Carnegie Mellon Researchers Design 'Nutrition Label' For The Internet Of Broken Things

(Mis)Uses of Technology

from the watching-you-watching-me dept

Thanks to a laundry list of lazy companies, everything from your Barbie doll to your tea kettle are now hackable. Worse, these devices are now being quickly incorporated into some of the largest botnets ever built, resulting in devastating and historic DDoS attacks. In short: thanks to “internet of things” companies that prioritized profits over consumer privacy and the safety of the internet, we’re now facing a security and privacy dumpster fire that many experts believe will, sooner or later, result in even bigger security and privacy headaches than we’re seeing today.

One problem is that consumers often don’t know what they’re buying, which is why groups like Consumer Reports have been working on an open source standard to include security and privacy issues in product reviews. Another big problem is that these devices are rarely designed with GUIs that provide transparent insight into what these devices are doing online. And unless users have a semi-sophisticated familiarity with monitoring their internet traffic via a router, they likely have no idea that their shiny new internet-connected doo-dad is putting themselves, and others, at risk.

This lack of transparent data for the end user also extends to company privacy policies and company privacy practices, which are often muddy and buried beneath layers of fine print, assuming they’re even truthful in the first place.

Enter the CyLab Security and Privacy Institute at Carnegie Mellon, where researchers say they’re hoping to create a standardized “nutrition label” of sorts for IOT devices. Researchers say the labels will provide 47 different pieces of information about a device?s security and privacy practices, including the type of user and activity data the device collects, with whom the data is shared, how long the device retains data, and how frequently this data is shared. The goal is to take something incredibly confusing to the average user and simplify it in a way that’s more easily understandable.

To do so, the researchers say they consulted with 22 security and privacy experts across industry, government, and academia to design the easy to understand labels:

They’ve also built a label generator for those interested. Ideally, by including more accurate labels and privacy and security issues in reviews, you could ideally shame at least some companies into trying a little harder, and help consumers and businesses alike avoid platforms and companies that pretty clearly couldn’t care less about end user privacy and security. A more detailed breakdown of a device’s habits would be available for experts or researchers looking to know more about a particular device or its habits:

“We have designed a that includes a simple, understandable primary layer for consumers and a more detailed secondary layer that includes information important to experts. The primary layer is designed to be affixed to device packaging or shown on an online shopping website, while the secondary layer can be accessed online via a URL or QR code.”

One interesting finding from the researchers: consumers polled were interested in paying more to have this kind of insight into what a product actually does. Granted such labels are only useful if they’re actually used, and there’s a long list of overseas Chinese companies that will see no penalty for not including them (though the lack of such a label could be a deterrent from buying such products). To be truly effective, you’d likely need to incorporate such requirements as part of the United States’ first actual privacy law for the internet era, should such legislation ever actually get crafted.

Filed Under: cybersecurity, internet of things, iot, nutrition label