Technology & Innovation

Does the IoT fun stop with connected toy data breaches?

April 21, 2017

Global

April 21, 2017

Global
Jim Ivers

Vice President and Senior Director of Marketing for the Software Integrity Group

Jim is a 30-year technology veteran who has spent the last ten years in IT security. Prior to Cigital, Jim was the CMO at companies such as Covata, Triumfant, Vovici, and Cybertrust, a US$200m security solutions provider that was sold to Verizon Business. Jim also served as VP of Marketing for webMethods and VP of Product Management for Information Builders.

The term “connected device” should immediately provoke questions such as “to what?”, “for what purpose?”, and “with what level of protection for the data?”

Making predictions can be a tricky business. Being proven right doesn’t always happen immediately and up until you are proven right, you are either wrong or early.

When toymaker VTech announced in November 2015 that nearly five million customer records had been leaked (including pictures of and data about children), many working in the IoT field predicted that the breach would be a tipping point for security and privacy issues with connected toys. Much of the theorising was based on the notion that nothing stirs the emotions faster than concerns over the privacy and safety of children.  

This prediction didn’t receive any traction at the time. Just as security professionals were beginning to embrace the notion that they were wrong in their predictions, a string of recent events may prove that they were merely too early.

Smart toy security troubles are on the rise

In mid-February 2017, it was reported that the Federal Network Agency in Germany issued a warning to parents about the . The agency, which presides over telecommunications in Germany, advised parents to destroy the doll because it collects and transmits conversations with children.

The data in the conversations were being parsed by speech recognition software that can turn dialogue into searchable queries. Although the agency based their warning on the doll being a “concealed transmitting device” that ran afoul of the law, there was also much concern over regulations protecting the privacy and security of children. Agencies from multiple countries, including Federal Trade Commission in the US, expressed concerns over these privacy and security issues.

In early March 2017, it was reported that toymaker Spiral Toys had been hacked, exposing data from over 800,000 users. The data contained personalised voice messages, pictures and other data collected via Internet-connected teddy bears and the associated smartphone apps. Researchers reported that the data was stored on a database that was unprotected and not behind a firewall. The same researchers believe the data was held for ransom before being exposed by multiple sources.

Any parent would find these breaches of privacy and security reprehensible. As someone in the software security space, you would be inclined to view these breaches to be inevitable, yet easily preventable. As a citizen of the world, take the view of this as a continued warning about the dangers of IoT and connected everything.

Securing smart devices goes beyond toy manufacturers

It is difficult to believe that there is malicious intent on the part of the toy manufacturers. They are looking for an angle to sell toys, and IoT and connected devices are hot topics. They are also financially motivated to hold down production costs for profitability. Having a connected toy adds new cost items such as building the associated app and building the infrastructure (including data storage) to store the collected data. All of their key business drivers (e.g., time to market and profitability) are diametrically opposed to notions of building security into the process.

Take note that this is not a set of issues unique to connected toys. Other issues were exposed in February on the analysis of the end user license agreements for smart televisions. Manufacturers are now warning people not to discuss sensitive subjects in front of these televisions as the conversation will be recorded and stored. This includes the voices of children.

It’s time to take IoT security and privacy seriously

The issue of privacy laws is simple and must be recognised by consumers: If something is IoT or connected it collects data, that data goes somewhere and is stored. While seemingly benign, that data may combine sensitive information—which can be stolen.

Add children to the mix and the focus suddenly shifts. There have been no reports of children receiving inappropriate messages or other misuses of the leaked data yet but the fact remains that these children have been put at risk.

The previous, bold industry prediction was that parents will begin to demand that connected toys demonstrate the basic concepts of data privacy and security as awareness of the problem reaches critical mass. Enlightened toy manufacturers will begin to embrace the basic concepts of security and build connected toys that can be trusted by parents. They may in fact begin to use proof of security measures as a differentiator in the market. Do not be surprised to see some form of seal or certifications emerge to visibly demonstrate to consumers the security awareness of the product.

The tipping point may have just arrived. In March 2017, Consumer Reports, a nonprofit organisation that informs consumers about products, services, and safety, announced that they are “launching the first phase of a collaborative effort to create a new standard that safeguards consumers’ security and privacy”. The organisation hopes to push a new open-source standard that addresses privacy and security concerns for connected consumer devices.

Many parents, manufacturers of IoT goods and security professionals will be watching with baited breath. At the rate that these breaches are surfacing, many in the industry may feel they have an improved chance of being early. But this time it is doubtful whether they’ll feel satisfied about being right.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week