Home Automation: Privacy Risks and Strategies
A Note on Language
In this toolkit, we will sometimes use the word woman/women and feminine pronouns for simplicity and to recognize the significant impact technology-facilitated violence has on women and girls. We recognize that TFGBV also impacts trans, non-binary, and Two-Spirit people. We hope that all people impacted by TFGBV will find these documents useful.
Our homes, workplaces, and vehicles are rapidly being filled with “smart” and “connected” devices that promise to increase convenience, improve energy savings, and strengthen personal security. These devices and systems offer potential tools survivors can use to strategically increase their safety. Unfortunately, these devices and the systems that control them also provide yet another, highly invasive way that technology can be misused to monitor, harass, threaten, or harm survivors.
For more information and general tips about the Internet of Things and smart devices, see our Overview Document.
What Are Some Examples of Home Automation?
Home Automation includes devices, systems, or apps that allow remote control of Internet-connected devices in the home. Some examples include:
- Personal Assistants (e.g. Google Home, Amazon Echo/Alexa). These devices are voice-activated and often include features that adjust lights, play music, place phone calls, read text messages, search for information, and other functions.
- Home Automation Systems (e.g. Nest, Arduino.). These systems often begin with a thermostat or lights and can be expanded to include additional connected devices. Some brands will only allow for connection with devices of the same brand, while others may allow for more universal control across brands.
- Apps pair with IoT devices to allow web-based control through mobile devices. Many of these apps come with the IoT devices, and some work across brands. The apps might notify a user of a smoke alarm, a person at the door, or if an appliance was left on.
- Settings or pre-programmed routines may be built into a device or service and left to run, with or without current remote access. For example, when a user’s phone nears the house, the front door might unlock, the lights might go on, music may begin, and the thermostat may adjust to preferred settings.
Connected Devices
These common devices might also be part of the network:
- Thermostat
- Smart light bulbs
- Smart electrical outlets (with lights or other devices plugged into them)
- Entertainment systems (e.g. stereo, TV, speakers)
- Hubs that are located on a bedside table, in a closet, or other locations throughout the house that connect to the home personal assistant
- Security cameras and motion detectors
- Smoke detectors
- Video doorbells
- Smart locks
- Appliances (e.g. refrigerator, vacuum)
- Pet feeders, nanny or pet cams, toys, and trackers
- Children’s toys and trackers
Home Automation Misuse as a Tactic of Abuse
Home automation devices and systems can be misused to monitor, harass, isolate, and otherwise harm survivors. The technology can track who is in the home and what they are doing. Such surveillance might be done secretly, or overtly, as a way to control behaviour – by capturing images, keeping activity logs, eavesdropping, and gaining access to email or other accounts linked to the connected devices.
Home automation technology can also be misused to cause distress and harm by turning lights and appliances on or off, adjusting the temperature to uncomfortable levels, playing unwanted music or adjusting the volume, triggering home invasion and smoke alarms, and locking or unlocking doors. This kind of harassment can cause significant sleep disruption and trigger traumatic reactions.
Home automation may also be misused to isolate a survivor by threatening visitors, posting private videos or images without consent, and blocking physical access. For example, smart locks could be remotely controlled, limiting a survivor’s ability to leave the house or return to it. A video doorbell could be used not only to monitor who comes to the door, but also to harass them remotely or, in combination with a smart lock, prevent them from entering the house.
People with disabilities may experience additional harm when a caregiver, family member, or roommate takes control, limits access, or damages the system or home automation devices, as might happen with other assistive technology.
Safety Planning and Home Automation Misuse
As with all safety planning, each survivor’s experience and priorities should determine the course of action. Identifying the technology being misused and taking steps to decrease related risks will take time, energy, and access to information.
If you suspect that a device is being misused, you can begin to document the incidents. Our technology abuse log is one way to document each occurrence. These logs can be helpful in revealing patterns and determining next steps, and may be useful in building a case if you choose to involve the legal system.
Ask questions that can help identify what the person could be doing, such as:
- Are there any patterns in terms of when devices are misused (e.g. the time of day, related events like contact, visitation, or court proceedings)?
- Does the person misusing the technology have access to the home or accounts for utilities, security services, or devices? Did they in the past?
- What devices do you know are in the home?
- What else might be hidden?
Once the devices and services that might be involved have been identified, particularly what sort of system could be controlling the devices, the next step is to identify options for regaining control of the system. For instance, if a personal assistant device is being misused, can the account be accessed by you and the password changed to lock out unauthorized access? If it is an app, can the system, network, or devices be reconfigured to block access?
Potential approaches include:
- Contacting the company that made the device or maintains the software to change account ownership and access.
- Changing router or network settings. For more information, see our document on Wi-Fi security.
- Replacing the devices (lightbulbs, the thermostat, electrical outlets, or other connected devices) to either remove those devices from the system or regain control of the system.
NOTE: It is important to safety plan around the possibility that cutting off remote control may escalate harmful behaviour.
Using Home Automation to Increase Safety
These same systems and devices that may be misused to harm survivors can also be used to protect privacy and enhance safety. Here are some examples:
- Security cameras, video doorbells, and other security devices can notify a woman when someone approaches or enters the house. These devices might also gather evidence to document violations of a protection order or other criminal behaviour.
- Smart lightbulbs might provide peace of mind to a woman by illuminating the house or a room before she enters it.
- Pet cams and feeders might provide needed support or comfort to a woman when she is away from home, or help reassure her of a pet’s health or safety.
- Energy-saving devices might help to reduce the financial burden of living independently from a perpetrator.
- Home automation can assist women with disabilities, potentially decreasing the level of support needed from caregivers and increasing independence.
Considerations with New Devices
When considering buying new home automation devices, there are a few questions to consider:
- Does that particular device need to be “smart” or “connected”?
- Do the benefits outweigh the risks?
- How secure are the device and the app that runs it?
- Can that security be strengthened?
Technology-Facilitated Gender-Based Violence (TFGBV) is part of a continuum of violence that can be both online and in-person. If you or someone you know is experiencing TFGBV, you are not alone. You can use sheltersafe.ca to find a shelter/transition house near you to discuss options and create a safety plan. You don’t need to stay in a shelter to access free, confidential services and support.
Adapted for Canada with permission from NNEDV’s Safety Net project, based on their resource Internet of Things Home Automation: Survivor Privacy Risks and Strategies.