But yes, the real story is that training data (and “real” data) does leak all the time and that most companies don’t take insider risk as seriously as they should.
The meat of the article is that what technology and tech companies are doing is divorced from the expectations that we have as a society.
It couldn’t have been done from any roomba, but it could happen to almost everyone who didn’t understand the exact ramifications (which we click through several of every year to try to get the vacuum up and running). That’s why a lot of ppl on HN put masking tape over their laptop webcam. Or are you calling those people paranoid?
Would it be a bad thing if people erred on the side of being too private, for a change?
A lot of people think it is a problem that people are blindly trust big tech tracking everything they do, or are uninformed about this sort of thing.
Precisely how the "Zoom is Chinese spyware!" stuff spread around.
I did not expect to see actual photos of the woman sitting on the toilet in this article. But damn, they're real and published dead center. It's awful and voyeuristic to feature, but in a way it brings to life the freakishly perverse Orwellian horror of all of this.
This piece hits hard, as it should.
How did neither Roomba nor ScaleAI have safeguards against PII of this nature? This is inside people's intimate spaces. It could have been sex. Or children. How did they not think of this?
This sort of disregard for privacy should be punished, and this woman should be able to sue Roomba and ScaleAI for a handsome sum.
Maybe they did have some kind of internal data privacy policy or 3rd party policy, but it was wholly inadequate.
My team once had a certain perennial Billboard chart topper's login credentials due to suspected mishandling by one of their team (I'm still afraid to say whom), but you'd better believe we treated it - and all of our customer data - as sacred taboo. Mishandling PII was fireable at minimum, and could probably land us in litigation with a permanent mark against our careers.
We need GDPR/CCPA++ protections here. As an added bonus, the companies that play nice will get a comfortable moat in the form of their compliance.
It's also absurd to think they didn't face safeguards. We can only speculate if the individual was fired, or if stronger policies were put in place since 2020, but it's naive to expect that whatever policy is put in place will stop a human data labeler from smuggling PPI for personal reasons.
Well, you'll find a Roomba spokesperson saying that, anyway.
I don't mean to imply that the spokesperson was lying and these were plain old roomba's instead of special R&D Roomba's.
I do mean to imply that I think a roomba spokesperson would describe "included in paragraph 12 of a 23 paragraph terms of service that they clicked through" as "specifically aware", but I would not consider that any kind of "proof" that the people actually were "specifically aware". At best it is an argument they ought to have been, which is a different thing (and it's an argument).
Therefore I don't agree with your implication as I just don't see any evidence to support it. Even the article's author, with the evidence they were given doesn't push this point.
You are making claims about what the owners "specifically knew". What is the evidence about what the roomba owners (or, uh, holders) did or did not know, "specifically" or otherwise?
> They were given to “paid collectors and employees” who signed written agreements acknowledging that they were sending data streams, including video, back to the company for training purposes.
So it hardly seems likely that they would not be aware of this.
But as a guy, I don't know if girls pull them down farther if they think they're not being watched. She might be the one who agreed to it.
Still, the owner of a space is making the decision for all people who come into that space.
I opened the article (on a phone) and no fewer than 3 separate popovers appeared over the content. “Hey! This is our cookie policy” “Happy holidays! We have a special subscription price!” And something else that was covered by the first two before I had a chance to read it.
Thankyou for summarising. I noped right out of there out of disgust.
Roomba iOS app refuses to go past its welcome screen unless its granted access to the location info.
This is unreasonable, they don't need this info for their app to function.
However their devices are all but unusable without an app, so they ultimately blackmail people into giving location data to them.
Meaning they don't really give a sh#t about users' privacy, so it's not that "they are watching you", but that they won't think twice about hooking up to a random Roomba and shooting a video with it. Consent or not.
I've returned several "smart" devices that required an app and an account. One example is GoVee smart blubs. As soon as they refused to work without an account I sent them back. Another is some Meross smart outlets. I retuned them for Eve Energy outlets.
The burden is on them to not perform those actions, not on me.
I should be fully entitled to make use of the product without agreeing to any additional contracts or permissions.
Does anyone know, is this like Android where some bluetooth functionality is behind the location permission?
