Unexpected Inferences from Sensor Data: A Hidden Privacy Threat in the Internet of Things

Abstract

A growing number of sensors, embedded in wearables, smart electric meters and other connected devices, is surrounding us and reaching ever deeper into our private lives. While some sensors are commonly regarded as privacysensitive and always require user permission to be activated, others are less protected and less worried about. However, experimental research findings indicate that many seemingly innocuous sensors can be exploited to infer highly sensitive information about people in their vicinity. This paper reviews existing evidence from the literature and discusses potential implications for consumer privacy. Specifically, the analysis reveals that certain insufficiently protected sensors in smart devices allow inferences about users' locations, activities and real identities, as well as about their keyboard and touchscreen inputs. The presented findings call into question the adequacy of current sensor access policies. It is argued that most data captured by smart consumer devices should be classified as highly sensitive by default. An introductory overview of sensors commonly found in these devices is also provided, along with a proposed classification scheme.

What Does Your Gaze Reveal About You? On the Privacy Implications of Eye Tracking

“…Even though eye tracking is a demonstrative example, the threat of undesired inferences is of course much broader, encompassing countless other sensors and data sources in modern life [47]. In other recent work, we have examined sensitive inferences that can be drawn from voice recordings [49] and accelerometer data [48,50], for instance.…”

Out of Control – Privacy Calculus and the Effect of Perceived Control and Moral Considerations on the Usage of IoT Healthcare Devices

“…This legislation, among others, requires informed consent of the user toward data collection and guarantees access to information about what data was gathered and what was the purpose of data processing. However, the realization of these requirements is often problematic due to the lack of transparency ( Kröger, 2018 ; Rantos et al, 2018 ) and because people want to benefit from the promising technology.…”

“…As a result, the trade of personal data is fueled, which means that the secure handling of user data can no longer be guaranteed. While access to data obtained by biometrical sensors or microphones requires explicit user consent, data collected from sensors which are considered harmless (e.g., accelerometers, temperature or light sensors) can be often accessed by third parties without security permission ( Kröger, 2018 ) still allowing inferences for example about the users’ environment. Thus, there is a lack of transparency regarding data collection by IoT, which makes it difficult for users to understand what happens to their data – whether it is stored permanently, processed or even passed on to third parties.…”

Privacy Implications of Voice and Speech Analysis – Information Disclosure by Inference

“…Of course, the problem of undesired inferences goes far beyond microphones and needs to be addressed for other data sources as well. For example, in recent work, we have also investigated the wealth of sensitive information that can be implicitly contained in data from air quality sensors, infrared motion detectors, smart meters [56], accelerometers [57], and eye tracking sensors [58]. It becomes apparent that sensors in many everyday electronic devices can reveal significantly more information than one would assume based on their advertised functionality.…”