4 ways 'internet of things' toys endanger children

May 10, 2018 by Marie-Helen Maras, The Conversation
Are toys sharing too much information on the internet? Credit: mhong84/Shutterstock.com

As Amazon releases an Echo Dot smart-home device aimed at children, it's entering a busy and growing marketplace. More than one-third of U.S. homes with children has at least one "internet of things" connected toy – like a cuddly creature who can listen to and respond to a child's inquiries. Many more of these devices are on the way, around the world and in North America specifically.

These toys wirelessly connect with online databases to recognize voices and images, identifying children's queries, commands and requests and responding to them. They're often billed as improving children's quality of play, providing children with new experiences of collaborative play, and developing children's literacy, numeric and social skills.

Online devices raise privacy concerns for all their users, but children are particularly vulnerable and have special legal protections. Consumer advocates have raised alarms about the toys' insecure wireless internet connections – either directly over Wi-Fi or via Bluetooth to a smartphone or tablet with internet access.

As someone with both academic and practical experience in security, law enforcement and applied technology, I know these fears are not hypothetical. Here are four examples of when internet of things toys put kids' security and privacy at risk.

1. Unsecured wireless connections

Some "internet of things" toys can connect to smartphone apps without any form of authentication. So a user can download a free app, find an associated toy nearby, and then communicate directly with the child playing with that toy. In 2015, discovered that Hello Barbie, an internet-enabled Barbie doll, automatically connected to unsecured Wi-Fi networks that broadcast the network name "Barbie." It would be very simple for an attacker to set up a Wi-Fi network with that name and communicate directly with an unsuspecting child.

The same thing could happen with unsecured Bluetooth connections to the Toy-Fi Teddy, I-Que Intelligent Robot and Furby Connect toys, a British consumer watchdog group revealed in 2017.

A cat-like stuffed toy orders real cat food.

The toys' ability to monitor children – even when used as intended and connected to official networks belonging to a toy's manufacturer – violates Germany's anti-surveillance laws. In 2017, German authorities declared the My Friend Cayla doll was an "illegal espionage apparatus," ordering stores to pull it off the shelves and requiring parents to destroy or disable the toys.

Unsecured devices allow attackers to do more than just talk to children: A toy can talk to another internet-connected device, too. In 2017, security researchers hijacked a CloudPets connected stuffed animal and used it to place an order through an Amazon Echo in the same room.

2. Tracking kids' movements

Some internet-connected toys have GPS like those in fitness trackers and smartphones, which can also reveal users' locations, even if those users are children. In addition, the Bluetooth communications some toys use can be detected as far away as 30 feet. If someone within that range looks for a Bluetooth device – even if they're only seeking to pair their own headphones with a smartphone – they'll see the toy's name, and know a child is nearby.

For instance, the Consumer Council of Norway found that smartwatches marketed to children were storing and transmitting locations without encryption, allowing strangers to track children's movements. That group issued an alert in its country, but the discovery led authorities in Germany to ban the sale of children's smartwatches.

3. Poor data protections

Internet-connected toys have cameras that watch kids and microphones that listen to them, recording what they see and hear. Sometimes they send that information to company servers that analyze the inputs and send back directions on how the toy should respond. But those functions can also be hijacked to listen in on family conversations or take photographs or video of children without the kids or parents ever noticing.

An 11-year-old shows government cyberprofessionals how easy it is to hack a teddy bear.

Toy manufacturers don't always ensure the data is stored and transmitted securely, even when laws require it: In 2018, toymaker VTech was fined US$650,000 for failing to fulfill its promises to encrypt private data and for violating U.S. laws protecting children's privacy.

4. Working with third parties

Toy companies have also shared the information they collect about kids with other companies – much as Facebook shared its users' data with Cambridge Analytica and other firms.

And they can also surreptitiously share information from third parties with kids. One toy company came under fire, for example, in both Norway and the U.S. for a business relationship with Disney in which the My Friend Cayla doll was programmed to discuss what were described as the doll's favorite Disney movies with kids. Parents weren't told about this arrangement, which critics said amounted to "product placement"-style advertising in a toy.

What can parents do?

In my view, and according to consumer advice from the FBI, parents should carefully research internet-connected toys before buying them, and evaluate their capabilities, functioning, and security and privacy settings before bringing these devices into their homes. Without proper safeguards – by parents, if not toy companies – are at risk, both individually and through collection of aggregate data about kids' activities.

Explore further: Germany bans internet-connected 'spying' doll Cayla

Related Stories

'Spy' toys face complaints from EU, US watchdogs

December 6, 2016

EU and US consumer watchdogs announced Tuesday they are filing complaints against a clutch of smart toys that can "spy" on children and their homes, for allegedly breaching privacy and data protection laws.

Choosing safe toys for the holidays

December 21, 2017

(HealthDay)—When trying to choose the perfect toys for kids this holiday, consider the age of the child first, a leading pediatricians' group says.

Recommended for you

Pushing lithium ion batteries to the next performance level

December 13, 2018

Conventional lithium ion batteries, such as those widely used in smartphones and notebooks, have reached performance limits. Materials chemist Freddy Kleitz from the Faculty of Chemistry of the University of Vienna and international ...

Uber filed paperwork for IPO: report

December 8, 2018

Ride-share company Uber quietly filed paperwork this week for its initial public offering, the Wall Street Journal reported late Friday.


Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.