Peloton Outage Prevents Customers From Using $2,500 Exercise Bikes

from the dumb--tech-is-smart-tech dept

Peloton hasn't been having a great run lately. While business boomed during the pandemic, things have taken a sour turn of late on a bizarre host of fronts. In just the last month or two the company has seen an historic drop in company valuation, fired 20 percent of its workforce, shaken up its executive management team, been forced to pause treadmill and bike production due to plummeting demand, been the subject of several TV shows featuring people having heart attacks, and now has been caught up in a new scandal for trying to cover up a rust problem to avoid a recall.

Some of the issues have been self-inflicted, while others are just the ebb and flow of the pandemic. Most users still generally love the product, and a lot of these issues are likely to fade away over time. But adding insult to injury, connectivity issues this week prevented Peloton bike and treadmill owners from being able to use their $2000-$5000 luxury exercise equipment for several hours Tuesday morning. The official Peloton Twitter account tried to downplay the scope of the issues:

For much of Tuesday morning the pricey equipment simply wouldn't work. I have a Peloton Bike+, and while the pedals would physically spin, I couldn't change the resistance or load into my account; you just were stuck staring at a loading wheel in perpetuity. Some app users say they had better luck, but many Bike, Bike+, and Peloton Tread owners not only couldn't ride in live classes, they couldn't participate in recorded classes because there's no way to download a class to local storage (despite the devices being glorified Android tablets).

The outage (which occurred at the same time as a major Slack outage) was ultimately resolved after several hours, but not before owners got another notable reminder that dumb tech can often be the smarter option. Your kettlebells will never see a bungled firmware update or struggle to connect to the cloud.

Filed Under: connected bikes, iot
Companies: peloton

Google Will Cripple OnHub Routers Starting Next Year

from the you-don't-own-what-you-buy dept

We've long written about how you don't really own what you buy in the modern era. Books, games, and other entertainment can stop working on a dime due to crappy DRM. Game consoles you've purchased can find themselves suddenly with fewer features. Or worse, hardware you've bought thinking you'd own it for a decade can wind up being little more than a pricey paperweight.

But quite often, products that should work for years just slowly stop being supported, leaving you with hardware that gradually becomes less and less useful. We saw this recently when Sonos initially bricked still working (and expensive) speakers. The phenomenon popped up again this week when Google announced that its OnHub router, launched back in 2015, will no longer be supported starting next year. The products will still technically function as a basic router, but they'll no longer see security updates, and many of the cloud-based functionality and advanced features will be stripped from the devices.

To be clear this isn't an end of the world type of scandal. Google's providing 40% discounts to OnHub owners off of new Google routers (which will experience the same fate in a few years). The Hub also had some initial performance problems, and was quickly supplanted in Google's lineup by its Google WiFi (now Nest) products a year after they launched. But the downgrades are still part of an annoying shift in which companies hype all manner of cloud-based functionality at launch, then gradually strip functionality away once they no longer want to pay to support their own products:

"That Google can take an aging but perfectly functional router and switch off big parts of its functionality is one of the downsides of networking hardware that requires you to sign up for an account or use an app to administer it. While most advanced mesh routers are moving in this direction, offerings from Asus, Netgear, Linksys, and others at least retain some kind of web administration interface so you can continue to handle basic configuration tasks if those companies discontinue support or cease to exist."

It's not only annoying, but it's obviously not great for the environment to be routinely discarding fully functional kit. This may be less of an issue for more technologically sophisticated users who keep tabs on trends like this, but it's much more of a headache for Luddites who barely understood how their old router worked in the first place -- and now suddenly have to navigate the fact that perfectly good hardware has been crippled remotely.

Filed Under: end of life, iot, onhub, onhub router, ownership, smart devices
Companies: google

Hikvision's Director Of Cybersecurity And Privacy Says IoT Devices With Backdoors 'Can't Be Used To Spy On Companies, Individuals Or Nations'

from the O-RLY? dept

Hikvision describes itself as "an IoT solution provider with video as its core competency". It hasn't cropped up much here on Techdirt: it was mentioned earlier this year as one of two surveillance camera manufacturers that had been blacklisted by the US government because they were accused of being "implicated in human rights violations and abuses" in Xinjiang. Although little-known in the West, Hikvision is big: it has "more than 42,000 employees, over 20,000 of which are R&D engineers." Given the many engineers Hikvision employs, the following comment by Fred Streefland, Director of Cybersecurity and Privacy at Hikvision EMEA (Europe, the Middle East and Africa), reported by IPVM, is rather remarkable:

even devices with backdoors can't be used to spy on companies, individuals, or nations. The security features built into devices, networks, and data centres, combined with end-users data-protection responsibilities, make espionage and other misuses of backdoors impossible.

