We previously reported about the microphone and video capabilities of Echo technology [view related post]. The FBI is also concerned about this technology being used in toys that are connected to the Internet.

The FBI is so concerned that yesterday, it issued a Public Service Announcement that warns consumers that Internet-connected toys “could present privacy and contact concerns for children.”

The announcement states “[t]he FBI encourages consumers to consider cyber security prior to introducing smart, interactive, internet-connected toys into their homes or trusted environments.” The reason is that these toys include sensors, microphones, cameras, data storage, speech recognition and GPS features that can “put the privacy and safety of children at risk due to the large amount of personal information that may be unwittingly disclosed.” This raises concerns for the privacy and physical safety of children.

The information disclosed often includes name, date of birth, addresses, pictures, voice messages, recordings of conversations, and past and present locations, which increases the risk of identity fraud and exploitation risks.

The risk is that the information is primarily stored in the cloud or with third party companies, and if their data security is weak, the data can be accessed by or disclosed to an unauthorized third party (i.e., a hacker or criminal).

The FBI gives consumers a long list of recommendations before using Internet-connected toys, including:

  • Research reported security issues online
  • Only use trusted and secured WiFi
  • Research the toy’s connection security measures (i.e., use passwords and encryption)
  • Confirm that the toy can receive security patches and updates
  • Read the Privacy Policy and other documentation to find out where user data is stored and whether a third party is used for storage
  • Carefully read the disclosures and Privacy Policy to determine what the company will do in the event of a cyber-attack
  • Turn off the microphone, camera and recording capabilities when the toy is not in use
  • Use strong and unique passwords when creating user accounts and only provide the minimum amount of information necessary to create the account.

These recommendations are no different than recommendations for online activity, but people are not viewing Internet-connected toys in the same way as using apps or social media sites. The FBI does not send out consumer alerts about all concerns they see, so when it does, it is a red flag to pay attention to.

Parents need to be educated on these risks so they are aware of the capabilities and implications of the toys they are bringing into their homes and should closely consider following the FBI recommendations.