What your smart devices know and share about you Kashmir Hill and Surya Mattu
Kashmir Hill: So for my
birthday last year,
my husband got me an Amazon Echo.
I was kind of shocked, actually,
because we both work
in privacy and security.
(Laughter)
And this was a device that would sit
in the middle of our home
with a microphone on,
constantly listening.
We’re not alone, though.
According to a survey by NPR
and Edison Research,
one in six American adults
now has a smart speaker,
which means that they have
a virtual assistant at home.
Like, that’s wild.
The future, or the future dystopia,
is getting here fast.
Beyond that, companies are offering us
all kinds of internet-connected devices.
There are smart lights, smart locks,
smart toilets, smart toys,
smart sex toys.
Being smart means the device
can connect to the internet,
it can gather data,
and it can talk to its owner.
But once your appliances can talk to you,
who else are they going to be talking to?
I wanted to find out,
so I went all-in and turned my
one-bedroom apartment in San Francisco
into a smart home.
I even connected our bed to the internet.
As far as I know, it was just
measuring our sleeping habits.
I can now tell you
that the only thing worse
than getting a terrible night’s sleep
is to have your smart bed
tell you the next day
that you “missed your goal
and got a low sleep score.”
(Laughter)
It’s like, “Thanks, smart bed.
As if I didn’t already
feel like shit today.”
(Laughter)
All together, I installed 18
internet-connected devices in my home.
I also installed a Surya.
Surya Mattu: Hi, I’m Surya.
(Laughter)
I monitored everything the smart home did.
I built a special router that let me look
at all the network activity.
You can think of my router
sort of like a security guard,
compulsively logging
all the network packets
as they entered and left the smart home.
KH: Surya and I are both journalists,
he’s not my husband,
we just work together at Gizmodo.
SM: Thank you for clarifying.
The devices Kashmir bought –
we were interested in understanding
what they were saying
to their manufacturers.
But we were also interested
in understanding
what the home’s digital
emissions look like
to the internet service provider.
We were seeing what the ISP could see,
but more importantly,
what they could sell.
KH: We ran the experiment for two months.
In that two months,
there wasn’t a single hour
of digital silence in the house –
not even when we went away for a week.
SM: Yeah, it’s so true.
Based on the data, I knew when
you guys woke up and went to bed.
I even knew when Kashmir
brushed her teeth.
I’m not going to out your brushing habits,
but let’s just say it was very clear to me
when you were working from home.
KH: Uh, I think you just outed them
to, like, a lot of people here.
SM: Don’t be embarrassed,
it’s just metadata.
I knew when you turned on your TV
and how long you watched it for.
Fun fact about the Hill household:
they don’t watch a lot of television,
but when they do,
it’s usually in binge mode.
Favorite shows include
“Difficult People” and “Party Down.”
KH: OK, you’re right,
I loved “Party Down.”
It’s a great show,
and you should definitely watch it.
But “Difficult People”
was all my husband, Trevor.
And Trevor was actually a little upset
that you knew about his binges,
because even though he’d been the one
to connect the TV to the router,
he forgot that the TV was watching us.
It’s actually not the first time
that our TV has spied on us.
The company that made it, VIZIO,
paid a 2.2 million-dollar settlement
to the government just last year,
because it had been collecting
second-by-second information
about what millions of people
were watching on TV, including us,
and then it was selling that information
to data brokers and advertisers.
SM: Ah, classic surveillance economy move.
The devices Kashmir bought
almost all pinged their servers daily.
But do you know which device
was especially chatty?
The Amazon Echo.
It contacted its servers
every three minutes,
regardless of whether
you were using it or not.
KH: In general, it was disconcerting
that all these devices were having
ongoing conversations
that were invisible to me.
I mean, I would have had
no idea, without your router.
If you buy a smart device,
you should probably know –
you’re going to own the device,
but in general, the company
is going to own your data.
And you know, I mean,
maybe that’s to be expected –
you buy an internet-connected device,
it’s going to use the internet.
But it’s strange to have these devices
moving into the intimate space
that is the home
and allowing companies to track
our really basic behavior there.
