[projectvrm] Re: Listening wasn't bad enough? (Was: Listening TV's)

[John Havens < >]

Awesome post, T.Rob. I will also get a t-shirt.

Btw, a not hyperbolic extension of this idea is how augmented reality glasses/contact lenses or virtual reality display companies could emulate what Samsung has done. So ads could be inserted before your eyes in real time based on what you're seeing. Google has filed patents along these lines, where the pupil-facing portion of Glass can measure your emotions by using the responses of your pupil/eye to visual stimuli.

So the privacy concerns of your home will also extend to the lens through which you're seeing the world. Or more specifically, the manufacturer of that lens.

I hope you like Pepsi ads inserted in real time while you're drinking a Coke.

On Feb 24, 2015, at 10:53 PM, "=Drummond Reed" < "> > wrote:

T.Rob, I use Wordpress.com, so if you ran into any commenting problems, blame them (which is ironic 'cause they excel at commenting).

In any case, I just approved the reply, and I LOVE your closing. I think the final six lines should be immortalized in a T-Shirt and sold at IIW (I will personally order a half-dozen).

Let's get this bonfire going!

On Tue, Feb 24, 2015 at 6:23 PM, T.Rob < " target="_blank"> > wrote:

Thanks, Drummond!  I had a helluva time replying so you may find 10 or so comments awaiting moderation.  I closed the comment with the following:

 

But this is our in-home private networks to which they are laying claim.  Something over which we have sovereignty, and rightly so.  It should be easy to defend and disproportionately difficult to take from us.  Samsung can only win this fight if we sit back and let them.

 

Each of us must decide:

It's my network.

It's my content.

It's my device.

It's my decision.

Do I take a stand or do I take a knee?

 

-- T.Rob

 

From: =Drummond Reed [mailto: " target="_blank"> ]
Sent: Tuesday, February 24, 2015 19:43 PM
To: T.Rob
Cc: Adrian Gropper; Dan Miller; Guy Higgins; James Pasquale; ID Coach; John Havens; ProjectVRM list
Subject: Re: Listening wasn't bad enough? (Was: Listening TV's)

 

Here's my blog post: http://equalsdrummond.name/2015/02/24/t-rob-on-the-samsung-adhub-privacy-policy-have-we-reached-a-privacy-waterloo/

 

On Tue, Feb 24, 2015 at 4:29 PM, =Drummond Reed < " target="_blank"> > wrote:

T.Rob, you are SO right. This is a privacy Waterloo. We can't get enough eyes on your blog post.

 

I already tweeted it, but I'm going to write my own blog post pointing to it now.

 

On Tue, Feb 24, 2015 at 11:49 AM, T.Rob < " target="_blank"> > wrote:

Owners of Samsung's "smart" TVs are now reporting that apps on the TVs are inserting Pepsi ads into their own content stored locally on their PCs and NAS drives.  In nearly identical stories, GigaOm and Ars Technica report that this happens for Plex and Foxtel apps running on the TVs. 

 

http://iopt.us/1LAinAD

https://ioptconsulting.com/listening-wasnt-bad-enough/

 

Kind regards,

-- T.Rob

 

I have availability! For a good time (with IBM MQ) call:

T.Robert Wyatt, Managing partner

IoPT Consulting, LLC

+1 704-443-TROB (8762) Voice/Text

+44 (0) 8714 089 546  Voice

https://ioptconsulting.com

https://twitter.com/tdotrob

 

From: =Drummond Reed [mailto: " target="_blank"> ]
Sent: Tuesday, February 24, 2015 1:49 AM
To: T.Rob
Cc: Adrian Gropper; Dan Miller; Guy Higgins; James Pasquale; ID Coach; John Havens; ProjectVRM list
Subject: Re: [projectvrm] Listening TV's http://www.bbc.co.uk/news/technology-31296188

 

+1 to "informed dissent". T.Rob, you just might have a movement there...

 

On Wed, Feb 11, 2015 at 7:17 PM, T.Rob < " target="_blank"> > wrote:

Maybe this is another catch phrase in the making but what we have now is better thought of as informed dissent.  If you aren't dissenting, that's probably because you are not informed.

