TV maker unlawfully tracked viewing habits

[Homer J Simpson]

http://www.bbc.com/news/technology-38889975

[MarkS]

It shouldn't come as a surprise. You hook up a device that really shouldn't have any business being connected to the internet in the first place, a device that says quite a lot about you personally, and then are surprised when data is collected and sold.

I'm not saying it is right or wrong, but it shouldn't be a shock.

[Ampera]

Welcome to the Internet of Things! Where personal data is collected directly before your  bandwidth is harvested for a botnet and your charged with DoS based crimes and your ISP cuts your service.

But at least you can check to see if you have another bucket of chicken in the fridge right from your couch...

[Brutte]

My Samsung printer experience.

[HighVoltage]

My Samsung printer experience.

That is one reason why I am using old HP LaserJet printers 4100N and install all drivers manually.

A friend just bought a new TV set with viewer tracking but he did not care at all. So, I think most people would not care, if they knew that this tracking is going on. As long as they can watch their favorite brain washing TV shows.

 

[Sigmoid]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;
3) if they did, be surprised?

Anyway, just plain don't buy consumer IoT shit, people. It's a security issue, and the "benefits" are more gimmicks than anything else. If you want a big TV, and really ALL the options you like come with IoT / smart shite, just buy a huge monitor and a stand-alone DVB-T decoder with HDMI out - as a bonus you can also play GTA V on it or whatever.

As for the printer thing mentioned, there is simply no excuse at all to buy one of these "consumer grade" printers, ever. Regardless where you live, ebay, craigslist, their local variants, and used hardware depots are chock full to the brim with used professional office equipment sold for peanuts. You can get a full duplex, 1200dpi, shitload of pages per minute, PostScript II HP laser printer for the price of a good dinner - and you can also get third-party toner refills for those, making them immensely more economical. (It WILL probably look as if a bunch of mountain trolls have collectively barfed all over it, but that's nothing a little isopropyl alcohol and a soft rag cannot fix...)

We're engineers, let's use our heads. ;P

[Buriedcode]

To be fair, data gathering about peoples viewing habits, or use of a product has been common for a while, and is (often) stated in the user agreement.  We all enjoy the convenience of using credit cards and endless 'free' applications, which always comes with some cost - be it ads, or more specifically *targeted* ads, anonymous collection of user interaction, and giving away a small piece of our privacy.

If you don't wish to provide any of this 'big data', then you don't have to use the product/app.  Whilst I can't say I'm overly pleased about it it seems increasingly people want convenience of modern technology, but also complete privacy.  I'm sure this is possible but you can't have your cake and eat it - we all reap the rewards of 'big data' such as lower prices for consumer goods, 'loyalty cards' and modern conveniences such as voice recognition (which is essentially a massive data gathering exercise to improve voice recognition) and the price we pay is that our habits are stored, often anonymised, and used to find trends.

[vealmike]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;
3) if they did, be surprised?

1/ I've just bought a LG OLED TV, fantastic thing, great picture. I bought it because of the OLED panel and the image quality. It also streams directly from my NAS and from all the UK catchup services.
2/ Well durrrr, how can I use catchup if I don't connect it to the internet? Sorry, but your question is dumb.
3/ No surprises, the user agreement is very clear that the TV tracks what's watched and returns the info to LG.

So what? I really couldn't care that they know what I watch. The telly is visible from the road outside my house too - should I only ever watch it with the curtains drawn so that passers by can't tell what I'm watching?

psst, most of my watching is via the Sky box, so the TV manufacturer can't track what I'm watching.  Sky do instead.

[Ampera]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;
3) if they did, be surprised?

Anyway, just plain don't buy consumer IoT shit, people. It's a security issue, and the "benefits" are more gimmicks than anything else. If you want a big TV, and really ALL the options you like come with IoT / smart shite, just buy a huge monitor and a stand-alone DVB-T decoder with HDMI out - as a bonus you can also play GTA V on it or whatever.

As for the printer thing mentioned, there is simply no excuse at all to buy one of these "consumer grade" printers, ever. Regardless where you live, ebay, craigslist, their local variants, and used hardware depots are chock full to the brim with used professional office equipment sold for peanuts. You can get a full duplex, 1200dpi, shitload of pages per minute, PostScript II HP laser printer for the price of a good dinner - and you can also get third-party toner refills for those, making them immensely more economical. (It WILL probably look as if a bunch of mountain trolls have collectively barfed all over it, but that's nothing a little isopropyl alcohol and a soft rag cannot fix...)