Streefland expanded on why data protection laws make espionage "impossible":

the end-users who buy these cameras are responsible for the data/video footage they generate. In other words, they're the data custodians who process the data and control the video footage, which is legally required to be kept private. Secret access to video footage on these devices is impossible without the consent of the end-user.

An interesting theory, but not one that security guru Bruce Schneier has much time for. IPVM asked him to comment on Streefland's statements:

I would say that only someone who doesn't understand cybersecurity at all would say something like that. But he's a CSO [Chief Security Officer], so he's probably deliberately saying something that stupid in order to sell you something.

That's a polite way to put it. As many stories on Techdirt attest, IoT products in general, and video cameras in particular, have huge security problems, often caused by backdoors, that have led to all kinds of spying at every level.

It seems that someone at Hikvision has realized just how ludicrous Streefland's comments were. The original source for the IPVM story is an interview with Streefland published by Benchmark Magazine. That interview is taken almost verbatim from a post on Hikvision's own blog, called "Debunking myths in the security industry." By an amazing coincidence, both the original interview and the blog post now lead to "404 not found" messages. Happily, the Internet Archive's indispensable Wayback Machine still has copies of both the interview and the blog post, where Streefland's words of wisdom quoted above can be found, along with some other choice thoughts on security.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: backdoors, cybersecurity, fred streefland, iot, privacy, surveillance
Companies: hikvision

Arlo Makes Live Customer Service A Luxury Option

from the basic-competency-is-extra dept

The never-ending quest for improved quarterly returns means that things that technically shouldn't be luxury options, inevitably wind up being precisely that. We've shown how a baseline expectation of privacy is increasingly treated as a luxury option by hardware makers and telecoms alike. The same thing also sometimes happens to customer service; at least when companies think they can get away with it.

"Smart home" and home security hardware vendor Arlo, for example, has announced a number of new, not particularly impressive subscription tiers for its internet-connected video cameras. The changes effectively involve forcing users to pay more money every month if they ever want to talk to a live customer service representative. From Stacey Higginbotham:

"This week, Arlo launched what I generously think of as its pay-for-customer-service enticement for its smart home camera products. As of Oct. 4, customers without a subscription who’ve had their devices for more than 90 days no longer get phone support. And after one year, they lose access to live chat support."

If you don't pay Arlo more money for actual customer service, you're relegated to cobbling together support solutions from the company's forums, an automated website chat bot, or elsewhere. Given the cost of Arlo products, the decision to make speaking to an actual human being a $3 to $15 monthly add on is fairly ludicrous:

"Arlo’s customer support framework now requires a $2.99 to $14.99 per month Arlo subscription, a free trial plan, or the device to be within 90 days of purchase for phone support. Then you’re downgraded to chat support for the remainder of the year.

After that, absent a plan, Arlo customers with problems will only have access to a virtual assistant or the public forums. That means no phone support and no chat. This feels pretty punitive for a product that can cost between $130 and $300 depending on the device."

Even U.S. telecom giants, the poster children for atrocious U.S. customer service, haven't meaningfully pursued making live customer support a premium option (though they have tinkered with innately providing worse support to folks with low credit scores). Arlo's choice comes amidst higher shipping costs and supply chain issues during COVID, but the decision to try and recover those higher costs by making basic competency a luxury tier will likely come back to bite it in an IOT space that's only getting more competitive.

Filed Under: customer support, home security, iot, subscription fees
Companies: arlo

Amazon's Idea For A Mesh Network Is Cool; Its Method Of Rolling It Out Is Not

from the c'mon-guys dept

Over the weekend there was a bit of a reasonable fuss raised after Ars Technica noted that all of the various Amazon connected devices (including Alexa, Echo, Ring, etc.) would become part of a mesh network called Amazon Sidewalk, in which the devices would be sharing a tiny tiny bit of bandwidth across the network of devices. The idea behind the mesh network is kind of cool, and there are some clear benefits to using it.

