A great improvement resulted from the choice among themes, as I had hoped.

It doesn't seem likely that legislation will prohibit the making of particular devices, nor that a cluster of net-connected sensors called a "baby monitor" will in the end be separable from all the other forms of sensor that the Internet of Shit/Things will contain. Does one prohibit refrigerators as spy devices? Or try to prevent Internet-connected refrigerators? (In this and other categories of home appliances, it is getting much more difficult to acquire non-Internet versions.

So perhaps it would be possible to strengthen the next draft by proposing measures, collective or individual, that are possible.

Mother is Always Watching: Psychological, Sociological, and Privacy Concerns of Surveillance Helicoptering

SURVEILLANCE AND HELICOPTERING

HARM ON THE FAMILY

PRIVACY CONCERNS

LAW

Beyond banning spy devices for personal use, probably little can be done through law for the interpersonal, psychological, and sociological issues of spying within a family. Children are entitled to a certain level of privacy under the United Nations Convention on the Rights of the Child, but the U.S. hasn’t ratified it. Even if they had it grants only a small amount of privacy that doesn’t cover parent snooping. It is hard to imagine the passage of a law abridging the parent’s “right” to invade their children’s privacy.

In terms of peeping Toms or peeping companies/governments, the law can punish peeping on baby monitors and the like as well as further outlawing the use of children’s data from phone tracking, baby monitors, etc. For some spy devices, regulation of IoT devices would help. The ability to sue companies for leaking might help as well.

I think this draft is uncertain of its subject: is it baby monitors or the security of the Internet of Things, known among security professionals as the Internet of Shit? Most of your paragraphs are about the social context of child surveillance technology, but in the final paragraphs you say that only security (or rather, the insecurity of product design deliberately intended to compromise security for ease-of-setup in order to save manufacturers the cost of real after-sale support) is your subject. As to that, baby monitors are not much different from all the other IoS? gear; a discussion of the political economy of insecurity would better address the problem than a focus on a particular product category. The technology of child- and home-surveillance, on the other hand, raises questions about the intra- and interpersonal-psychology, sociology, economics etc. of family life in the "developed" world that far exceed issues of device and network security in their breadth and potential importance. The next draft should choose. I can see good reasons to pursue either path, and good results that can follow from it; my own bias in favor of the latter topic should not be relevant to your choice.

If you are, in the end, writing about the issue of Io[ST] security, you should read Bruce Schnier's Click Here to Kill Everybody (2018), the essential study, which Columbia University appears not to possess in its decaying libraries.

Baby Monitors: Sacrificing Security for "Safety"

-- By AyeletBentley - 08 Oct 2019

Even before I walk into the apartment where I am babysitting the family is watching me. They’re not home but they see me on the “Ring” and text, “I see the nanny let you in.” Suddenly they appear on their video Alexa without warning and without me answering to explain the bedtime procedures for their 3-year-old. At bedtime she wants to listen to “Uncle Moishe.” Almost immediately her parents have turned it on from their phones. While sitting at a concert 60 blocks south they ignore Billy Joel, instead watching and listening to their daughter and me.

Constant parent surveillance started in my generation. Friends got busted for lying about their whereabouts when their parents tracked their phones. Sneak in after curfew? Good luck. Your phone, the “Ring,” the cameras inside are the nosiest neighbors. For concerned parents the gadgets of the internet age allow for a type of helicoptering like never before.

What if we told these concerned parents that with a few lines of python anyone can watch? Or that there are websites listing webcams that are set to the default passwords (or without passwords) that anyone on the internet can access?

Hacking is Easy

There have been accounts of mothers catching hackers hijacking the cameras. One mother noticed her baby monitor moving without anyone controlling it. She realized it was scanning the room and landing on her bed. Everyone who was supposed to have control was in the same room not moving the device. Others reported their baby monitors talking. One particularly disturbing case involves a hacker yelling at babies on baby cams.

If peeping Toms on the internet are watching through baby monitors, what comes next? Surely those who lived in Stalin’s Soviet Union would find bringing a device into your home that anyone can access foolish. Even if you aren’t worried about your own government, there is nothing stopping other countries from peeping too. This can allow for more targeted advertising, election campaigning, perfect price discrimination. Even if governments or companies aren’t themselves watching, the dangers of commodification of personal information are real.

The dangers of these insecure devices goes beyond concerns of creeps or the hypothetical 1984 sounding concerns of the government or companies watching, they can bring down the internet. In 2016 DNS provider Dyn was attacked by Mirai botnets which took down sites including Netflix, Twitter, and Spotify largely using IoT? devices (such as baby monitors) infected with malware. Hackers took complete control of the monitor. Further, baby monitors can grant a hacker access to the home network to get information from computers.

The Law

Security experts have called on the government to get involved by regulating IoT? devices. Mikko Hypponen, chief research officer for F-Secure, for example, compared leaking WiFi? passwords to devices catching on fire: it shouldn’t happen and the government should make sure it doesn’t. Experts have proposed civil and criminal penalties for creating unsecure devices and laws requiring buyers to change the default password before the device can be used. Others, however, believe regulation would be useless because U.S. regulations won’t affect other countries.

Some have proposed allowing victims of baby monitor hacks to sue manufacturers or sellers of the monitors. The Mirai attack shows the widespread hacking of these devices and suggests the possibility of a class action suit. If companies are hit with hefty fines they would be incentivized to send shoddy security for IoT? devices the way of lead paint.

Still others have proposed a more radical solution: hacking back. Rob Graham, security researcher and hacker, suggested the NSA launch a proactive strike to knock compromised IoT? devices offline. Graham sees this as a solution to U.S. legislation being useless overseas. While that may be true, there are likely other Constitutional concerns with the NSA hacking into people’s devices to knock them offline.

Conclusion

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, AyeletBentley
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.