On February 23, 2022, CLTC hosted a panel of scholars whose research addresses the “internet of things” (IoT), as devices like smart cameras, smart speakers, video doorbells, and internet-connected toys are leading to new challenges for privacy, security, and surveillance in homes and neighborhoods. The panel was co-sponsored by Cyversity, which works to achieve the consistent representation of women and underrepresented minorities in the cybersecurity industry.
IoT devices can, in many cases, capture data from people who may not be aware of the devices, or whether and how they might opt out of data collection. Among the questions the panel considered were: How is the IoT changing privacy protection needs? What innovative approaches can protect security and privacy for the diverse homes and communities being impacted by IoT technologies? And what kind of research, policy, and community action can create solutions to these challenges?
The panel featured Diana Freed, Ph.D. candidate in the Department of Computer and Information Science at Cornell University; Jessica Vitak, Associate Professor in the College of Information Studies and Director of the Human-Computer Interaction Lab (HCIL) at the University of Maryland; Yaxing Yao, Assistant Professor in the Department of Information Systems at the University of Maryland, Baltimore County; and Michael Zimmer, Associate Professor in the Department of Computer Science at Marquette University and an Affiliated Faculty at the Northwestern Mutual Data Science Institute. The conversation was moderated by Richmond Wong, a Postdoctoral Researcher at the UC Berkeley Center for Long-Term Cybersecurity.
“These challenges are not only about data security, but about the diverse humans who interact with these devices, and how people from different backgrounds or skill levels or populations might face different types of harms or risks,” Wong said in his introductory remarks, noting that the panel built on themes discussed at the 2021 Conference on Computer-supported Cooperative Work (CSCW).
Each of the researchers briefly introduced their work. Freed explained that her research focuses on technology-facilitated abuse in the context of interpersonal relationships. “These types of IoT devices are often used as tools for partners to surveil each other,” she said. “The devices are used both overtly and covertly. Very often, in an abusive relationship, an abuser might leave the relationship and still maintain control of the home through these types of devices. And that gives them power over the home environment, as well as the individual.”
Research collaborators Jessica Vitak and Michael Zimmer research a range of questions related to consumer perceptions of data-collecting devices, and people’s awareness of how the data may be used, particularly when combined with other data sources. “Data captured in isolation might not be as problematic,” Vitak said. “The concern happens when you start aggregating that data with different data sources, or you start sharing that data with entities that are going to make decisions based on that…. There’s a lot of potential for unwittingly sharing sensitive information with these devices, and we don’t know how that data is necessarily going to be used both in the immediate future, but also in the far future. That raises a lot of concerns.”
Zimmer noted that their research had revealed cross-cultural differences about data collection. Surveyed device users in the United States, for example, noted they were more willing to share data with companies, but were wary of how government entities might use their personal information. In the Netherlands, on the other hand, the attitudes were reversed, with greater trust that the government would use data to improve lives, and lower trust that institutions like Google would use their data responsibly. “There are interesting nuances that we have to figure out throughout this whole ecosystem,” Zimmer said.
Yaxing Yao explained that his work focuses on the “multi-stakeholder perspective,” focusing not only on the users of IoT devices, but also “bystanders,” such as visitors or roommates. “One of the things that surfaced in my work is really the tension among different stakeholders,” Yao said. “How do you balance the needs of different stakeholders, and how can you negotiate the expectations? We have seen that bystanders not only have privacy needs, but they also want to have some level of control. How do you do that in a setting that is not your home?”
The panelists noted that data-capturing IoT devices have potential to add to changes in power dynamics, particularly as more employees settle into “work at home” positions, and that consumers often have limited understanding of which devices are capturing what data. Freed noted that people often mistakenly believe that their TVs are surveilling them, for example.
Questions of consent about the use of IoT devices also emerge frequently, whether for elderly people in nursing homes whose families have installed monitoring cameras, or for children who have little agency or decision-making power about the devices in their homes. “I don’t think that most people are engaging in any kind of critical reflection on those bystanders,” Vitak said, noting that traditions like the “Elf on the Shelf” may contribute to “normalizing surveillance among young children” so they are “expecting to be watched and have data captured about them in various ways.”
“What we’re also seeing in the schools is that, on the laptops that are handed to children, there are different types of software that are monitoring conversations,” Freed added. “There just doesn’t seem to be a lot of digital boundaries in people’s lives, especially young people. They’re not even aware of what their rights should be, and it’s not always clear who’s advocating for these rights. It’s important that we create better education for kids around these types of topics so they have a sense of what their rights are, and how they can think about privacy in terms of safety.”
Watch the full presentation above or on YouTube.
