Smart speakers pose threat to particular group of people

Cybersecurity experts have warned high-profile people not to keep smart speakers in their home – because it can leave them vulnerable to attack.

Devices such as the Amazon Echo and Google Nest have become increasingly popular in recent years, allowing users to control their home through simple voice commands.

This means the microphone is always on, ready to pick up speech.

Sadie Creese, professor of cybersecurity at Oxford University, warned earlier this year that smart speakers enable hackers to gain valuable information about them, their family and how they live their lives, leaving them vulnerable to attack.

Speaking to MPs on the science and technology select committee, Professor Creese said: ‘If you are person in a significant leadership position, where a threat might have an interest in targeting you to coerce you into doing something, or threaten you so that you would do something that could harm your organisation or your family, anything – any devices that give away how you live – will make you more targetable.’

When asked if she herself used one, Professor Creese said: ‘Asking me if I have smart speakers is a little bit like asking for my password. So I won’t comment on that.’

She advised anyone in high-profile roles not to have smart speakers in their homes ‘just like I would advise against putting a camera in their living room’.

Professor Creese added her warning did not apply to most people.

However, Professor Alan Woodward, a cybersecurity expert at the University of Surrey who advises the EU’s law enforcement agency Europol, said anyone with a smart device should treat it as ‘always on’.

‘The bottom line is you should treat any camera or microphone as live,’ he said. ‘I have cameras but they all point away from the house or see people approaching the house, not activities within the house.

‘If you feel you want a smart speaker or home assistant’ then you can check to see what it is ‘formally’ harvesting – Google and Amazon have the facility to view the snippets captured and stored online.’

Tech giants have already been sued over how they acquire and use data from smart speakers, while Amazon has handed over recordings from smart speakers and footage from its Ring doorbell cameras to police on multiple occasions, in some cases without customer consent or a warrant.

However, Professor Woodward still recommends those who wish to own a smart speaker to buy one from a big brand such as Amazon or Google, warning that in cheaper replicas, ‘security will have been lower on the design agenda – you get what you pay for’.

‘The issue with most [smart devices] is that you are unlikely to know if it has been compromised,’ the University of Surrey professor added. ‘So to be truly safe, you should assume it has been compromised. Despite what some vendors tell you, nothing is 100% secure or unhackable.

‘Quite the opposite – if it is smart it is potentially vulnerable.’

This article was originally published on 29 March 2024.