IEEE Technology and Society Magazine - June 2018 - 72

and privacy implications for consumers [3], however;
many Internet-connected devices have poor in-built
security measures [4] and can reveal private data and
information that may harm or embarrass consumers [5].
A 2015 inquiry into data retention by the Parliamentary
Joint Committee on Intelligence and Security (PJCIS) [6]
mentioned "privacy" nearly 400 times. It said that privacy and security concerns "are closely related, as the
potential for security breaches has significant ramifications for the proportionality and privacy risks associated
with the proposed scheme."

IoT Consumer Research: Scenario,
Test, Evaluate, Propose
In this article, we examine the security and privacy implications of selected IoT devices, building on previous
work [7] in this area. Our specific contributions are as
follows: First, we developed hypothetical scenarios of
household IoT usage. We then tested the security and
privacy vulnerabilities of several of these devices, subjecting them to hostile targeting under laboratory conditions. Next, we invited IoT suppliers, consumers,
insurers, and regulators to evaluate our results at a
workshop. Finally, after examining their reactions and
discussing their expectations, we proposed possible
approaches to help mitigate the identified risks. We also
identified a research trajectory that would begin a new
four-step cycle of Scenario-Test-Evaluate-Propose. We
wish to emphasize that the workshop phase of our
research cycle is as critical as the other phases, and not
merely an afterthought. It is this phase that enables us
to engage with consumers and understand the contexts
in which they use their devices. In doing so, we are in a
better position to construct realistic scenarios to guide
our laboratory testing.

Scenarios
We created four scenarios in which people are likely to
use IoT devices. Our aim was to identify products they
would purchase so that we could evaluate their vulnerability under laboratory conditions. All the characters and
locations are fictitious, but the scenarios are extremely
realistic, and constructed on the basis of direct engagement with consumer advocates.
In the first scenario, the consumer is Tuan, a midcareer private investigator who lives by herself in a
regional town in Australia, regularly drives to Melbourne
and flies to Sydney to meet with clients. Most of her
work involves insurance fraud although she is often
asked to track cheating spouses. Because she travels
quite a bit, and meets a lot of unusual people in her line
of work, Tuan is worried about leaving her home unattended. Knowing the benefits of surveillance tools, she
believes that installing IoT devices would offer some

peace of mind. As a sole occupier who desires home
security, Tuan buys three IoT devices:
1) a Belkin motion sensor to detect movements inside
her house;
2) TP-Link indoor and outdoor motion sensor cameras; and
3) A Nest smoke alarm to send alerts to her smartphone
in case of fire.
In the second scenario, the IoT device users are Joe
and Lorna Jones, an elderly couple who live in the inner
city. Lorna is a bit hard of hearing, wears a pacemaker,
and has respiratory difficulties. She is not a regular user
of the Internet. Joe has some mobility problems and
relies on his medical-alert device when he's away from
home. Lorna was playing bowls (lawn bowling) the last
time he had a fall, and it took hours before he could get
help. Their son, Geoffrey, who lives with his family on
the Gold Coast 100-km away, wants a way to monitor
his parents' welfare more thoroughly than checking in
on Skype every couple of days. He has installed a number of IoT devices in their home to allow him to keep a
virtual eye on Joe and Lorna's health and wellbeing.
These devices are:
1) Blipcare blood pressure monitor, which sends readings to the web for Geoffrey to check;
2) Withings weighing scale;
3) Withings sleep monitor;
4) Awair air quality monitor; and
5) Netatmo weather station.
In the third scenario, Suresh and Veda Singh live in
Sydney's suburbs. They know they have to cool their
west-facing house in summer. Although they've trained
their three growing children to moderate their electricity
usage, it still feels like they're in a losing battle against
the large electricity bill that arrives every quarter. While
shopping for smart devices intended for use around the
home, they also bought an interactive doll for their
youngest child. The cute doll has a microphone that "listens" to the child, and replies in a manner similar to
Apple's Siri. Their purchases included:
1) a mix of LIFX and Phillips Hue light bulbs for
remote-control lighting;
2) a TP-Link power switch to control their appliances; and
3) A Hello Barbie talking doll.
In the fourth scenario, a trendy young city couple place
a high priority on their social life. Eddie and Jenny like
to listen to music in every room of their home, including on their rooftop terrace. They also spend a lot of time
on their mobile devices, and subscribe to the major movie-streaming services. Jenny likes watching the latest
movies while Eddie prefers playing computer games. Both
have busy professional lives and often work nights and on
weekends. They have bought the following devices:

IEEE Technology and Society Magazine

∕

JUNE 2018

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2018