We're engineers, let's use our heads. ;P

Not sure how you get DVB-T in the US, but for ATSC, you get 4 channels if you have a really good antenna and live right next to every single tower.

The better option is to not watch TV.

[Doc Daneeka]

Hmm, I just cannot relate. I havn't owned a TV for nearly 5 years...

[Cerebus]

So, I think most people would not care, if they knew that this tracking is going on. As long as they can watch their favorite brain washing TV shows.

What very few people realise is that these beasties (most 'smart' TVs) not only track what broadcast programmes you watch but also any media you play through DLNA and friends. Some even send clips of the video you watch back home; the manufacturer cited above was one of the ones guilty of this. Thus, they can leak compromising information about your, ahem, 'private' viewing habits, or send file names such as "XYZ takeover bid presentation.mp4" to their real masters, which if you know it came from the home of the CEO of ABC Corp is highly valuable information.

I've got an LG TV that is guilty of all of this and guilty of ignoring privacy settings, but I was wise to it so I set up a combination of firewall, DNS and redirection to a web server that I control to keep it in check but still allow me to use the built in YouTube, BBC iPlayer and other VOD apps without loss of privacy. This actually had the happy side effect of forcing me to harden my home network to 'insider' attacks, which I probably otherwise wouldn't have bothered to do.

[timb]

So, I think most people would not care, if they knew that this tracking is going on. As long as they can watch their favorite brain washing TV shows.

What very few people realise is that these beasties (most 'smart' TVs) not only track what broadcast programmes you watch but also any media you play through DLNA and friends. Some even send clips of the video you watch back home; the manufacturer cited above was one of the ones guilty of this. Thus, they can leak compromising information about your, ahem, 'private' viewing habits, or send file names such as "XYZ takeover bid presentation.mp4" to their real masters, which if you know it came from the home of the CEO of ABC Corp is highly valuable information.

I've got an LG TV that is guilty of all of this and guilty of ignoring privacy settings, but I was wise to it so I set up a combination of firewall, DNS and redirection to a web server that I control to keep it in check but still allow me to use the built in YouTube, BBC iPlayer and other VOD apps without loss of privacy. This actually had the happy side effect of forcing me to harden my home network to 'insider' attacks, which I probably otherwise wouldn't have bothered to do.

You know, LG claimed that none of the data was "personalized" (that is, they collect anonymous data that cannot be tracked back to a specific person). However, part of the data they collect is your IP address, SSID name and names of other nearby SSIDs, which means (in most cases) they can actually pinpoint your address! (There are services that have databases full of SSIDs and their geographic location; they're used to enhance GPS navigation on smartphones when you're indoors or in poor coverage areas.)

So it's not anonymous at all!

[raptor1956]

There was a time when this data collection thing would have been illegal and anyone doing it would be prosecuted for it.  But, for a number of reasons those times are long gone.  First, we live in a time when corporations wield undue influence and get what they want no matter the negative consequence to there customers.  But, perhaps even more insidious is the fact that many governments around the world want access to that data and get access to it either via warrant or without a warrant and further require that the ISP's and others collecting the data keep quiet about the governments access to it.

So, we have a mutually parasitic arrangement where governments permit companies to spy on there customers so long as they get access to that information when they want to and corporations provide that information to governments as a means of insuring they get to collect and harvest that data.  The long and the short of it is that there will be no clamping down on data collection because it's profitable to the corporations AND government loves the private sector for collecting data they want and are given.

Not far from where I live is the Utah Data Center operated by the NSA.  A Forbes report indicated it had between 3.0E18 and 12.0E18 bytes of storage and would see that capacity increase as technology improves.  We are told that this is just to collect "meta data", but how does, say, 6.0E18 bytes square with the claim it's only being used to collect meta data?  With that much storage and with the capacity increasing with time it seems to me they are collecting way more than meta data.

https://en.wikipedia.org/wiki/Utah_Data_Center


Brian

[EEVblog]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;

Because stuff like Netflix is very convenient to have in the TV. My Sony TV has a Netflix button.

[james_s]

Why would anyone
1) buy one of these "smart TVs";
2) if they did, actually connect it to the Internet;

Because stuff like Netflix is very convenient to have in the TV. My Sony TV has a Netflix button.

