Vacuum cleaners and toothbrushes

Image: allthegearnoskill

Just under two months ago I heard two news items on the same day, and both caught my attention. One was about a robot vacuum cleaner, the other about an electric toothbrush. Let’s look for the similarities.

A robot vacuum cleaner has eyes, because otherwise it would keep bumping its nose. Some models use cameras for this (others use, for example, a laser or ultrasound to detect obstacles and to build a picture of their surroundings). A family in Taiwan had one of those vacuum cleaners with optical cameras. When the husband, who was away, wanted to surprise his wife by chatting with her through the vacuum cleaner, he saw on the camera footage that his wife was naked and with another man. He filed a lawsuit for adultery and was awarded damages, but then had to go to prison himself. His (ex?) wife had filed a counterclaim for invasion of privacy. Taiwan takes illegal recordings very seriously.

Then that toothbrush. Dyson has brought a model with cameras to market. You wonder why? To analyse your teeth. The device can also fire a jet of liquid at the spaces between your teeth, and it finds those spaces by looking. That’s where – how could it be otherwise these days – AI comes in.

I then wonder what those cameras do the rest of the time. Look around your bathroom a bit? No, says the manufacturer: when you aren’t brushing, the camera is off. Moreover, the camera has a macro lens, designed to focus at very short distances. That’s quite obvious alright. However, there is also a second lens to widen the field of view. But that one won’t have much depth of field either (a measure of how ‘deep’ the area is that you see in focus), although it is greater with a wide-angle lens than with a macro lens. The resolution, by the way, is only 100,000 pixels – my average phone is fifty times better. And Dyson promises that the photos are not stored anywhere and not shared.

So much for the theory. Then I went looking for camera footage. And I found it: an Instagrammer called ‘allthegearnoskill’ took her toothbrush outside and shot pictures with it. They are heavily distorted photos, and the light and colours are odd too, but you can recognise a thing or two in them, such as buildings and landscapes. These are probably screenshots of footage streamed to the phone – after all, the toothbrush doesn’t store anything itself.

Two very different devices, and yet with something in common. The German word Zweckentfremdung comes to mind; you could translate it as ‘purpose alienation’ – the thing is used for something quite different from what it was intended for. A vacuum cleaner as a private detective, a toothbrush as a camera.

But there is more going on. These devices also have an app. And are therefore connected to the outside world. Remember what I wrote about that in the last blog? Those devices are vulnerable. If you can get at them with your app, then in theory someone else can too. Handy for burglars: a vacuum cleaner that maps the house for them and shows what is there to take. And that toothbrush is perhaps a fun toy for bathroom peeping toms.

It is somewhat reassuring that such devices at least have basic security: you need an account with a password. After that it all gets a bit vaguer. Multi-factor authentication would be desirable, but is by no means always documented. Access to the camera and any communication functions should be shielded separately. And as an aside: why would you ever want to make video calls via your vacuum cleaner? Speaking of Zweckentfremdung!

And in the big bad world…

• the AIVD (the Dutch intelligence and security service) reports an increase in insider risk. [DUTCH]
• the Belgian tax authority went dark after a cyberattack. [DUTCH]
• plenty more went dark last week, worldwide.
• the Dutch government advises, from a privacy point of view, using a browser other than Microsoft Edge. [DUTCH]
• many alarm buttons for the elderly will soon stop working. [DUTCH]
• you of course already realised that you’d better not share your bank account password with AI.
• ransomware calls for a quick response (although prevention is of course many times better).
• you need a backup strategy at home too (unfortunately the article contains an annoying amount of advertising).
• ransomware gangs are now also threatening the families of their victims’ employees. And they use the hacked company’s own AI.
• a Swiss bastion is starting to show cracks. (not fully readable without an account, but a large part is)
• the North Koreans (probably) robbed more than six billion dollars in cryptocurrency.
• residents of the EU and the UK can object to AI training by Meta using their data.