But, of course, this is Amazon we're talking about -- a giant company, and the method of rolling this out seems to have caught a ton of people by surprise: namely opting everyone into the program with a short timeline to opt-out. That seems less than ideal. Lots of privacy folks are concerned, in general, with two aspects of this: the fact that people may be suddenly sharing data with their neighbors without necessarily realizing it, and the tie-in to Amazon, which is (again) a large company that tends to collect quite a bit of data on people. To its credit, Amazon released a pretty comprehensive whitepaper exploring the privacy and security protections they've built in to Sidewalk, and my guess is that for many consumers the benefits of easier setup and better connectivity via Sidewalk will seem worth it to them.

The real issue, then, is forcing everyone into the network. Obviously, it's no surprise why this was done. A mesh network really only works if you have enough nodes on the network to make it useful. So it makes sense that Amazon would want as many of the devices to be on the network on day one as possible. However, given the company and the public scrutiny it has received of late, it seems like it should have anticipated these concerns a lot more, pushed for an opt-in setup (perhaps with incentives), rather than jumping to the "hey, we're adding this automatically" approach.

While it's possible that Amazon is betting that the concerns over this will blow over, and having so many nodes on the network will make it worthwhile to take the short-term heat, it still surprises me that the big internet companies don't take more steps to alleviate these kinds of concerns up front, including taking a more cautious approach. But, perhaps that's why I don't run a giant internet company.

Filed Under: alexa, amazon sidewalk, echo, iot, mesh network, opt-in, opt-out, privacy, ring, sharing
Companies: amazon

Cricut Hastily Walks Back Plan To Charge Cutting Machine Owners $10/Month To Fully Use Their Purchases

from the lol-check-out-these-Cricut-tools dept

Cricut -- the leading brand of home use CNC machines -- has decided to alienate the people you'd think it would most want to embrace: its paying customers. Cricut machines allow users to upload designs and put their machines to work cutting materials from paper to cloth to metal to whatever will fit into the machines, giving hobbyists and craftmakers control of a small-scale manufacturing operation. They're pretty amazing. And they're pretty expensive.

They're also subject to a whole lot of rules -- some written and some unwritten. Cricut has made efforts to lock competitors out of the market by limiting cutting tool compatibility and restricting sheet size to increase sales of its own line of Cricut raw materials. Most designer paper comes in a standard 8.5" x 11" size. Sheet size in Cricuts is limited to 6.75" x 9.25", meaning off-the-rack, non-Circut-branded papers are about 20% useless.

Things like this help Cricut make the most of its multiple revenue streams. Cricut has apparently decided it has at least one too few revenue streams. As Hackaday reports, the company is now asking customers who've purchased printers to start paying the company in exchange for the privilege of fully utilizing their purchases.

[Cricut] has dropped a bombshell in the form of an update to the web-based design software that leaves their now very annoyed users with a monthly upload limit of 20 new designs unless they sign up for a Cricut Access Plan that costs $9.99 on monthly payments. Worse still, a screenshot is circulating online purporting to be from a communication with a Cricut employee attempting to clarify matters, in which it is suggested that machines sold as second-hand will be bricked by the company.

Well, that's at least two levels of suck contained in a single announcement. First, the decision to hit people who've already shelled out hundreds or thousands to Cricut with perpetual fees is inexplicable. Cricut isn't the only cutter on the market and a move like this just talks loyal users out of their loyalty and encourages them to explore their options. In exchange for smaller fees, Cricut seems willing to watch thousands of dollars exit the market for their competitors.

Second, the bricking of secondhand devices is pure bullshit. A Cricut is a Cricut. Anyone who bought one should have the right to sell it. And anyone buying one from a former user should rightfully expect it will be fully functional, not bricked by a company willing to compound its errors.

Fortunately, the company has listened to its users. It has dropped the rent program and said that anyone who buys a cutter before the end of this year will be grandfathered into the existing unlimited free program. Buyers who purchase one after December 31, 2021 will apparently be expected to purchase a subscription, which means this mini-debacle will be revisited later this year if Cricut refuses to drop its subscription program completely.

Cricut has also clarified that it's not moving forward with a plan to brick secondhand machines. New users will need to set up their own accounts, but the machines will function as normal.

All's well that ends well, I guess. But anyone outside of Cricut could have informed Cricut how this was going to play out. Chances are, some people inside Cricut realized that as well, but were overridden by those willing to ask what the market was willing to absorb, even if it meant shedding a few more reputation points.

Filed Under: business model, cnc, connected devices, drm, iot, subscription plan
Companies: cricut

Thousands Of Security Cameras, Archived Footage Exposed After Surveillance Company Verkada Is Hacked

from the unsecured-security-cameras-are-the-best-security-theater dept

Put enough cameras up and pretty soon they become tasty targets for malicious hackers.