Also the average consumer (which you obviously are not) simply don't know any better. They take the products at face value, assume they do what they're supposed to do and don't even realize there is potentially nefarious stuff going on under the surface.

Ever since they appeared on the market though I've maintained that the concept of a smart TV is defective by design. Yes, being able to stream Netflix is fantastic and I use it all the time, but I do so with an external device, in my case a BD player that has built in "smart" functions. I think it's idiotic to build a computer with a life cycle of a year or two into a TV that should be good for a decade or more. On top of that, the smarts built into most smart TVs are a generation behind right out of the gate. TV companies almost invariably have piss-poor software development and idiotic UI design. At least one manufacture is now displaying advertisements in the menu. 

I just want a TV with a big screen, a great picture, a bunch of inputs and nice intuitive controls. Major bonus points if those controls are on the *front* of the damn thing where I can actually see/use them rather than hidden off on the side or back requiring the remote to do anything but I don't see the form over function trend going away any time soon.

[Halcyon]

Why would anyone
1) buy one of these "smart TVs"

Have you tried buying a television recently that wasn't "smart"? About one year ago I was looking for a new display for my living room, since I run everything (including live television) through a PC running Kodi, all I wanted was a normal, dumb display without any of the bling. The only pre-requisites were that it had to be a specific size, prefered the panel to be direct back-lit (as opposed to edge lit) and the image quality had to be to my standards.

I narrowed it down to three options. My preferred choice was a Sharp Aquos LCD TV which was one of their last direct back-lit models. I was a few months off buying it when Sharp pulled out of the consumer display market in Australia. All of their stock had been exhausted and JB Hi-Fi sold out of everything, even their demo/shelf models. I couldn't even get one through a staff member working at their Australian head office in Huntingwood.

My next option was an NEC commercial display but I tested one out and the image quality was terrible compared to other leading consumer displays. It was fine if you wanted to display signage 24/7 but awful as a television. Other than that, it ticked all the boxes.

I finally settled with a Philips TV. It has an edge-lit LCD but it does a fairly even job. The image quality is excellent. It has basic "smart" functions such as YouTube and web browsing which I don't use. It runs Philips' own proprietary firmware rather than Android which seems to be the trend these days.

It was honestly the dumbest of the smart TV's I could find that met my criteria. I could have opted for those cheapo Chinese brands from Kogan or something but they are horrible by comparison. Mine is connected to the internet, but only for the purpose of downloading firmware updates when I need it to. Other than that, it has no access to the outside world or any part of my network apart from the DHCP and DNS servers. Everything on the "untrusted" side of my network is locked down with a host whitelist and port blocking. For my TV, it only has access to the Philips update server at a specific time of a particular day.

[anfang]

Oh well, tough shit eh. "Smart" TVs are for dumb people. Anyone worth their salt knows you buy a standard HD TV and plug a Roku into it.

[Halcyon]

Oh well, tough shit eh. "Smart" TVs are for dumb people. Anyone worth their salt knows you buy a standard HD TV and plug a Roku into it.

Anfang, you might like to read my previous post before making such a childish claim. It's easier said than done.

[james_s]

At least you can usually ignore the "smart" features. If you don't connect it to the internet it's pretty hard for it to do anything nefarious. That's pretty much the only choice anymore and I don't see that changing anytime soon.

[Ampera]

I prefer HTPCs for my works. If you want to have a proper HTPC, get one with a REAL Linux installation on it. It will play anything and everything, has support for any file system on the planet, and will work a hell of a lot better than Windows for any multimedia needs. Heck if you're into it, gaming is something you can do too.

I think that companies need to be held responsible for this bullshit. If their devices get brought into a botnet, they should face criminal charges as co-conspirators to the crime. If it's discovered they are holding personal information, they should be liable to any and all damages as well as have the databases confiscated and thoroughly wiped.

Welcome to the modern world people, a few decades ago it was impossible to have so much big data harvesting, and you always had an expectation of privacy by law in your own homes.

We are in a time when everybody is trying to get a piece of you, and nobody is safe. And the worst part is, no matter how hard you try, and how paranoid you may get, it does nothing.

The best you can do is avoid red flags. Secure your machines. Don't fall for IoT. Make your own gadgets. This is an era of profound bullshit, and it's only getting thicker though history always repeats.

