Privacy and Connected Devices

Thanks to the exponential growth of the Internet, citizens became more and more exposed to personal information leakage in their digital lives. Beginning with web tracking on our computer, the advent of smartphones, our personal assistant always connected and equipped with many sensors, further reinforced the tendency. Today the craze for quantified self wearable devices, smart home appliances and more generally connected devices, enable the collection of personal information – sometimes very sensitive – in domains that were so far out of reach. However, little is known about the actual practices in terms of security, confidentiality, or data exchanges. The end-user as well as the regulator are therefore prisoner of a highly asymmetric system. This talk aims at discussing the topic of personal information leakage in IoT. In particular it will rely on preliminary work carried out in the context of the IOTics project (ANR 2016 call for proposal). Leaded by the Inria/PRIVATICS team, this project gathers four research teams working on security, privacy and digital economy, plus the CNIL, the French data protection agency. It focusses on connected devices and follows three directions: the analysis of the internal behavior in terms of personal information leakage of a set of connected devices; the analysis of the privacy policies provided (or not) by the device manufacturers; and the analysis of the underlying ecosystem. By giving transparent information of hidden behaviours, by highlighting good and bad practices, the IOTics project aims at reducing information asymmetry, at giving back control to the end-users and hopefully encouraging stakeholders to change practices.