AILSA CHANG, HOST:
Whether you hit the stores on Black Friday or browsed Cyber Monday deals today, let's face it. Holiday shopping season is already in full swing. But before you click purchase on that smart speaker or fitness tracker, Lily Hay Newman wants you to think twice. She says you should know what you're getting people into before they unwrap the box. Newman is the security reporter at Wired, and I asked her what made her want to issue such a warning.
LILY HAY NEWMAN: I think it was kind of a cumulative thing over time. I've written a ton of stories and done a lot of reporting about Internet of Things security and privacy.
CHANG: Internet of Things - you mean like Internet-connected devices?
NEWMAN: Internet-connected - exactly. And I've also received a lot of Internet-connected devices and kind of felt stuck with them and never knew what to do with them because I didn't want to use them myself. So it's like, do I try to return it? Do I tell the person? Do I regift it?
CHANG: It's so awkward.
NEWMAN: Yeah. You're kind of in a bind.
CHANG: OK, so you warn people it's not just cheap, off-brand devices that we're talking about that could end up gathering all kinds of information about you. It's stuff made by huge companies like Google, Apple, Amazon. Let me just ask you, how clearly do they say to people what they're going to be doing with the data they collect?
NEWMAN: Well, a big part of the problem is that it is pretty unclear, and there have been a lot of different examples of big companies and small companies using data in ways that ends up being surprising to the users. For example, virtually all of the big smart assistant manufacturers got caught in a situation where consumers didn't really realize that they were using audio snippets of people talking to their devices to check how the machine learning that works on the device was doing and make it better, which, in a way, is a good service. But it involves human-to-human - you know, someone listening to what you were saying...
CHANG: Right.
NEWMAN: ...Which is exactly the concern. And the companies mostly said, well, this is just how machine learning works at this point. It involves some of this human input. And the customers were like, OK, well, we didn't know that, you know? So...
CHANG: Why are you using my voice to feed...
NEWMAN: Right.
CHANG: ...Your machine's brain? Well, what about stuff that kids use? Like, I could see Internet-connected toys or Fitbits end up on some children's wish lists. In fact, I am hearing already from colleagues who are seeing this on their children's wish lists already. What sort of precautions could you take to protect kids' privacy?
NEWMAN: There are some Internet-connected devices that are tailor-made for kids. They incorporate additional privacy and security protections, so there are limits on the type of data the device can collect. But I also think there's a big issue with gifting these devices to kids because kids aren't necessarily in a position to weigh the pros and cons of using the device. And if adults in their lives are promoting the use of these devices, then they're going to think it's safe.
CHANG: So what is the best etiquette around giving someone one of these devices? I mean, do you think I should ask first before I actually give someone one of these devices, or should I just include a gift receipt?
NEWMAN: Yeah. I like all of those options. I mean, I think with a gift receipt, they can choose whether they actually want it - or asking them or, you know, someone close to them, well, which one did they want? Which model? What are the features they're looking for? Things like that.
CHANG: Or else they'll just end up regifting it or throwing it out anyway.
NEWMAN: Yeah, and, I mean...
CHANG: Who wants that?
NEWMAN: I'm ashamed to say that I've regifted Internet-connected devices. I'm swearing it off now.
CHANG: You are making a pledge on public radio.
NEWMAN: I never - yeah. No more.
CHANG: Lily Hay Newman covers information security, digital privacy and hacking for Wired. Thanks very much.
NEWMAN: Thanks for having me. Transcript provided by NPR, Copyright NPR.