Only Dumb People Live in Smarthouses: Warnings for the Techno Fetishists

SABRA: Welcome to the Coffee Break with Sabra, where we answer your burning questions, the questions you didn't ask, didn't know to ask, or were afraid to ask, we ask them for you. Each week we bring you another 20 minutes so that you can get your answers and get back to having a productive and fabulous day. Today we're here with Raj Goel. He's an author, entrepreneur, IT expert and public speaker. Raj is globally known as the go-to man in cyber security and privacy law. He is committed to educating individuals and organizations about online safety and how to protect the most important assets, people and data. His expert advice helps individuals, companies, and conglomerates navigate their way through the world's ever-changing technology and increasingly complex IT compliance laws. He often appears in the media and at conferences worldwide to educate the public on cyber security and digital privacy, a subject he is passionate about. Raj is fueled by his passion for enhancing civil rights in cyberspace, his love of helping people keeping themselves, their families, and their companies safe online. He's available as a consultant and public speaker, and often sought after by the major media outlets and companies. Welcome to the program Raj.

RAJ: Sabra, thank you for having me once again.

SABRA: Yeah, I'm thrilled to have you here, really fascinating and sometimes scary information that you share with us. Today, I don't think it'll be much different. You'll be talking about interesting topics. The title is “Only Dumb People Live in Smart Houses, Warning for the Techno Fetishes”, great title by the way.

RAJ: Thank you.

SABRA: I have to ask you, what do you mean by that because I thought we want to live in a smart house, right? We all want to be smart, be up to technology?

RAJ: Yes. We all want to be smart, that is the default condition for Americans and the American society. And the smart home really should be called the open invitation to criminals, hackers, and idiots. TV commercials are full of AT&T, Comcast, and Time Warner building a smart home. You can be out on a date and lock the doors, and check the thermostat in your house. Just last year Google spent $4 billion, $3.2 billion buying NEST, a small startup that makes home thermostat and smoke detectors. And NEST spent another half a billion dollars buying Dropcam. So in one fell swoop, if you do all your shopping through Google, you can do your searches through Google, get your email through Google, and have them know who's coming through your front door through Dropcam. They know what the temperature is in your house, whether you’ve had a smoke or fire, and how many people live in your house. And Google has rapidly become the world's first and largest surveillance corporation. And what they've done and other companies, Google's not alone in doing this, is they gamified giving away your privacy. What’s the point of buying a Nest thermostat 4, 5, 10 times what you would buy a Honeywell thermostat at Home Depot for? So it can track your energy consumption and lets you lower the temperature remotely from your smart phone or put it on timers. And you can share this data with your friends so you could compete to see who's got the greenest house. This all sounds so wonderful, so Norman Rockwell, so do-gooder, and what's not being disclosed or not being made readily apparent is now one private corporation where will you choose your products from now knows who's in your house, their genders, their ages, your sleeping patterns, your waking patterns, when you are at home, when you're not home. And whether they sell this data or not, you know and I know at some point they're going to have a data breach. They're going to get broken into either with a massive breach or through a long-term attack as a criminal organization. If I'm a one-man burglar, I'm going to walk by the neighborhood, break into your house, if the homeowners are away. Now there are people voluntarily sharing data, what they bought and where they're going. Now with these smart devices these data are being recorded automatically 24/7. Your smart fridge will know when to re-order milk. Well, the smart fridge, smart cam, the Dropcam, and Nest, they're not built by security professionals with an eye towards security and privacy. They're built by start-ups to make a quick buck. Just recently I was interviewed by Channel 11 WPIX in New York because a Russian hacker, I suppose a small Russian firm, built a web portal where you could go in and look at ever security camera available in the world that have been installed with default username and passwords. We were able to look at cameras in nursery cribs. I showed the reporters here's a restaurant in lower Manhattan where you can see the food prep, the cash register. They found a deli where you could actually case the deli and know when would be the best time to rob. And then I spotted this interview on a live demo on air – I was able to locate a camera at a US Army's trench warfare proving grounds. You and I can't walk into a US military installation without getting arrested, without a written invitation, but by watching these cameras online we can 24/7 see what's going on. And they had hundreds and thousands of cameras worldwide available. So as you go to smart houses in the internet of things, the smart thermometer, the smart thermostat, the smart smoke detector, the smart camera, the smart door, the smart fridge, the smart TV. Every smart TV sold to date has been broken into because either manufacturers don't know how to write code securely, or it had default passwords. And so now, you're watching TV, the TV’s watching you. And it's not just the brand manufacturer watching you, now it's anybody else with a web browser. And that's the real danger of smart houses: the technology has outstripped our laws, which happens all time in technology. But more importantly the same idiots who couldn't protect your credit cards at Home Depot or your data at Facebook or Google are the same idiots now building your home. A 22-year old kid out of college doesn't have the brains or the maturity to write secure software, and they're the ones behind most of these start-ups. I'm not saying 50 year olds are any better. Most developers can't write secure software. Windows has proven this, Apple's proven this, Flash and Adobe have proven this. Even large corporations can't write secure software properly, and yet we as consumers are spending 4, 5, 10, 20 times normal rates to buy these smart devices which are compromising not only our privacy but our actual safety. One of the points I've made in the interview about the breaking of the cameras is if Sony broke into your house at two o'clock in the morning and started filming you, your spouse, or your children, you would call that a home invasion, wouldn't we? That's a break in.