[Halcyon]

I'd like to think the majority of us (EEVblog members) are smart enough to work out how to put a stop to our devices spying on us or leaking information but part of that is personal responsibility (i.e.: be careful what you type and where). The same cannot be said for the majority of the planet. I'm of the firm opinion that the gap between "intelligent" and "average" people is getting wider as the population becomes lazier and stupider.

There are those who question, take the time to learn and understand how things and the world operate, then there are those who get so wrapped up in their little bubble of social media, Pokemon, selfies etc... etc... that they don't realise they themselves are the product rather than a consumer and companies are just after their data. More people just need to stop and think "Why is this thing free? What's in it for the company?". There is HUGE money in it as we can all see.

A great and very common example are websites which promote you to login with your Facebook, Google, whatever profile, instead of creating a seperate login. They promote it as being "easier to use" and not having to keep track of multiple logins. If you think they offer this to make your life easier, guess again. If you're one of those people, give yourself an upper cut and go fix it! One account -- One service.

[Sigmoid]

1/ I've just bought a LG OLED TV, fantastic thing, great picture. I bought it because of the OLED panel and the image quality. It also streams directly from my NAS and from all the UK catchup services.
2/ Well durrrr, how can I use catchup if I don't connect it to the internet? Sorry, but your question is dumb.
3/ No surprises, the user agreement is very clear that the TV tracks what's watched and returns the info to LG.

So what? I really couldn't care that they know what I watch. The telly is visible from the road outside my house too - should I only ever watch it with the curtains drawn so that passers by can't tell what I'm watching?

psst, most of my watching is via the Sky box, so the TV manufacturer can't track what I'm watching.  Sky do instead.

The question was rhetorical of course...

Anyway, what most people (apparently you included) don't quite grasp is the breadth of inferences you can make from data collected "with consent". I've been quite immersed in the academic literature around this stuff for some time.

Those fitbit things? They can potentially diagnose* mental illnesses, among other things. I'm not saying the Fitbit corporation is making these inferences, but they have the data to make them (or sell it to others who make them).
(* - Flag you as mentally ill accurately enough to be a credible basis for discrimination, if the intention is there.)

Your grocery store purchase history that you trade for some ridiculous coupon deals? Well in one contentious case, the supermarket knew that a girl was pregnant before she herself realized it.

Data mining is fucking awesome. But it's scary at the same time. As long as we don't have strict state regulation (which IS coming, at least in the EU - no wonder silicon valley corps are squealing like pigs in the slaughterhouse), it's up to each of us to keep our data safe... And while it's pretty much impossible to maintain a lockdown while actually being on-line and active, at least let's not add to our exposure unnecessarily.

Not sure how you get DVB-T in the US, but for ATSC, you get 4 channels if you have a really good antenna and live right next to every single tower.

The better option is to not watch TV.

xD I'm multi-homed... but regardless of broadcast standard used, you can pretty certainly get a decoder box for whatever you need. Satellite DVB is always a solution too.
I do agree with the second point though.

[NiHaoMike]

I think the best countermeasure against tracking is to pollute it with fake data in order to lower the SNR.

[Ampera]

The US has no real equivalent to DVB-S. All of our services are similar to Sky (DirecTV, Dish, Etc.) Paid subscriptions.

And ATSC is absolutely useless in most areas as all the major networks that people actually want to watch are on the paid services, so you only get maybe 3 local channels.

Europe has it a lot better with DVB-T and DVB-S wide, rampant, and true for most of what you'd want to watch.

There are also options like Sling, but that's not much better. Personally, I don't watch TV, if I do for something like a baseball game, I do it with my TV card on my computer (Which are actually pretty cool.)

[bson]

I agree with the ruling - people have a right to privacy in their home even if they choose not to exercise it.  I don't care myself if the whole world knows I watch local sports and GoT on HBO Go, or what have you.  But the right to privacy is important, regardless.  Just like other rights - I can go stand on a street corner and insult people all day, or make up conspiracy theories on Youtube, yet have no compelling interest to do so.  Just like the right to keep and bear arms, or run for office, or right to assemble.  I do none of those things, and see no huge reason to.  Yet the rights are important for when we DO decide to exercise them.  For collecting Nielsen-style viewer data a simple opt-in is sufficient; anyone choosing to keep their TV habits private can choose not to opt in, or can opt out later if they change their mind.  However, it shouldn't be assumed they want to opt in like it appears is done in this case today.