There’s a specific “local network” permission nowadays so maybe it was the older permission API because you can deduce location from MAC addresses?
Out of spite I took the iPad to a friend's house, enabled location, clicked through the welcome screen and disabled it again. Then came back home and hooked up the device.
So, no, it's not linked to its BT needs at all.
And I am not sure I buy the “anyone who does one bad thing will necessarily do all of the bad things” view.
And that's without getting into why it must have an Internet connection (to enable a large chunk of its functionality). It has a Bluetooth, it is perfectly capable of talking to the smartphone using it, but it can't be controlled that way.
Re: bad thing - not a "bad thing" per se, just a very cavalier attitude, which is as troubling.
Either way, Android (and iOS) should be stricter about these things; apps should work without any permissions. I mean a navigation app without location access won't work very well and permission can be denied by accident, but that can be resolved.
If I disabled the permission it would stop working.
So I switched to the home assistant integration for it and removed the app from my phone.
Best thing it's he didn't even know at first. He bought a new washing machine that had app support, so out of curiosity he installed the app and scanned for devices, but the app only found his stove.
Technology was a mistake.
Another smart scenario I can think of, link it with energy prices and a real-time dynamic energy contract, and/or solar panel output or battery charge levels, to only run it when it's cheapest to do so.
Of course, that means having it stand-by to run at all times, meaning it may run half-empty and you need to keep the door closed which will cause mold etc.
Should be, but here's the thing: they don't want to build the best app or customer experience through convenient features, they want your (location) data, because aggregated, that shit is worth more than the stupid dishwasher.
They don't make money on selling dishwashers anymore; components, shipping, marketing and middle men will swallow up any profit. But location data and subscriptions will bring in the real money, over a long and continuous period of time.
See also this story from a Twitter engineer who talked to mobile phone companies that were prepared to pay big money for location data; I can't find the source anymore, but it's been reposted on various outlets: https://hindupost.in/media/an-ex-twitter-engineer-reveals-ho...
You can't pair anything with an app unless you turn the location on. Main feature of the Roomba app is to pair a vacuuming robot using phone's wifi and a special wifi network between phone and vacuum.
So while it's not a perfect solution to block you from going further, you can't really be that paranoid about them asking for that access. And ofc, I'm sure your location flew to the iRobot servers along with your other details that could've been scraped from starting the app on your phone.
edit: added paragraphs for readability.
I participated in an iRobot Study in 2019, since then I have received multiple invitations that I have declined specifically because they mentioned streaming video or cameras.
Here's the following para:-
"In other words, by iRobot’s estimation, anyone whose photos or video appeared in the streams had agreed to let their Roombas monitor them. iRobot declined to let MIT Technology Review view the consent agreements and did not make any of its paid collectors or employees available to discuss their understanding of the terms."
Was the HN title changed. I am having trouble seeing how one who did not read the article would interpret the HN title to suggest a "they're watching you" narrative. For example, one could interpret it as posing a question about leaked photos, e.g., who leaked them and/or why.
The idea that a "they're watching you" narrative is "attention-getting" is interesting seeing that many HN commenters repeatedly tell us that people outside of HN do not care about privacy or surveillance. If that is true, then why would a journalist/publication seeking the largest possible audience try to advance such a narrative. No one cares. That's what they tell us, anyway.
The actual title is: "A Roomba recorded a woman on the toilet. How did the photos end up on Facebook"
This website is a publication of MIT. A strange source for "they're watching you" narratives.
Seems like the narrative's just as accurate as it was prior to reading the title.
> iRobot … confirmed that these images were captured by its Roombas in 2020. All of them came from “special development robots with hardware and software modifications that are not and never were present on iRobot consumer products for purchase,” the company said in a statement. They were given to “paid collectors and employees” who signed written agreements acknowledging that they were sending data streams, including video, back to the company for training purposes. According to iRobot, the devices were labeled with a bright green sticker that read “video recording in progress,” and it was up to those paid data collectors to “remove anything they deem sensitive from any space the robot operates in, including children.”
Seems like the real story is that training data was leaked, rather than the attention getting “they’re watching you” narrative the title suggests