Internet of Baby - the privacy implications of a smart nursery. - EMF 2026

Right. [applause] Sweet. Right. Hello everyone. Um yeah, today I'm going to talk about in terms of the baby, the privacy and the security implications of having a smart nursery. Uh so obviously who am I? standard slide. My name is Atilia Wentry. Um I work in cyber security. Uh my background is application SL kind of prod. Um I'm currently a hacker engagement manager at Integrity. Um so that's my kind of technical credentials. Um I'm also the peak target audience for uh all these devices we're about to learn about as I'm a mom to be uh and I'm having my first baby at the end of the year. So yay. >> [screaming] >> Um, so that's kind of what led to this talk. Um, instead of panicking about what's to come, I thought I would panic about the state of IoT devices in the world instead. Um, it's also interesting once uh the algorithms know uh what's happening to you. Um, the ads change and I started to get a lot of this is essential, this is what you need. Um, and that's what kind of led me to start looking into all of these things. Um so a couple of disclaimers. The first disclaimer is maybe unsurprisingly um this is quite a biased talk against uh IoT kind of products. Um I think everyone kind of lives on a tech spectrum. Um I'm probably more on the lite end of the spectrum. Uh so yeah, it will be biased. And the second disclaimer is like if you're using one of these devices or all of them, you do you. Um, supposedly parenthood is quite difficult. And if you think that one of these devices help you in your life, you know, knock yourself out. I'm not here to judge you. I'm just judging the privacy and the security implications of your choices. Um, so the kind of definition of smart devices is maybe kind of vague. Um really here I'm looking at internet enabled devices. So devices that have apps that are connected to the internet. I'm not looking at like local area devices. So like you used to get a lot of baby monitors using decked for instance um and FHSS. Uh even a lot of devices use Bluetooth. My threat model really here is the big scary internet not the fact that someone would be outside my front door or inside my nursery intercepting traffic. If someone's doing that, we have bigger fish to fry than the privacy implications. So, if you haven't had a baby in the last few years, uh you might be surprised to know that there's an insane amount of smart products out there um to help you take care of your baby. Literally, does it exist? Then someone has added, you know, internet connection to it and made an app for it. Um probably the most common thing that people tend to buy is a baby monitor. These used to be, you know, just kind of it would react and play sounds if the baby was crying and you were in the room next door. These have now, you know, kind of grown into this huge ecosystem where they have AI facial recognition onto your baby and they will send you notifications and screenshots if your baby smiles whilst you're away. So, it's become this huge kind of thing that they can do uh rather than just kind of monitoring your baby. Another thing that they a lot of them do is a lot of them do a lot of like very common uh use case for kind of IoT devices is smart socks. So this is basically like a little tiny sock that you um will use to kind of track the baby's health. Um it's kind of like a Fitbit for babies and you use it as like a little sock. Um and it will give you information about the heart rate and the blood oxygen levels of your baby. This is kind of sold as a um thing to make you feel more secure when the baby's sleeping. Um SIDS like sudden infant death syndrome is like a fear of all new parents and this is while it's not directly marketed as like a solution. I think that's what a lot of people use it as. Um all of the manufacturers are very clear that this is not medical devices but they kind of sell them as if they are. Um and then yeah the list goes on. You can have anything from sensors in the baby's diapers that give you phone notifications if they need changed. You have e prams like ebikes but pram um breast pumps with apps. Why? I don't know. Um but the list is enormous. So put yourself in my shoes. We're building a nursery and we need some kind of essential devices to uh keep for our baby. So the baby needs somewhere to sleep. So we have a nice little smart nur uh bassinet. This bassinet will move if it senses that the baby is upset. Um, we can control it for an app. It will give us notifications based on the baby's kind of behavior. We need somewhere to change the nappies. Um, and apparently it's quite important to keep track of the weight of the baby at the start. So this uh changing pad will weigh our baby as we're changing the nappies. It will also give a lot of other tracking like we can add how often we change nappies and things like that. Um, and it will track all of this in an app. We need a thermometer. So, we're going to buy a smart thermometer. Uh, this will give us a nice little log of the temperature of the baby. Important, you know, if it's having a fever and things like that. So, we can go back in our app and check uh the kind of health records. Uh, of course we want also to get one of these smart socks. As mentioned, this will track the kind of heart rate and uh blood oxygen um of the baby and gives notifications