SM: So true.
Even the most banal-seeming data
can be mined by the surveillance economy.
For example, who cares
how often you brush your teeth?
Well, as it turns out, there’s a dental
insurance company called Beam.
They’ve been monitoring their customers'
smart toothbrushes since 2015 –
for discounts on their
premiums, of course.
KH: We know what
some of you are thinking:
this is the contract of the modern world.
You give up a little privacy,
and you get some convenience
or some price breaks in return.
But that wasn’t my experience
in my smart home.
It wasn’t convenient, it was infuriating.
I’ll admit, I love my smart vacuum,
but many other things in the house
drove me insane:
we ran out of electrical outlets,
and I had to download
over a dozen apps to my phone
to control everything.
And then every device had its own log-in,
my toothbrush had a password …
(Laughter)
And smart coffee, especially,
was just a world of hell.
SM: Wait, really? Cloud-powered
coffee wasn’t really working for you?
KH: I mean, maybe I’m naive,
but I thought it was going to be great.
I thought we’d just wake up in the morning
and we’d say, “Alexa, make us coffee.”
But that’s not how it went down.
We had to use this really particular,
brand-specific phrase to make it work.
It was, “Alexa, ask the Behmor
to run quick start.”
And this was just, like,
really hard to remember
first thing in the morning,
before you have had your caffeine.
(Laughter)
And apparently, it was hard to say,
because the Echo Dot
that was right next to our bed
just couldn’t understand us.
So we would basically start every day
by screaming this phrase at the Echo Dot.
(Laughter)
And Trevor hated this.
He’d be like, “Please, Kashmir,
just let me go to the kitchen and push
the button to make the coffee run.”
And I’d be like, “No, you can’t!
We have to do it the smart way!”
(Laughter)
I’m happy to report that our marriage
survived the experiment,
but just barely.
SM: If you decide to make your home smart,
hopefully, you’ll find it
less infuriating than Kashmir did.
But regardless, the smart things you buy
can and probably are used
to target and profile you.
Just the number of devices you have
can be used to predict
how rich or poor you are.
Facebook’s made this tech,
and they’ve also patented it.
KH: All the anxiety you currently feel
every time you go online,
about being tracked,
is about to move into your living room.
Or into your bedroom.
There’s this sex toy called the We-Vibe.
You might wonder why
a sex toy connects to the internet,
but it’s for two people
who are in a long-distance relationship,
so they can share their love from afar.
Some hackers took a close look at this toy
and saw it was sending
a lot of information
back to the company that made it –
when it was used,
how long it was used for,
what the vibration settings were,
how hot the toy got.
It was all going into a database.
So I reached out to the company,
and I said, “Why are you collecting
this really sensitive data?”
And they said, “Well, it’s great
for market research.”
But they were data-mining
their customers' orgasms.
And they weren’t telling them about it.
I mean, even if
you’re cavalier about privacy,
I hope that you would admit
that’s a step too far.
SM: This is why I want
to keep my sex toys dumb.
KH: That’s great.
We’re all very glad to know that.
(Laughter)
SM: A data point I’m willing to share.
(Laughter)
The devices Kashmir bought
range from useful to annoying.
But the thing they all had in common
was sharing data with
the companies that made them.
With email service providers
and social media,
we’ve long been told that if it’s free,
you’re the product.
But with the internet of things, it seems,
even if you pay, you’re still the product.
So you really have to ask:
Who’s the true beneficiary
of your smart home,
you or the company mining you?
KH: Look, we’re a tech savvy crowd here.
I think most of us know
that these things connect to the internet
and send data out.
And fine, maybe you’re OK with living
in that commercial panopticon,
but others aren’t.
We need the companies to rethink
the design of these devices
with our privacy in mind,
because we’re not all willing
to participate in “market research,”
just because a device we bought
has a Wi-Fi connection.
And I have to tell you,
even when you’re aware,
generally, this is happening,
it’s really easy to forget that normal
household items are spying on you.
It’s easy to forget
these things are watching you,
because they don’t look like cameras.
They could look like …
well, they could look like a dildo.
Thank you.
(Applause)