 

-- T.Rob

 

From: " target="_blank"> [mailto: " target="_blank"> ] On Behalf Of Adrian Gropper
Sent: Wednesday, February 11, 2015 21:37 PM
To: T.Rob
Cc: Dan Miller; Guy Higgins; James Pasquale; ID Coach; John Havens; ProjectVRM list

Subject: Re: [projectvrm] Listening TV's http://www.bbc.co.uk/news/technology-31296188

 

+1 T.Rob. It's not informed consent to anything if I don't have the opportunity to get the data FIRST.

 

Adrian

On Wednesday, February 11, 2015, T.Rob < " target="_blank"> > wrote:

> Here I thought Barry White sang "Never Gonna Give You Up."

The version that is the origin of the Internet "Rickroll" meme is Rick Astley's.  It may be a cover of Barry White's or Barry may have covered it from someone else.  However, only the Astley version qualifies as a Rickroll if and when some eavesdropper happens upon it.

 

> Here’s my call to action: For companies that are launching “smart” devices on the Internet, be transparent about why, when and how you collect and use personal information. For individuals putting these devices to use, demand to know how you can control when and what you are revealing about yourself.

 

If at any point you update this article, or simply in the course of writing new ones, I would love, LOVE it if the premise that the device manufacturer had any natural claim on the data disappeared entirely.  To do this right, the devices must give their data *first* to the device owner.   It should not blue-screen if it can't get to the Internet and it should function whether or not any data gets back to the vendor.  The vendor's business model should not depend on getting data from 100% of the devices, nor probably even 50% of them. 

 

If the owner gets the data first…

·       We can mash up new interfaces that would not be lucrative for the vendor.

·       We are not locked into a specific vendor, so long as there's a device that performs that function.

·       Our devices do not die if the vendor ceases support or goes out of business.

·       We can audit exactly what data gets out the door, therefore have a reason to trust the vendor.

·       The vendor is obliged to compete on the quality of the product, the API, and the security, whereas today the product is not much more than a cheap, minimal platform for sensors to feed data back to the vendor.

 

This notion that the device vendor gets any data as a precondition to operating the device has got to go.

 

Kind regards,

-- T.Rob

 

I have availability! For a good time (with IBM MQ) call:

T.Robert Wyatt, Managing partner

IoPT Consulting, LLC

+1 704-443-TROB (8762) Voice/Text

+44 (0) 8714 089 546  Voice

https://ioptconsulting.com

https://twitter.com/tdotrob

 

From: Dan Miller [ " target="_blank">mailto: ]
Sent: Wednesday, February 11, 2015 16:36 PM
To: Guy Higgins
Cc: T.Rob; Adrian Gropper; James Pasquale; ID Coach; John Havens; ProjectVRM list
Subject: Re: [projectvrm] Listening TV's http://www.bbc.co.uk/news/technology-31296188

 

T. Rob: Here I thought Barry White sang "Never Gonna Give You Up."

Anyways... I just posted this: http://bit.ly/1FzD1zs

while my thoughts were fresh. My livelihood is based on "intelligent assistance" first taking shape and then taking off. I see a necessary trade-off between what I disclose about myself so that a collective resource (network of friends, network of recommendation robots, whatever) can massage it and make suggestions regarding my next step or action.

I like Google Now. I want Siri to have more relevant answers about more things that are important to me. That's why it's important for my virtual intelligent assistant to know me.

I respect that Moore's law is in our favor and lots of things will be local. Right now that's not an option. But also right now there are all sorts of bad actors about in the world and I know I'm just being stupid to send email's on Gmail, for instance. Advertisers love it.

I use no encryption for my communications. On a separate thread in this group Phil Wiindley and others are offering "keys" for a couple of services like KeyBase or OneName.

I'm trying to map that to something I understand and might use. Does it create a sort of single sign-on for me to use multiple services and have my communications links encrypted or something like that? How would I, a casual browser and frequent searcher/commuicator make use of a key?

