This sucks: intimate photos taken by robot vacuums were leaked online

Even if you’re not a tech geek, you likely have a few “smart” devices at home. A vacuum cleaner, every modern homemaker’s best friend, is probably one of them. A robot vac can sweep floors, hover up dust, pet hair — but also your data.

Privacy policies of most humming assistants state that the manufacturer can collect information from you to improve their products and services, provided you opt in. But who doesn’t want their vacuum to become better in dodging dog poop, avoiding wires, and performing other circus tricks such as not getting stuck under the bed? And who reads the privacy policy before clicking ‘accept’ anyway? Besides, one can be under the impression that an impartial algorithm will process the collected data or, at the very least, that this data will stay with the manufacturer and not be spilled all over the internet — so no need to worry.

iSpy: how a robot vacuum leaked intimate pics

But this assumption is only partially true. While AI is definitely on the course to replace humans, it is not there yet. MIT Technology Review revealed last month that the leading robot vacuum cleaner manufacturer, iRobot, hired third party contractors to sift through and label the raw data collected by the development version of its Roomba j7 series robot. iRobot shared the data with a startup called Scale AI, which, in turn, shared it with independent subcontractors from Venezuela, who in turn shared it on… Facebook and Discord.

These low-paid workers were tasked with labeling furniture and other objects that Roomba’s cameras have captured. The majority of the 15 images obtained by MIT Technology Review from private social media groups were quite innocuous: they featured doorways, shelves, kitchen cabinets, lights, countertops etc. But several photos were way more damning. A series of images taken from different angles showed a woman sitting on a toilet seat — in some of the stills her face is clearly visible. Another image featured a child sprawled on the floor and staring directly at the camera, his face not blurred as well.

The leak set off a blame game. iRobot accused Scale AI of breaching the contract by allowing the images to be posted. Scale AI, for its part, accused Venezuelan workers of violating their contracts.

One could argue that iRobot fell victim to a bad subcontractor. Indeed, if the labellers hadn’t made the blunder of posting the photos on social media, nothing would have come to light. But the problem goes much deeper than a bunch of crowdsourced workers that are yet to grasp the concept of privacy — it’s about how much data tech companies glean from us and who they share it with.

The issue of consent

In its defense, iRobot claimed that the model that captured the compromising images was not sold in stores, but was only distributed among “paid collectors and employees.” Those people, iRobot said, had all consented to their data, including videos, being used for AI training. iRobot, though, did not say whether the volunteers knew that their intimate data would be seen by fellow humans. The consent form only mentioned that the data would be shared with “service providers,” according to the MIT Review.

iRobot admitted that it had shared visual data collected by its vaccums — over 2 million images in total — with multiple contractors and not only Scale AI. According to iRobot, before handing the data over, it filters out images where a user is naked or otherwise compromised. The company did not say why the image of a woman on the toilet was not removed, however.

What does your vacuum know about you

iRobot maintains it does not spy on regular consumers. But, technically, nothing stops it from collecting large amounts of precise information from unsuspecting users’ homes.

First of all, robot vacuums collect this data when they map out your home — that involves drawing a detailed map of all the rooms in your house during the initial cleaning. The map helps the robot understand the layout of the rooms so that it does not clean the same spot twice and bump into corners. The more advanced a mapping technology is, the more accurate the map, and the more efficient the cleaning. In the case of iRobot’s j7 model, the vacuum can collect this data thanks to a front-facing AI-powered camera, a step up from gyroscope and accelerometer-based mapping technology used by cheaper models. Having been fitted with a camera not only gives a robot vacuum an edge over its blind competitors, but also carries obvious privacy risks — since it is now able to see what’s going round and take photos.

Thus, iRobot’s Roomba j7+ model can recognize and take pictures of pet waste and cables by itself and share them with a smartphone app, if you opt in. You can also opt in to share your data with iRobot; in this case, the images will be encrypted and sent to the company, where human employees will examine them. As far as images of people go, the vacuum’s software is supposed to automatically shut off the camera if a human or a photo of a human is in its view. But, as we’ve seen from the MIT Review’s report, safeguards do not always work.

Photo: YoonJae Baik/Unsplash

Moreover, as the saying goes, appetite (for data) comes with eating, or rather, vaccuming and mopping in this case.

The existing technology allows vacuuming robots to get plenty of valuable insights into your life that can come handy to third parties, such as advertisers. And it’s not just about the size of your house, whether you have two bedrooms or one, or whether you have a pet that poops all over the place — although, this is already, perhaps, more than you want strangers to find out. The vacuum cleaner can also get information about your daily routine. With iRobot OS, a cloud-based operating system for robot vacuums, you can set up the iRobot vacuum cleaner so that it automatically starts cleaning when you leave the house and stops when you return. The robot can also be paired with voice assistants like Amazon Alexa, Apple Siri, and Google Assistant so that it responds to your voice commands.

