Exploring End Users Perceptions of Smart Home Device Data Practices and Risks

Role: Ph.D. Leader | Skills: User Interview, Qualitative Data Analysis | Collaborators: Tomasz Kosiński,

Dr. Heather Richter Lipford

Overview

Smart homes are more connected than ever before, with a variety of commercial devices available. The use of these devices introduces new security and privacy risks in the home, and needs for helping users to understand and mitigate those risks. However, we still know little about how everyday users understand the data practices of smart home devices, and their concerns and behaviors regarding those practices. To bridge this gap, we conducted a drawing exercise and semi-structured interview with 23 participants who have experience living with multiple smart home devices. We focused on recruiting both more technical participants who installed their devices, as well as non-technical users who were not involved in the installation process. We investigated the following research questions:

RQ1: What are end users’ mental models of the data flows in their smart home?

RQ2: What are end users' perceptions of the data collection, sharing, storage and use by smart home devices and their manufacturers?

RQ3: How do these mental models and perceptions relate to users' privacy and security concerns, considerations and behavior?

Research Method: Phone Interview, Online Drawing Exercise

Participants: 23 Smart Home Owners

Qualitative Data Analysis Method: Inductive Coding

Advanced model

Service oriented model

Fig: Participants mental model of data flow in smart home

We found that the sophistication of participants' threat model and the adoption of protective measures do not depend on their knowledge of how their smart home works. While participants mentioned some threats and protective measures, they often estimated the privacy and security risks from their smart home devices to be too low to trigger any actions. Our study makes the following contributions:

Provides a thorough analysis of both technical and non-technical users' perceptions of smart home device manufacturers' data practices and related threats that offer new insights and also confirm, explain, and extend findings from previous studies.
Among other findings, our results provide new evidence that people are moderately aware of the sensitive information that can be inferred from smart home data, however, are not concerned over the collection and sharing of this data.
Participants' lower-risk perceptions are shaped by trust, previous experiences within other computing contexts, and their own biases, despite their concerns over the lack of control over their information.

Based on our findings, we provide recommendations for smart home designers, researchers, and policy-makers to provide improved awareness and control of data collection practices and protection strategies, considering the perceptions and capabilities of general smart home users.

Publications

Madiha Tabassum, Tomasz Kosinski, Heather Richter Lipford. ``"I don't own the data": End User Perceptions of Smart Home Device Data Practices and Risks" in the proceedings of the Symposium on Usable Privacy and Security (SOUPS), August, 2019.