 

On Wed, Feb 11, 2015 at 10:58 AM, Guy Higgins < " target="_blank"> > wrote:

Years ago, there was a terrible plane crash in Iowa City (not the destination, but an airport that was available for an emergency landing).  A DC-10 lost all hydraulics — that essentially means that none of the airplane control surfaces (ailerons, rudder, elevator, flaps, etc) were available to the pilots.  Thanks to the presence of an airline instructor pilot working with the exceptionally experienced pilots assigned to the flight, almost half of the passengers survived the almost-controlled crash.  The reason for the loss of all hydraulics?  The redundant hydraulic systems were routed through the same location in the tail of the airplane (near the third engine) and were all destroyed by the same engine failure.  

 

That is exactly the kind of disaster that will happen if control networks are not rigidly segregated from other, non-control, networks.  I’m not prescient, but it doesn’t take a rocket scientist to do the probability calculations to see how quickly the probability approaches 1.0

 

Guy

 

From: "T.Rob" < " target="_blank"> >
Date: Wednesday, February 11, 2015 at 11:29
To: 'Dan Miller' < " target="_blank"> >, Guy Higgins < " target="_blank"> >
Cc: 'Adrian Gropper' < " target="_blank"> >, 'James Pasquale' < " target="_blank"> >, 'ID Coach' < " target="_blank"> >, 'John Havens' < " target="_blank"> >, 'ProjectVRM list' < " target="_blank"> >
Subject: RE: [projectvrm] Listening TV's http://www.bbc.co.uk/news/technology-31296188

 

We are back to the whole "adding $1 to a car is expensive over a million cars" argument.  The network for operational car functions such as brakes and the one for infotainment should be separate.  To the extent that the operational functions need to inform the infotainment devices, one-way egress is allowed, and this can be enforced using crypto.  Anyone can read the operations messages, only authorized devices can write them.  Of course that means duplicating some of the physical wiring to do it right.

 

For what it's worth the Boeing 787 Dreamliner used the same network for plane operations as it uses for passenger infotainment when it was initially sold.  I don't know whether it still does but this goes to show how monumentally clueless people can be about this stuff.  You think disabling the brakes on a moving car is bad, try ENabling them in a moving jet with 300+ passengers aboard.
http://archive.wired.com/politics/security/news/2008/01/dreamliner_security

 

As for TVs that listen, all I have to say is "I void warranties."  When I am not actually using the voice rec, the mic on the TV will be fed a continuous loop of the 1987 Rick Astley song "Never Gonna Give You Up," thus Rickrolling any would-be eavesdroppers.

 

Kind regards,

-- T.Rob

 

I have availability! For a good time (with IBM MQ) call:

T.Robert Wyatt, Managing partner

IoPT Consulting, LLC

+1 704-443-TROB (8762) Voice/Text

+44 (0) 8714 089 546  Voice

https://ioptconsulting.com

https://twitter.com/tdotrob

 

From: Dan Miller [ " target="_blank">mailto: ]
Sent: Wednesday, February 11, 2015 12:43 PM
To: Guy Higgins
Cc: Adrian Gropper; James Pasquale; T.Rob; ID Coach; John Havens; ProjectVRM list
Subject: Re: [projectvrm] Listening TV's http://www.bbc.co.uk/news/technology-31296188

 

Hi all:

Great conversation! T. Rob - Yes, I do know that wake up words require a TV (or Echo, or smartphone) to be always listening. Heretofore the challenge had been battery life on a phone, but the TV is plugged in (in more ways than one).

Adrian, et al. I'm not sure that there is enough diversity among solutions that are being proposed and likely to be adopted.

And James - I'm not sure a single Samsung Smart TV buyer has a clue what a TPM is and where his or hers is.

More dramatic than the contract terms of the Samsung TV "going viral" was the 60 minutes segment showing how DARPA (or more accurately "hackers") could take control of your car. I know it was up against the Grammies but... seeing Leslie Stahl pump the brakes and say "No! No!" as she ran over a bunch of orange pylons. The segment ended by noting that Ed Markey is about to propose legislation to put a stop to it. But how? I think they said that only two of the top makers of luxury cars with electronic gew-gaws had taken formal measures to prevent hacking.

Proposing diversity is one thing, but doesn't that contradict efforts to build some standards for establishing trust and preventing malicious attacks on networks?