SABRA: Sure.

RAJ: But if somebody breaks into your smart camera and starts streaming at you or your nanny cam, or your fridge cam, or your thermostat and starts streaming at you at two o'clock in the morning, does that count as a break-in?

SABRA: It should be.

RAJ: It's not. It may be against the computer hacking laws but it's not legally the same as a break-in or a burglary, even if the damage may be greater or the same.

SABRA: Another example where the law is behind the technology. It sounds like we need an update on our current law, so we could have laws about break-ins but perhaps it needs to be expanded it now include these technologies.

RAJ: Yes, we need some new laws, but more importantly we need some common sense again. Just because technology lets you do it doesn't mean you should. I remember my mother telling me, "If your friend jumps off a bridge are you going to jump off too?" Well, if your friends use stupid apps, should you be using them? If your friends have smart houses, should you be using them? Not necessarily. I'm a big fan of letting somebody else be the guinea pigs and the beta testers. I'm too old and too cautious to want to be a pioneer. Pioneers have arrows in their back. When you have a choice, wait. Wait for a year, 5 years, 10 years, let's see how the technology bears out, not all new shiny things are wonderful. Some of the new, shiny technologies are going to cost you more money and more peace of mind than the joy you'll get out of them. Another example for me is eBooks. I love reading books. I actually either buy paper books or I buy ePubs from people not named Amazon. I do not buy Kindle books. I buy eBooks from other publishers that gave me ePubs without the DRM, digital rights management, because I don't want them to know what books I've read. I don't want them to be able to track what page I'm on, what paragraph I'm reading, and I don't want them to delete or take back what I bought because they don't think I should be reading it. Amazon, they make billions selling Kindles and conveniently or humorously enough the first book Amazon revoked for people who paid for it was 1984.

SABRA: Really?