in case something goes wrong. And lastly, obviously a baby monitor. This is kind of like the main thing that people buy. Um, this one we're going for, the high-tech one. It'll give us little push notifications if the baby smiles. It will save all of that data in the cloud. It's fantastic. So, I'm a pretty high-tech nursery now. It's not crazy, you know. I didn't buy the EPRAM, but we do have the kind of what I would say is reasonable amount of kind of products to to care of our baby. Um, so the question really is, okay, if we aggregate all of the data that each one of these devices uh collect, what have we given away? A lot. Um, so this is the kind of aggregated data um, of these products and all of the products that I picked are based on like a real life one. You can find me if you want to know which one. Um, and yeah, really looking at it, it's a huge amount, right? Um, there's very obviously kind of sensitive healthcare data here. Um, heart rate, weight, uh, body temperature, all those things. But also importantly, not only have we given away data about the baby, we've given out away data about ourselves and our house. Um because we are having like live video streams of our home. We have audio streams of our home. So we can kind of we're giving away what we're talking about in the nursery. Um we're also giving away the location. Um either be it by precise, you know, allowification uh or allow location, but also approximate, right? They can infer kind of where we are. So, we've given all of that away, maybe unknowingly, maybe we kind of understand that we've done that, but we've also given away information that we have entered ourselves. Um, most of these things will ask you to set up a little profile for your baby. [snorts] Of course, you will add the name, the date of birth, the gender, um, maybe a little profile picture as well. So, there's a huge amount of data that, you know, we've potentially given away. Now, you might think, well, these are only five items. there only five manufacturers. How bad could it be? Well, in the modern kind of ecosystem of developing, you know, apps, it's not just very rare that you would kind of do everything yourself. Uh you will be hosting it somewhere. So that will be kind of your Amazon's, your Google's, your Microsoft, your Alibabas. Um, of course you will probably have some sort of analytics, um, some sort of customer support platform and then our loved but trusted advertising technology partners. We've all seen them when they pop up the cookie exception. Um, 347 trusted partners and data processors, right? So this is the data is going away to them too. Um, and then maybe more importantly, this is all ready to be hooed up by data brokers. So data brokers are companies that basically gather huge amounts of data and then kind of massage them into nice little data sets. Um and for each and every new company that our data comes to that's a sort of potential for a data broker to potentially buy that data. Um you might think that well it's you know my baby's weight it doesn't really matter. Um but as I showed sort of aggregated it's becoming quite a big data set and this is actually really really valuable. Um so this is valuable um initially just for the company themselves right they can use it for product development so they can improve their algorithms they can train those AI models that are detecting your baby's you know moods and things like that and they can also help kind of train the prediction behavior um behavior prediction uh for the baby. So this is all kind of added into their data set. This is also really really useful for marketing. If you know how often you feed the baby and then how often you change the nappies, you can probably do some pretty good advertisement for formula and diapers, maybe even childare needs. If you see, you know, who's coming and going and how often is the baby taken care of and things like that. And then lastly, the slightly conspiratorial part, future usages. Um, this data is out there. The data is persistent, right? Um, we've seen in the past that seemingly, you know, innocent companies have sold data to not so innocent purposes. Geom motors is a great example where they sold driving patterns to insurance insurance companies in the US. um what's stopping the manufacturers of you know the baby things to kind of sell that on where further down the line um that data ends up for insurance purposes having the data that you're really ill as a child that might impact your insurance you know as an adult potentially the data is also as I said persistent um 23 and me you know the DNA testing one um they went bust recently and they got sold to another pharmaceutical company. Um, most importantly together with all of that data, right? Um, so most of the terms and conditions will say, you know, we're not going to use your data for anything bad, but we we can sell it if we need to sell the company. So again, the data is out there. So we've kind of talked about privacy. Now I kind of want to talk about the risk of data breaches. Um so even if um you trust a company, do you trust their security? So my main kind of example is uh quite recent. It's only a few months ago where basically there was a Chinese company called Muri Technology and they create white label uh cameras including baby monitors and they sell them under I think it's like 300 