Study explores tensions between IoT device owners and “incidental users”

In the Fall of 2019, a nanny in Boston wrote in the New York Times about the time she learned that audio and video of herself was being recorded while on the job without her knowledge or permission.

“I dealt with it by trying not to say much within earshot of the cameras,” she wrote. “I limited and censored my own speech and private conversations, wondering whether at any time something I said could put my job or my family in jeopardy.”

Experiences like the nanny’s are becoming more common as smart home devices like voice assistants or cameras on doorbells become more and more popular. People are increasingly often incidental users of these devices—not because they purchased or installed the devices, but because they find themselves in environments in which someone else has set up smart devices.

“These devices continue to pop up in our friends’ homes, our family’s homes, and outside our neighbors’ houses, making us incidental users of these devices whether we like it or not,” says Camille Cobb, a postdoctoral researcher in CyLab.

Cobb recently led a study exploring the tensions that may arise between device owners and incidental users, who may or may not be comfortable as incidental users. She presented the study at last week’s Privacy Enhancing Technologies Symposium.

The researchers deployed a survey to nearly 400 demographically representative adults in the United States, asking participants to answer questions about 20 different scenarios representing four different device types—e.g. smart cameras, voice assistants, etc.—and five different situations—e.g. at their own home, at a friend or family member’s home, etc.

“We asked people questions like, ‘Have you ever seen a camera outside your neighbor’s house?’ or ‘Have you ever seen a voice assistant at your friends’ house?’” Cobb says. “Overall, 91 percent of participants answered yes to one of those questions, so being an incidental user was clearly very common.”

... being an incidental user was clearly very common.

Camille Cobb, postdoctoral researcher, CyLab

People who owned devices themselves were more comfortable with devices being around in other situations as well, the results showed. Perhaps surprisingly, some people preferred having devices around them outside of the house versus not.

“If there’s a camera on me, and someone accuses me of stealing something, there’ll be proof that I didn’t do it,” Cobb says one participant said.

The researchers also tried to get a sense of whether device owners would be willing to make accommodations for incidental users, asking questions like, “If you found out that one of your devices was making your neighbor uncomfortable, would you be willing to relocate it or turn it off for them? How about a friend or family member?”

“I’d have to evaluate their objections,” one participant responded, and Cobb says many participants responded similarly. Many indicated that they would want incidental users to convey a really clear reason for why they’re uncomfortable.

“There’s this potential incompatibility between what it would take for a device owner to make these accommodations and what people are actually feeling,” Cobb says. A major and simple takeaway from the study is that there are a lot of incidental users out there, and a not-insignificant portion of them are uncomfortable with it.

“Even if most people most of the time are not concerned, a significant number of people are,” Cobb says. “We should do something about that. We should care.”

We should do something about that. We should care.

Camille Cobb, postdoctoral researcher, CyLab

To help address the issue, the researchers recommend the creation of more tools for conveying devices’ presence and functions. They say that even if incidental users can’t control the data being collected about them, they’d prefer to at least be aware. Cobb says solutions like the prototype privacy and security label could help inform not just device owners but also incidental users. It should also be easier for device owners to reduce the amount of data collected.

“If a device owner could easily use a camera to monitor their own property without also capturing the public sidewalk or their neighbors’ yards, this would potentially mitigate some privacy concerns,” the researchers say.

Paper reference

“I would have to evaluate their objections”: Privacy tensions between smart home device owners and incidental users

• Camille Cobb, Carnegie Mellon University (CMU)
• Sruti Bhagavatula, CMU
• Kalil Anderson Garrett, CMU
• Alison Hoffmann, CMU
• Varun Rao, CMU
• Lujo Bauer, CMU