A group of hackers say they breached a massive trove of security-camera data collected by Silicon Valley startup Verkada Inc., gaining access to live feeds of 150,000 surveillance cameras inside hospitals, companies, police departments, prisons and schools.

Some of the more notable targets include Tesla factory cameras and security cameras deployed by Cloudflare. The hackers also apparently have access to archived video from these sources. Verkada has responded by disabling all internal administrator accounts -- something it probably should have done back when it was making news for doing the same thing, only without the participation of outside hackers.

Last year, a sales director on the company's sales team abused their access to these cameras to take and post photos of colleagues in a Slack channel called #RawVerkadawgz where they made sexually explicit jokes about women who worked at the company, according to a report in IPVM, which Motherboard independently verified and obtained more information about.

"Face match… find me a squirt," the sales director wrote in the company Slack channel in August 2019, according to one screenshot obtained by Motherboard.

Now, the same sort of thing can be done by anyone with access to the compromised system. The hackers involved here claim to be operating somewhat altruistically.

The data breach was carried out by an international hacker collective and intended to show the pervasiveness of video surveillance and the ease with which systems could be broken into, said Tillie Kottmann, one of the hackers who claimed credit for breaching San Mateo, California-based Verkada. Kottmann, who uses they/them pronouns, previously claimed credit for hacking chipmaker Intel Corp. and carmaker Nissan Motor Co. Kottmann said their reasons for hacking are “lots of curiosity, fighting for freedom of information and against intellectual property, a huge dose of anti-capitalism, a hint of anarchism -- and it’s also just too much fun not to do it.”

Add to that list "too easy." According to Kottmann, the hackers gained access to a "Super Admin" account after finding a username and password publicly exposed. That access has since been revoked (along with all other internal admin accounts), but the footage served up to reporters showed everything from eight hospital staffers restraining a patient to police officers grilling suspects.

Then there's the facial recognition tech grafted onto Verkada's cameras.

Verkada's website advertises that "all" of its cameras include "Smart Edge-Based Analytics," referring to the cameras' facial recognition, person identification, and vehicle analysis tools.

It's not clear which of Verkada's 24,000 customers were using these functions but they appear to be built-in. And its list of customers -- also exposed in the breach -- includes schools, banks, bars, breweries, churches, condo complexes, museums, airports, a Salvation Army Center, as well as the previously mentioned companies, hospitals, and prisons.

And, as was briefly noted earlier, Verkada's system allows customers to search recorded video by face, allowing users to compile screenshots of every instance in which the searched face was captured by the cameras.

Surveillance is a growth market. Amass enough market share and someone's going to want to see what you've collected. Verkada's use of admin accounts was already problematic given what we know about the mindset of some of its administrators. Giving admins access to all customer cameras and recordings may make it easier to address user problems, but without better security, it's also irresponsible.

Filed Under: cybersecurity, hackers, iot, privacy, security, security cameras
Companies: verkada

LAPD Asked Ring Users To Turn Over Footage Of Anti-Police Brutality Protests

from the I'm-pretty-sure-we-can-said-people-who-never-wondered-if-they-SHOULD dept

It's not just a home surveillance system. It's a surveillance system.

Documents obtained by the EFF and shared with The Intercept show law enforcement used footage from Ring doorbell cameras -- cameras some people have obtained for free from Ring's thousands of law enforcement "partners" -- to hunt down people protesting police violence.

The documents show the Los Angeles Police Department sent requests to Los Angeles residents asking them for footage recorded by their cameras. But the LAPD did not specify what sort of footage it was looking for. The task force making the request was charged with investigating crimes committed "during protests and demonstrations."

This information was vaguely conveyed to Ring owners in the area. The requests didn't even bother to specify whether the "incident" the LAPD was investigating could even have been captured by the doorbell cameras targeted by this request.

"The LAPD ‘Safe L.A. Task Force’ is asking for your help,” reads the message, from detective Gerry Chamberlain. “During recent protests, individuals were injured & property was looted, damaged, and destroyed. In an effort to identify those responsible, we are asking you to submit copies of any video(s) you may have for [redacted].” The request appears to have made no mention of what exactly the LAPD was pursuing; no crime, proven or alleged, is described in the unredacted portion of the request, only that the police wanted footage of an unspecified “incident” related to a protest. The redacted portion of the request does not appear to contain any substantive further description.

