German Consumers Face $26,500 Fine If They Don't Destroy Poorly-Secured 'Smart' Doll

(Mis)Uses of Technology

from the internet-of-broken-things dept

We’ve noted repeatedly how modern toys aren’t immune to the security and privacy dysfunction the internet-of-broken-things has become famous for. A new WiFi-enabled Barbie, for example, has come under fire for trivial security that lets the toy be modified for use as a surveillance tool. We’ve also increasingly noted how the data these toys collect isn’t secured particularly well either, as made evident by the Vtech incident, where hackers obtained the names, email addresses, passwords, and home addresses of 4,833,678 parents, and the first names, genders and birthdays of more than 200,000 kids.

Last fall a lawsuit was filed against Genesis Toys, maker of the My Friend Cayla doll and the i-Que Intelligent Robot. The lawsuit accuses the company of violating COPPA (the Childrens’ Online Privacy Protection Act of 1998) by failing to adequately inform parents that their kids’ conversations and personal data collected by the toys are being shipped off to servers and third-party companies for analysis. A report by the Norwegian Consumer Council (pdf) also found that a lot of the data being transmitted by these toys is done so via vanilla, unencrypted HTTP connections that could be subject to man-in-the-middle attacks.

In Germany, where surveillance fears run a little deeper for obvious reasons, regulators last February went so far as to urge German parents to destroy the My Friend Cayla doll, highlighting that hackers can use an unsecure bluetooth device embedded in the toy to listen to and to talk to the child playing with it. Since then, Germany’s Federal Network Agency has clarified its position further. It’s not only banning the sale, purchase, and ownership of the toy, but it’s warning families that they face fines up to $26,500 if they don’t comply with demands that the toy be destroyed:

“The agency has now laid out just how parents are to destroy the doll. Parents are asked to fill out a destruction certificate that must be signed by a waste-management company and sent back to the agency for proof. While the agency says it has no plans to take action against those who don?t destroy the doll, it certainly could. Under German telecommunication laws, those who don?t comply with Federal Network Agency directives could face a fine up to $26,500 and two years in prison.

How very…thorough. One mother, amusingly, felt bad destroying the doll — so she came up with a novel solution:

“One mother tells the WSJ that she was surprised to have had the doll sitting in her daughter?s room for two years. She says she was hesitant to actually destroy the doll, so instead she donated it to the German Spy Museum Berlin.”

Germany’s decision is certainly unnecessarily excessive, but it’s a step up from the outright apathy on many fronts to the problems raised by connecting everything to the internet without prioritizing security and privacy. Researchers continue to argue that the IOT is creating thousands of new attack vectors into every home and business on the planet every day. Given the rise in the use of IOT devices in record-setting DDoS attacks, it’s only a matter of time before these devices contribute to an attack on essential infrastructure, potentially at the cost of human lives.

It’s obviously not their intent, but these devices continue to function as advertisements for the “dumb” technologies of yesterday. At least until parents collectively realize that Barbie and Ken need a better firewall.

Filed Under: fines, germany, iot, my friend cayla, privacy, security, smart doll