RAJ: Somebody bought a Kindle in the States, bought 1984, they went back to, I believe it's Sweden or Belgium, one of the European countries and Amazon didn't have the right to sell eBooks in those countries. So without telling the consumer, they went to Kindle and deleted the book, no refund, no nothing. That's not a one-time event. In the US they went and deleted books from high school and college students. Not only did the students lose the books, they lost all their notes. I love eBooks, I have hundreds of them. But, I only buy them from publishers and stores that don't think they have the right to know what I read, and to revoke my purchases. I actually should be the one to say, "Hey, this book sucks, I want a refund." Once you sold me the book you don't have the rights to it anymore. But when you rent books from Amazon, or music from Amazon or Apple, you're not actually buying anything on iTunes, you're merely renting it, and they have the right to revoke the purchase any time they want. Look at what happened when Apple rolled out the new iPhone 6 with free U2. They didn't ask if you wanted a U2 album; they gave it to you automatically. What right does Apple have to stop your phone? They didn't say click on the link and get our free album. They said, "Hey, we know you like music. Here's a free album for you, let's just blow up your iPhone, your iPod, and your Cloud storage because we can. They didn't ask any permission before doing this. I don't mind getting a free gift, I don't mind getting music, and I happen to like U2, but I absolutely object to a company deciding voluntarily to do something with my data or my account without a notice or with my permission. And a lot of these smart technologies, going back to smart homes, they will do things for you because they think they know what's in your best interest. Yes. On one hand, the idea of my fridge reordering milk, bread, eggs, or cheese when they're running low is a fantastic idea. On the other hand I'm willing to bet for every time they save me five minutes of going to the grocery store, they'll cost me hours, months, or years of heartache because somebody's going to turn my fridge to 90 degrees and ruin my groceries. Somebody's going to turn my range on and set the house on fire. If you can control it remotely, so can anybody else.

SABRA: Right.

RAJ: And most smart devices have no security, and no real verifiable security. Because as soon as consumers ask, “How secure is this?” they shut up.

SABRA: What about when personal computers first started coming out and all the programs that they had previously installed on those computers before you pick them up, that thing. It wasn't until Dell or whatever where you can actually build your own computer and select your components, what you want on it, not want on it. I don't remember if it was IBM or Apple, but you bought the computer, it was ready to be used. It had all the programs already installed. I thought that was part of the feature of what they felt was better, or a selling point...

RAJ: Dell was the pioneer in this. Dell was bloody greedy. It was not enough for them to sell you a computer for $1,000; they also went to manufacturers of dodgy applications and said, "For an extra buck we'll pre-load this application for you." And as a result Dell helped fuel the rise of cybercrime, credit theft, and ID theft because it sold all these millions of machines with programs that encourage you to buy more garbage, it also has viruses in it, with security holes in it. They sold machines pre-loaded with games that you thought were free. That had an atrocious privacy policy that had no security settings. They sold you machines with really bad spyware pre-loaded because they're trying to make a buck from multiple sources. All these pre-loaded software was not to increase your productivity; it was to increase their bottom line. And yes, Dell finally relented, and now you can buy a clean PC from them not because they are the good guys, but because they realize they could make more money charging you to not pre-load garbage on your machines. How's that for a kick? They charge you more to do the right thing, and we pay for it because it's easier to pay them a couple of extra bucks than to spend hundreds of dollars giving them all the crapware or dealing with the blow back when you have a virus or infection. Because some stupid app in the background downloaded a virus because the manufacturer thought they knew what to do with your property better than you did. And going forward, right now cars are pretty good. Imagine when your car has the same security standards as Windows. I actually despise the high-end smart cars, because their security is atrocious. In the US, the high-end smart cars are not that popular, in Europe they are. And the fastest growing area of car theft in the UK is in cars where it's $100,000 or more, and the criminals are breaking in not by breaking the window, but because the smart cars have bad security. How's that for a kick in the wallet? You paid more money to get the coolest BMW on the planet and it's easier for the criminals to steal it. And one of the guys who got his car stolen multiple times is David Beckham. He kept buying really expensive cars, the top of the line models, or they were gifted to him, and they were getting stolen right from the front of his flat in London because behind manufacturers didn't test their cars for proper cyber security. They're in an arms race to sell you a newer car every year. They're not in an arms race to sell you a safer, more secure car. We've got laws saying don't text and drive, but what are you going to do when your car comes with Pandora, Facebook, and Google built-in? You can't turn the damn things off. Who's responsible for the accident when you're trying to listen to Pandora and your stream switches because somebody's jacking your car and changed your music stream and started playing Ozzy Osbourne when you were listening to Enya.

SABRA: That's kind of crazy.