This was not the only message sent. The documents show the LAPD made additional requests following other demonstrations, in essence asking Los Angeles residents to rat out people engaged (for the most part) in peaceful protests. The task force wasn't asking for any info about specific crimes, but rather anything that showed people doing stuff that (again, for the most part) was protected by the First Amendment.

And there wasn't a lot of criminal activity. At least, not so much the LAPD should have felt comfortable sending out blanket requests for footage from cameras owned by private citizens.

In October, the Los Angeles Times cited LAPD data showing that the “vast majority” of the city’s Black Lives Matter rallies, part of a national wave of outraged mobilization following the police killing of Floyd, were peaceful, with only “between 6% and 7%” of protests resulting in any violence, including violence perpetrated by the LAPD itself.

But Ring has made aggressive inroads with thousands of law enforcement "partners." And it has provided them with instructions for requests like these -- ones that evade warrant or subpoena requirements.

On the plus side, the requests make any handover of footage completely voluntary. Bear in mind that law enforcement "requests" for footage are perceived by citizens as being far less voluntary than law enforcement perceives them to be. But the bottom line is these are requests, not demands. Even so, the LAPD would rather not answer questions about its mass emails or their efficiency rate.

And that's a problem Ring doesn't have an answer for. Indeed, it's an answer Ring doesn't even appear to care about. Ring likes cops. The people actually buying and/or deploying its cameras appear to be far down the list of things Ring cares about. As far as Ring is concerned, the market it has cornered is little more than an extension of existing government surveillance networks. If it did care about its users, it would have done more to protect them from malicious hackers and law enforcement officers who can't be bothered to boilerplate up a warrant affidavit.

Even if you decide the First Amendment question isn't settled enough to give Los Angeles residents pause when handing over footage to cops, the mutual appreciation society formed by Ring and law enforcement cuts private citizens out of the equation. It turns their cameras into cop cameras.

Sure, people may retain control of the devices and ignore emailed requests for footage, but Ring is doing all it can to erase the line between public and private. It allows law enforcement agencies to give cameras to citizens, increasing the chance the recipients of these freebies will be receptive law enforcement requests. It gives cops a portal that shows them where cameras are located, giving the government information it wouldn't have under other circumstances. Finally, Ring inserts itself into the PR process, giving itself final approval on press statements from law enforcement that involve its products, allowing it to craft a more self-serving narrative.

There's no indication this effort was limited to areas where criminal activity during protests was suspected. Instead, the portal provided by Ring made it possible for the LAPD to ask for private citizens' inadvertent recordings of protected speech. This is secondhand surveillance. And its encroachment into our everyday lives should be greeted with suspicion. This is an opportunistic approach to law enforcement, one that embraces mission creep.

Filed Under: black lives matter, iot, lapd, protests, ring, surveillance

Chastity Penis Lock Company That Was Hacked Says It's Now Totally Safe To Put Your Penis Back In That Chastity Lock

from the fool-me-once dept

While we've covered the Internet of Broken Things for some time, where companies fail to secure the devices they sell which connect to the internet, the entire genre sort of jumped the shark in October of last year. That's when Qiui, a Chinese company, was found to have sold a penis chastity lock that communicates with an API that was wide open and sans any password protection. The end result is that users of a device that locks up their private parts could enjoy those private parts entirely at the pleasure of nefarious third parties. Qiui pushed out a fix to the API... but didn't do so for existing users, only new devices. Why? Well, the company stated that pushing it out to existing devices would again cause them to all lock up, with no override available. Understandably, there wasn't a whole lot of interest in the company's devices at that point.

But fear not, target market for penis chastity locks! Qiui says it's now totally safe to use the product again!

Now, the European distributor of the chastity cage, which is called CELLMATE, wants everyone to know that it's safe to use the device after the release of a new app, which it says fixed the vulnerabilities in the API used to control it.

"Our product and brand (CELLMATE) has received quite a bit of negative attention because of this publication. Now, you can think 'negative publicity is also publicity,' but unfortunately it turned out completely different for the CELLMATE," Dennis Jansen, who works for Desudo, a distributor of the CELLMATE device, told Motherboard in an email, referring to our first story on the hack. "This wrongly created the image that our product could be hacked, after which the genitals of the wearer would be permanently locked up. Although such a situation was not even realistic at the time of publication (as you can read and see here), this story has made current and potential users unfairly frightened of our product. You will understand that this has had absolutely no positive effect on the attention and interest in using the CELLMATE."

