If HIPAA is helpless in protecting information on fitness trackers, and voice-controlled TVs, smart thermostats and Internet-accessible appliances do almost nothing to ensure privacy, what will the convenience of connected things eventually cost consumers?
The Federal Trade Commission warned last month about the serious privacy and data security risks, noting that the number of Internet-connected devices will double, to 50 billion, by 2020.
We chatted with Shaun Murphy, a former Department of Defense communication systems security consultant who this year is launching PrivateGiant, an online-security firm. He says the threat is potentially greater than personal information giveaways on Facebook and other social media.
This is an edited version of our conversation.
Q: How close to zero is the amount of security on connected TVs, refrigerators and thermostats?
A: Take a look at the terms of service or privacy policy that nobody reads. They give themselves the right to do whatever they want.
Q: If you look through WeMo permissions on Belkin’s home-automation devices, it’s contacts and calendar, camera and microphone, phone call log and they can modify or delete your USB storage.
A: You piece all that information together and you think, “What possible reason are they doing this?” They’re covering themselves legally just in case something happens. But maybe there’s something sinister going on. Maybe they are acquiring data and maybe they are doing stuff with it.
More Top Picks Best Anti Glare Laptop Screen Protectors
Q: I’m testing a Wi-Fi-connected sleep monitor now. If I’m not sleeping well, why couldn’t the manufacturer try to sell me a sleep aid through advertising on its app? This is like Google placing personalized ads on your browser, isn’t it?
A: Absolutely. On one hand, maybe that’s a benefit, wonderful or a good solution. But maybe you don’t want them knowing that level of information about you. There’s no way to control that. As soon as you sign up, you’ve opted in. You’ve consented.
Q: How serious is the security threat?
A: Now that we have home security devices, now that we rely on managing our house and the security of our house and the function of our house, it’s a very real threat. If someone finds a hole, either through the back door or if there’s something easily, or not easily, exploitable, that puts us at physical risk now.
Q: Why not more security?
A: When it comes down to it, when you’re selling a device like a security system or home management system, you’re trying to get the price as low as you can. Any sort of overhead or development costs that you can shave off, so be it. Corners are definitely being cut. We haven’t seen too many vulnerabilities disclosed, but it’s definitely going to happen this year. I guarantee it.
Q: What will it take for people to understand that a hacker can access their thermostat?
A: Maybe your Wi-Fi is super secure, maybe your phone is super secure, but these devices connect to things over a remote server. That’s what the hackers are going after. And they’re not going after one person at a time. They’re going after thousands. We’ve seen that celebrities and high-ranking government officials are vulnerable to the same stuff we’re telling consumers.
Q: Symantec last year set up Bluetooth scanners at a race to show the vulnerability of information on fitness trackers: User names and passwords often were visible in clear text, not even encrypted. Why do people use their own name and address with these apps?
A: What do these devices need to know? What’s reasonable? Do they need to know my full name and street address? No. Maybe they need to know my gender for calorie-counting or my weight, but my first name and last name they don’t need to know. Maybe put in your first initial and a fake last name. Things that 100 percent uniquely identify myself, there’s no way I’m giving that out freely.
Q: There are so many more devices now that want our information.
A: You have one little device that’s monitoring one aspect of your life and two or three or four devices that are monitoring other things. You put them together and you’ve got this creepy persona, or creepy picture, of yourself that’s very accurate and they have a very nice correlated picture of who you are and how often you’re at home, when you’re not at home. It’s kind of scary.