RAJ: That might strip the driving experience. Just in the last two years at various car shows the organizers have invited hackers to hack electric cars, smart cars. And in every single instance, from California to China, the hackers have won every single time. They've been able to open windows, unlock cars, stop the breaks, accelerate,

SABRA: Wow, just like what you see on TV, that's pretty scary.

RAJ: What's on TV is no longer fiction, it's reality disguised as entertainment.

SABRA: Wow, unbelievable.

RAJ: Now do you see why I have to say only dumb people live in smart houses and drive smart cars?

SABRA: Yeah, this is the world that we're entering into. You really need to do your homework and really evaluate if that's what you want. The problem I'm thinking of that could be is if they start phasing out the types of cars we have now and just having smart cars only. So where does that leave the consumer with not many choices?

RAJ: The good news is right now all these high-end technologies are actually for the techno fetishes and people with more disposable income than brains. I believe in being an informed consumer, and you know what, you also get to save money doing it. Don't buy the latest gadget, don't buy the smartest fridge on the planet, don't buy the smartest TV, you'll save money. In the long term, you'll probably have better privacy and security. Let somebody else be the guinea pigs. And in the meantime do your homework. Not only if can you afford it, but is it the right thing to buy? Is this right technology to introduce in your home? We read labels when we go to the grocery store, don't we? Does our milk have hormones, is our cheese safe to eat, how many calories does something have. Right now we've got restaurants posting up calorie information on menus and walls. We read them. Not everybody but some people read them.

SABRA: Right.

RAJ: If you're a label reader on your food, if you're a calorie counter on your menus, you might want to look at and read the labels on the technology. If labels don't exist, demand the labels be there. "Hey, this laptop you just bought, who else does it talk to?" The smart phone, who else does it talk to? Thermostat, who has access to the smart TV? You're watching TV, who else is watching you watching TV? TiVo knows what you're watching, what you're pausing...

SABRA: Yeah.

RAJ: Do we need TiVo in our house, is TiVo is a human right?

SABRA: Where does it end, right?

RAJ: It ends with an engaged consumer who looks at not just the cause and the benefits, but also downsides and buys things after education. We can't just say, "We should buy because it's available for sale." Do your homework. Is the right thing to buy?

SABRA: Yeah, I think more consumer awareness is really important. I think that's going to be the answer. Everyone needs to look out for themselves and make a decision. And then you have to weigh that against some people want the government involved to protect that. Who's right to proceed. Do you tell all these companies not to create these advanced technology or you just give enough information to the consumer to make an educated choice and decision?

RAJ: We can't tell the companies not to invent. I'm not against progress. I love progress, I love technology. I make my money with technology. I am not against technology, and I'm not against progress; I am against blind, mindless consumerism. We read the labels in our medicine, in our food, in our cars, we need to do the same thing with technology. We can no longer trust new techno gadgets, we can't give the trust that they haven't earned because they're getting worst, not better.

SABRA: Well, it all goes back to we live in a free society and we need to make choices and decisions, and evaluate. Make the decision that works for you and your family.

RAJ: Correct. And I think most people forget that we do live in a free society, and we as consumers and as parents can't just give in and say, "We should get this new gadget or widget because our kids' friends are doing it." We actually need to evaluate our own privacy and safety standards for ourselves individually, not just go with the herd.

SABRA: Yup. I think on that note we need to close this out. I'd love to talk with you more. It's so fascinating and interesting to me, but it's also a bit overwhelming. It’s a great reminder that we each need to be our own. We need to be vigilant and protect ourselves instead of giving up that power to someone else, to fight for what's right for us.

RAJ: Exactly. A great civil society requires vigilance and part of the citizens, we have to remember we are citizens, not just consumers.

SABRA: Absolutely Raj. I wish more people felt that way. I don't know if that's the consensus out there but I believe in a free society. Great message. Thank you.

RAJ: Thank you Sabra, it's a pleasure to be here again. I look forward to doing this with you again in the near future.

SABRA: Thank you Raj. Thank you for joining us again this week and join us again next week during our weekly Coffee Break with Sabra.