 

 

On Wed, Feb 11, 2015 at 5:55 AM, Guy Higgins < " target="_blank"> > wrote:

+1  Diversity here is a strong counterforce.  Hackers are successful to a very large extent because the world’s OS’s share a huge common heritage.  Just like biological viruses would almost certainly be incapable of harming a “life form” based on a non-RNA/DNA chemistry, hackers would find it much more difficult to create problems for truly diverse operating systems.  At least that’s my assertion.

 

Guy

 

From: Adrian Gropper < " target="_blank"> >
Date: Wednesday, February 11, 2015 at 6:42
To: James Pasquale < " target="_blank"> >
Cc: "T.Rob" < " target="_blank"> >, Dan Miller < " target="_blank"> >, ID Coach < " target="_blank"> >, John Havens < " target="_blank"> >, ProjectVRM list < " target="_blank"> >

Subject: Re: [projectvrm] Listening TV's http://www.bbc.co.uk/news/technology-31296188

 

As with biology, there's strength in diversity. Open source home and community layers promote essential diversity.

 

Adrian

On Wednesday, February 11, 2015, James Pasquale < " target="_blank"> > wrote:

Unless the TPM is locked down and either in my control or behind a wall garden, should we really be trusting anything or one. What happens when hackers start infiltrating the software and systems that your smart home is connected through?  

 

Just thinking out loud….  sorry

 

 

On Feb 11, 2015, at 7:09 AM, Adrian Gropper < " target="_blank"> > wrote:

 

It seems clear that Things that need to be connected shouldn't be connected directly to the vendor. The only reasonable solution is to connect things locally first, then to a community that we can choose, and lastly to the vendor. The community function would be equivalent to a corporate IT department that decides if and when to update.

 

Adrian

On Wednesday, February 11, 2015, T.Rob < " target="_blank"> > wrote:

> wake up words

 

You do realize that in order to hear the wake-up words, the device has to be listening, right?

 

Or that the microphone and video camera on the laptop/phone/tablet are also supposed to be off until you turn them on but that we've seen on many occasions that they are activated without our knowledge both legitimately and maliciously?

 

Whether the device behaves as the contract suggests or not, the comparison of the contract that binds you versus the text of 1984 is worthy of going viral.  In order to use the TV, we are being asked to agree to having our otherwise private conversations monitored.  In order to drive my Ford Sync-equipped vehicle I'm required to agree to that and make *you* agree to it before getting into the car if I give you a ride. 

 

If we agree to these things in the contract, the question of whether the device does them is irrelevant.  It *could* do them and now that we've agreed the behavior becomes normative.  Put a few million of these out there and you can send a software update to make the TVs behave exactly as the contract allows and know there's enough install base that your new revenue stream will offset any losses of units in the field.

 

 

Kind regards,

-- T.Rob

 

I have availability! For a good time (with IBM MQ) call:

T.Robert Wyatt, Managing partner

IoPT Consulting, LLC

+1 704-443-TROB (8762) Voice/Text

+44 (0) 8714 089 546  Voice

https://ioptconsulting.com

https://twitter.com/tdotrob

 

From: Dan Miller [ " target="_blank">mailto: ]
Sent: Wednesday, February 11, 2015 0:30 AM
To: ID Coach
Cc: John Havens; ProjectVRM list
Subject: Re: [projectvrm] Listening TV's http://www.bbc.co.uk/news/technology-31296188

 

Here's a little more background on the protocol for instructing the Samsung TV to listen. EFF to the contrary, you have to do something to tell the TV to listen.

https://www.yahoo.com/tech/no-your-tv-doesnt-care-what-you-say-110585259724.html

I know that it would be ideal to have all the rec and interpretation embedded on the device, but - for now - wake up words or pressing a "LISTEN" button will have to do.

 

On Tue, Feb 10, 2015 at 8:16 AM, ID Coach < " target="_blank"> > wrote:

Two bits:

 

1. Jibo: not a household thing yet, and described as "listening." Smart TVs: more likely a common household thing, "listening" is out of historical context. I'm curious to learn about if Samsung TV owners are now silencing themselves in their own homes. Expensive gear, investment for some, so not as easily traded out. How many Samsung Smart TVs are in homes today?

