Back in an era that this author fondly remembers, Barbie was a simple doll with moveable parts and long blonde hair ripe for plaiting (and chopping, in more mischievous moments). Today, she is much more sophisticated. Hello Barbie, the world’s first Wi-Fi-enabled Barbie doll, for example, uses voice recognition software and artificial intelligence to bring her to life.
Just as we are connecting everyday objects, such as cameras, heating systems and fridge freezers to the internet, we are also connecting dolls, toys and other items that are accessed by children. While this has many benefits for imagination, creativity and play, they also bring a number of risks – not least those associated with children’s privacy.
Indeed, there have been multiple reports of baby monitors being hacked and of cyber attacks on toy software that has led to sensitive data – including photos of children – being stolen. Hong Kong toymaker, VTech is one recent example of this, while Hello Barbie herself has been at the centre of controversy over whether or not she can also be hacked (ToyTalk and Mattel say not).
So when it comes to the Internet of Things (IoT), what are the potential risks for child protection, and what needs to be put in place to mitigate against these?
According to the Federal Trade Commission (FTC) in America, the IoT presents a variety of potential security risks that could be exploited to harm consumers, including children. These include enabling unauthorised access and misuse of personal information (such as photos of children or recordings of conversations); facilitating attacks on other systems (by being able to access banking details, passwords etc.); and creating risks to personal safety (in extreme cases, grooming). In a more general sense, research (pdf) by the UK Council for Child Internet Safety has found that 12% of children have experienced data misuse such as identity theft or somebody using their personal information in a way they didn’t like.
It all sounds pretty scary – so does that mean legislation is the answer?
Currently there is no specific legislation in place for the Internet of Things. The concept is so new and the technology changes so rapidly that the law has thus far found it impossible to keep up. That situation is unlikely to change any time soon.
There is only one example of case law and that relates to an American case involving TRENDnet, which provides internet-connected cameras for purposes ranging from home security to baby monitoring. Despite claiming its products were secure, the FTC found that hackers were able to access live feeds from consumers’ security cameras and conduct “unauthorised surveillance of infants sleeping in their cribs, young children playing and adults engaging in typical daily activities.” Under the terms of the settlement agreed with the FTC, TrendNet cannot misrepresent its software as “secure” and must get an independent assessment of its security programs once a year for 20 years.
Elsewhere, rules regarding IoT are established within the context of current laws, such as the Children’s Online Privacy Protection Act in the US. Meanwhile, in the UK, the Office of the Information Commissioner recently provided guidance on wearable devices and stipulated there should be no data collected that breaches the Data Protection Act, but so far no specific recommendations or rules have been made that relate to child protection and the IoT.
While we wait for government to decide what is the most appropriate way forward with regards to IoT and child protection, there are ways in which product designers and companies can work more effectively to minimise risks.
One such area is “security by design” whereby companies build security into their devices from the outset, says Tony Neate, chief executive of Get Safe Online. “They have to look at passwords, or even better – biometrics – building it in from the beginning rather than adding it on at the end”, he says.
Tony Anscombe, senior security evangelist at AVG, agrees: “We’re in a transitioning phase here. Some people may have fitness trackers, but if in five years’ time we are all suddenly going to be carrying three or four of these devices, the industry needs to come together to develop clear defined standards as to how they inter-operate and how to provide security for end users,” he says, adding how this is particularly important for those devices accessed by children.
Data minimisation is another area for developers to consider. This refers to the concept that companies should limit the amount and type of data they collect and retain, and should dispose of it once they no longer need it. In the case of children, this data could involve recordings of conversations between friends, photos and personal information about likes and dislikes.
“[Companies] can decide not to collect data at all; collect only the fields of data necessary to the product or service being offered; collect data that is less sensitive; or de-identify the data they collect,” advises the FTC (pdf). “If a company determines that none of these options will fulfill its business goals, it can seek consumers’ consent for collecting additional, unexpected categories of data.”
Communications with consumers, be it security instructions, privacy agreements or consents around data use, should all be in “simple language and understandable by everyone – ideally on one side of A4 paper”, says Anscombe.
The government also has a responsibility to ensure the public understands the risks, particularly as the IoT and connected devices become more prevalent. In many of the security breaches reported thus far, the situation has involved a degree of ignorance as to what constitutes online safety. For instance, one of the families whose baby monitor was hacked only had a password on the monitor itself and not one on the Wi-Fi.
“When I talk to parents about online safety, they often say to me that their son or daughter knows much more about computers than they do. But do the children know more about life than the parent? A boy or girl may appear to be located safe upstairs in their bedroom, but for all the parent knows they could be accessing the darker side of the web in its various forms”, says Neate. It is very important that parents are provided with clear guidelines as to what data is collected and/or stored, and how to remain secure right from the outset. This could include instructions on packaging, video tutorials orQR codes on devices that take consumers through to more information.
For now, governments around the world appear to prefer a broad-based approach to privacy legislation, rather than IoT specific rules. However, this is a brave new world we are entering, and as the number of connected devices increases so too will the number of children being exposed to risks.
Content on this page is paid for and produced to a brief agreed with UNICEF, sponsor of the child rights and business hub