different names on Amazon. So you might have one and not know that you have one, right? it's quite difficult to know who the actual manufacturer um of the device is. Um a really cool researcher called Sawi Asu um found basically a set of vulnerabilities that allowed attackers to access images from the monitors in real time um and ended up publishing five CVS. He's also done really cool research on DJI like smart hoovers which I really recommend checking out because it's terrifying. So the way it kind of worked is um because it's an IoT device, it uses something called MQTT, which is a like lightweight IoT messaging protocol um which works in a p uh publish and subscribe model. Uh what turned out to happen is that anyone really could subscribe to these um messages that the IoT devices were sending out. Um, so what they would send out was kind of push notification kind of motion alert notifications and what they would contain was a URL with the JPEG of what it had detected. Um, this was on an Alibaba like open storage bucket without any authentication, you know, without any expiry available for everyone. Um, there is no way for you as a user to delete this because this is all in the back end. Um so yeah pretty pretty spicy. Uh the impact was enormous. Um it impacted 1.1 million registered devices across 118 countries. Um Mary which is you know the kind of manufacturer but not really the seller um did not uh do their GDPR obligations. They haven't told the EU citizens about this. Um, and even if you did kind of find out about it, would you know that your baby monitor is made by Mary? Possibly not. Um, if you get a sort of update pushed to your device, are you sure as a sleepd deprived parent? Are you going to be keeping up on top of those firmware updates? I'm not so sure. My second just kind of final quick um example is by Euro consumer. So Euro consumer is basically a group of various um EU countries uh test like Euro consumer testing kind of uh agencies and they kind of got together and started looking at these kind of IoT devices for babies and children and found flaws in all of them. Uh so there were 69 vulnerabilities that they ended up reporting that kind of ranged from your you know not strong enough password requirement blah blah blah to accessing really quite sensitive data like the unborn baby's heartbeats and sleeping babies movements and things like that. Um, interestingly, um, the kind of less well-known brands have a lot worse security. I'll kind of touch on, uh, why I think that is, uh, next slide. So, what do I think you should do? Um, don't, uh, consider using internet enabled, you know, consider using ones that are not internet enabled. So like your deck, your FHSS Bluetooth. Um if you do want that, you know, kind of interactive device, maybe don't consider using one that's connected to, you know, actual internet. Um but if you do, um remember to change the passwords. I think a lot of us know about the kind of webcams connected to Shodden where you can see things uh because people haven't changed their passwords on their, you know, cameras. Don't be that guy. Change your password. Um, if you're buying devices, use known manufacturers. Um, it sucks because they're a lot more expensive, but as it seems, basically the kind of knockoffs that you get just do have worse security. if they have a big security breach, they can change their brand name and, you know, just still use the same device, but just, you know, go from cuddly bear logo to cuddly cat logo. Um, they don't really have the same kind of impact on their reputation as one of your bigger brands would do. um if there was a huge breach. This is not going to stop the selling data part uh but it will probably give you a bit of a piece of mind in terms of the actual security. And lastly, use fake data. You don't have to give them your baby's new real name, right? You don't have to give them the exact birth date. And the way that you know most people if you sign up to Wi-Fi on uh airport, you might use a fake email is do that. like they don't need you're not like you're not legally entitled to it. Um so just add some fake data to it and that hopefully will be a slight hindrance then for the data brokers to kind of collect all of that data um that they are hoovering up about you. So my TLDDR yes they will give you a piece of mind but the cost is the privacy and the security of you know your family. uh each and every one of these devices that you're adding is adding so many data points into this data set that exists out in the world. You're really giving away sleeping, feeding, toilet, household habits, your family relationship, like things that you probably wouldn't tell a random guy on the street, right? And you're doing all of this kind of to your baby before they even started trying mashed potatoes. So, this is worth considering. Lastly, um the kind of thing with biometric and health data is that it's persistent. You can't go back and like get rid of it in that particularly easily. You can't change it. You can't change like you know what your temperature whatsoever and you can't replace it unlike you can with a password or a credit card number which you know is really sensitive and you should really take care of. Um so yeah, that's me. Thank you for listening and if you have any questions, I will be in the Q&A tent apparently afterwards. [applause]