 

2. Trojan horses: recognized or not, we already have several in the form of our baby monitors, our smart phones, our computer mics that are always on... what market exists or might emerge to capitalize on home secrets? (Talk about an idiosyncratic market niche.)

 

 

 

On Feb 10, 2015, at 8:03 AM, John Havens < " target="_blank"> > wrote:

 

I'm intrigued there's such uproar about Samsung's TV's and not much seeming concern about in-home robots like Jibo:

 

http://fortune.com/2014/08/10/jibo-robot-emotion-hotel/

 

Jibo uses facial recognition technology, Skype, and multiple sensors within people's homes. Data is stores to the Cloud. In Japan, a similar robot named Pepper has similar capabilities, and all units learn from one another via cloud based interactions between humans and their manufacturer' smother ship.

 

Note I'm not anti-robot or anti-AI. But I do think passive sensor data outfitted with facial recognition inside people's homes veiled in an anthropomorphically adorable shell is something to think about.

 

So my question is - could Jibo and his kin be a Trojan horse for VRM? 

On Feb 9, 2015, at 9:36 PM, "Mr. Jim Pasquale" < " target="_blank"> > wrote:

There was quiet a bit of hub-bub regarding Samsung TV end user usage agreement this morning on most of the major cable news channels.  Found it rather amusing that people are just now becoming aware, of how invaded their private lives have become. 

Sent from an iPad

 

On Feb 9, 2015, at 7:45 PM, Doc Searls < " target="_blank"> > wrote:

bonus link for background: ProPublica on data brokers:

 

<http://www.propublica.org/article/everything-we-know-about-what-data-brokers-know-about-you>

 

Doc

 

On Feb 9, 2015, at 2:37 PM, Adrian Gropper < " target="_blank"> > wrote:

 

Our VRM focus may lead us to miss the growing role of data brokers. I define data brokers as any non-obvious intermediary with access to my private data. I don't have a log-in to the data brokers that have my data. I don't even know who 99% of them are. Data brokers are creepy by definition. Some, like the NSA and credit bureaus are countable and regulated.

CRM knows how to use data brokers but doesn't share that secret with me. VRM seems to ignore data brokers altogether.

 

Advertising agencies are simply data brokers. Amazon is not a data broker. Samsung doesn't have to be a data broker. Their Thing is visible to me and can give me access and control.

Our Things will be connected, at least to each other and maybe to the vendor for updates. Our Things will either connect to data brokers or not. Will the ones that connect to data brokers be labeled as such?

Adrian

 

 

On Mon, Feb 9, 2015 at 3:45 PM, Chasen, Les < " target="_blank"> > wrote:

I just got done reading Intimate Data Will Be Key to the Internet of Things from adage … creepy!!!!

 

 

-----Original Message-----

From: Iain Henderson < " target="_blank"> >

Date: Monday, February 9, 2015 at 2:33 PM

To: Project VRM < " target="_blank"> >

Subject: [projectvrm] Listening TV's http://www.bbc.co.uk/news/technology-31296188

 

Not long ago this would have been written off as an April Fool.....

 

 

Iain Henderson

" target="_blank">

 

This email and any attachment contains information which is private  

and confidential and is intended for the addressee only. If you are  

not an addressee, you are not authorised to read, copy or use the e-

mail or any attachment. If you have received this e-mail in error,  

please notify the sender by return e-mail and then destroy it.

 

 

 

 

--

Adrian Gropper MD
Ensure Health Information Privacy. Support Patient Privacy Rights.
http://patientprivacyrights.org/donate-2/ 

 

 

 

 

--

Adrian Gropper MD
Ensure Health Information Privacy. Support Patient Privacy Rights.
http://patientprivacyrights.org/donate-2/ 

 

 

 

--

Adrian Gropper MD
Ensure Health Information Privacy. Support Patient Privacy Rights.
http://patientprivacyrights.org/donate-2/ 

 

 

 

 

--

Adrian Gropper MD
Ensure Health Information Privacy. Support Patient Privacy Rights.
http://patientprivacyrights.org/donate-2/