Since iRobot OS is cloud-based, all this information can potentailly be accessed by rogue employees or shared with third parties, such as law enforcement. And the amount of information vacuum robots can amass is nothing short of impressive. iRobot CEO Colin Angle told the Verge in May that the j7 vacuums have so far detected over 43 million objects in people’s homes and learnt to identify and avoid 80 individual objects. This basically means that the manufacturer sits on a treasure trove of data. The question is, will he open it and for whom?

Amazon and iRobot — a match made in privacy hell?

Perhaps, it’s not a coincidence that once iRobot improved its navigation system and revamped its cloud-based software, it sparked Amazon’s interest. In August this year, the companies signed a merger deal, according to which Amazon will pay $1.7 billion for iRobot. The deal, which is yet to be approved by regulators, set off a privacy firestorm.

A number of data privacy organizations, including the Electronic Frontier Foundation, urged the US regulator to derail the acquisition, arguing that the potential comingling of Amazon and iRobot’s data would “jeopardize consumer privacy.”

“Linking iRobot devices to the already intrusive Amazon home system incentivizes more data collection from more connected home devices, potentially including private details about our habits and our health that would endanger human rights and safety,” the letter read.

In fact, iRobot has been entertaining the idea of sharing data with Big Tech long before settling for Amazon. In 2017, iRobot CEO Angle said that his company could share maps of customers’ homes for free with the likes of Amazon, Apple, and Google with customer consent in the future.

It should be noted that Amazon’s pending acquisition of iRobot is just part of a bigger, a rather worrisome trend.

Last year, Google bought fitness tracking company Fitbit for $2.1 billion, sparking similar privacy concerns. In the end, Google agreed to store Fitibit data separately and not use it for Google ads for at least 10 years so that the acqusition deal passes muster with the European Commission. Whether you should trust Google on this — is up to you, but as history shows its promises as far as privacy is concerned are not set in stone

Sensors get better — privacy issues get worse

On par with camera-based vacuuming robots, there are also laser-based robots that use a spinning invisible laser to glean detailed information about the size of the rooms and obstacles. This cutting-edge technology is called LiDAR, which stands for Light Detection and Ranging, and is considered to be the “gold standard for vacuum cleaning navigation”. Laser-based robots tend to be more accurate than their camera-based counterparts, and are typically much faster. And while they can’t capture as much visual data, they also pose a privacy threat, albeit of a different nature.

Researchers have found that devices that use LIDAR can be hacked to collect audio data from homes. Even though they do not have physical microphones installed, these robot vacuums can be repurposed “to spy on conversations and potentially reveal private information,” the researchers from the University of Maryland and Singapore concluded. In the paper called Spying with Your Robot Vacuum Cleaner: Eavesdropping via Lidar Sensors, the researchers described how they used a Xiaomi Roborock vacuum cleaner to successfully record speech and music with over 90% accuracy.

Photo: Elena Mozhvilo/ Unsplash

It’s safe to assume that sensors will get better with time as the demand for greater precision and efficiency while cleaning will only increase. Who wants their vacuum to trip on cords, ram a dog bowl, or scatter pet waste? That means that vacuums’ ability to collect data from homes will also increase. Besides, for the sake of more accuracy, manufacturers may consider installing multiple cameras at once (e.g. ceiling and front), or using both a laser and a camera for navigation — that will potentially enable them to collect even more data.

Balancing out the risks

Internet-connected devices pose a serious threat to privacy, and robotic vacuum cleaners are no exception. The fact that, unlike voice assistants and smart doorbells, which are stationary devices, vacuum cleaners can move and in some cases snap pictures of the inside of your home. Which makes them even more dangerous privacy-wise.

While manufacturers may assure you that they take every precaution to not let confidential user information leak, safeguards can fail, as we’ve seen in the case of Roomba. That’s why the choice is often between privacy, security, on the one hand, and convenience on the other.

The most privacy-friendly option will be to “dumb down” your smart home and replace a robot vacuum cleaner with a good old-fashioned corded vacuum which you would need to manually plug into a socket and drag across the floor. While privacy-friendly and cost-efficient, this option is hardly labor- or time-saving. And if you’re willing to sacrifice some of your privacy and security for convenience, you should be aware of the risks, and follow some basic rules:

• Opt for trustworthy vendors with after-sale support so your data is less at risk from a potential oversight

• Read the privacy policy and Terms of Services (ToS) and carefully tick privacy settings — while some features may not work unless you agree to a certain degree of data sharing, do not agree to more data sharing than is necessary for your device to function

• We usually recommend using DNS filtering to block access to ad servers and tracking sites. However, when data collection is part of the device’s core functionality, it cannot be restricted without undermining that device’s operation — this is true not only for vacuum cleaners, but also for other IoT devices, such as smart speakers.