help—they're basically just always-on microphones in your pocket.)

Can IoT devices actually improve your life and by extension society? Sure. Smart thermostats are pretty cool (pun intended). Wearable devices that can detect medical emergencies, such as falls, have huge potential to help the elderly. Heck, Alexa has been subpoenaed as a murder witness. But simply because of the amount of data they collect and their direct influence on physical reality, IoT technologies must clear a high bar for safety and responsibility. (If everyone has a smart button that can automatically dial 911, how many bogus 911 calls will there be?)

Right now, little oversight of IoT devices exists—at least in the United States. And until something changes there, it's probably a good idea to assume that any smart speaker or camera in your house might have a stranger spying through the other end. That's why Alyssa LeMay's parents eventually got rid of the webcam in her bedroom. They, like so many other smart buyers, have learned to beware.