A couple of things to note here. First, this whining about press coverage is roughly as tone deaf as it could possibly be. Second, while an emergency release accessible with a screwdriver may indeed by a thing, it seems not every user of the device is aware of that, given that at least one victim claims he had to use bolt cutters which left him bleeding. "It fucking hurt," he told Motherboard. Which, yeah.

But perhaps most important to this story is that anyone that actually wants to see the third party pen test for the API can go pound sand. Pen Test Partners, who originally discovered and reported the flaw, was reportedly brought in to assess the third party pen test as well. Asked if they would sign off that the device was now safe to use, reps from the company basically shrugged.

The founder of Pen Test Partners, Ken Munro, and the researcher who audited the CELLMATE, Alex Lomas, both confirmed to Motherboard that they did receive the third-party assessment and that the document says the issues are now resolved. But they also said they can't confirm the results, as they have not audited the device and its app and API since last year.

"I don't think I can comment more about the safety or otherwise of the product at this stage, I think people hopefully have enough information to make their own judgements," Lomas told Motherboard in an online chat.

Not exactly a ringing endorsement, obviously. The point is that the reputation cost for any company that allows this kind of vulnerability doesn't normally put a company in the position of trust for these kinds of fixes. That lack of trust likely becomes supercharged when people's naughty bits are involved. What's really needed here, should the companies and their distributors want to restore trust with the public, is transparency. Sadly, that doesn't seem to be in the offering.

Filed Under: chastity lock, iot, security
Companies: qiui

Amazon Transparency Report Indicates Its Multiple IoT Devices Are Juicy Targets For Law Enforcement

from the ALEXA-CONSENTS-TO-A-SEARCH-ON-YOUR-BEHALF dept

Never forget the IoT device you invite into your home may become the state's witness. That's one of the unfortunate conclusions that can be drawn from Amazon's latest transparency report.

Amazon has its own digital assistant, Alexa. On top of that, it has its acquisitions. One of its more notable gets is Ring. Ring is most famous for its doorbells -- something that seems innocuous until you examine the attached camera and the company's 2,000 partnerships with law enforcement agencies.

Ring is in the business of selling cameras. That the doorbell may alert you to people on your doorstep is incidental. Cameras on the inside. Cameras on the outside. All in the name of "security." And it's only as secure as the people pitching them to consumers. Ring's lax security efforts have led to harassment and swatting, the latter of which tends to end up with people dead.

Malicious dipshits have been using credentials harvested from multitudinous breaches to harass people with Ring cameras. The worst of these involve false reports to law enforcement about activity requiring armed response. That no one has ended up dead is a miracle, rather than an indicator of law enforcement restraint.

Ring wants you to hand over footage to law enforcement agencies. That's why it partners with agencies to hand out cameras for free and instructs officers how to obtain footage without a warrant. That's also why it stays ahead in the PR game, handling press releases and public statements it feels law enforcement officials are too clumsy to handle on their own.

And gather footage law enforcement does, as Zack Whittaker reports for TechCrunch. Omnipresent IoT devices give law enforcement plenty of recordings and other information -- with or without the consent of device owners and with or without the warrants they would normally need.

Amazon said it processed 27,664 government demands for user data in the last six months of 2020, up from 3,222 data demands in the first six months of the year, an increase of close to 800%. That user data includes shopping searches and data from its Echo, Fire and Ring devices.

While it's good to see warrants were involved in a majority of these cases, the unfortunate fact is a lot of this isn't considered protected under the Fourth Amendment and can be obtained with nothing more than a subpoena. Third party data isn't -- for the most part -- shielded by the Constitution.

The silver lining is that someone is likely to challenge warrantless acquisition of footage or data. The third party doctrine isn't as immutable as it used to be and federal courts have been interpreting the Supreme Court's Carpenter decision (which dealt with long-term tracking via cell site location info) to cover more than the justices originally envisioned when they handed down their ruling.

Even so, consumers should be aware that their internet-connected devices are generating a wealth of information about their habits, movements, and the people they associate with. And a lot of it can be had without judicial oversight. These devices are useful but they're also low-level informants. And anyone who invites Ring or Alexa into their home needs to be aware of their downsides and weigh that against the security or convenience they gain from having an always-on, internet-connected snitch. Those who feel they have nothing to hide may be unpleasantly surprised in the future.

Filed Under: alexa, government demands, iot, law enforcement, ring, surveillance
Companies: amazon