Hacking tends to bring to mind compromised bank accounts or infiltrated government security systems, not anything as salacious as a dildo. But yesterday, the scientist Ben Goldacre alerted me to the practice of “screwdriving” – short-distance sex-toy hacking.
It might sound far-fetched, but the bluetooth low energy (BLE) networking protocol that “smart” sex toys often use can be compromised relatively easily, as demonstrated by security consultant Alex Lomas, who wandered the streets of Berlin taking control of Lovense Hush buttplugs.
I am a natural tech evangelist, but I fear I am fast becoming the voice of internet doom in my increasingly desperate attempts to make the government wake up to its threats as well as its opportunities. So I wonder if it is finally this, walk-by dildo hacking, that will make people sit up and take notice?
Sex certainly gets people’s attention, and this is one area where the internet has form. In its early days, engineers joked that 3G stood for girls, gambling and gaming – as that was the only way business would make money out of the web (yes, tech jokes are rarely funny). Porn is still a huge driver of revenue across the web, and protecting children from porn has finally brought government and industry together to develop some basic regulation.
So I have high hopes that sexual security might play a role in raising people’s awareness of the security risk of internet-connected devices. The internet was about connecting people. The “internet of things” is about connecting things. Everything – your fridge, your car, your home, your cuddly toy, your bus, your nuclear power station – and, yes, your sex toy. And it is happening now.
Already, televisions and cars are sold as “internet-enabled”. Turning on the heating at home when you leave the office is increasingly common. And isn’t it cute to be able to buy a smart teddy bear that records your child’s first words and shares them with your family?
I am an internet-of-things believer. I’ve studied it, lived it, effectively built bits of it, and I was the first MP to speak about it in the House of Commons in 2011. I believe that it has the potential to transform our lives more than anything since electricity. It can deliver huge economic, environmental and social benefits; from energy management to tracking endangered species. Every time I wait at a bus stop I look forward to the smart public transport system that could be enabled by the internet of things, with buses that stop when and where you want them to, but don’t stop if you’re not there, saving fuel, time and my patience.
But we have to recognise that as more and more everyday objects become connected to the internet, the risk of a cyber-attack grows. Last year cyber criminals brought down Twitter, Spotify and Reddit by hacking domestic internet-of-things devices, including televisions and baby monitors. People’s homes weren’t actually the target – the hackers just used the devices to bombard websites with messages. But they could be next time. Sex toys are but one manifestation of what is an increasingly pervasive threat. Lomas was also able to hack his father’s BLE-enabled hearing aid to selectively alter his hearing and put voices in his father’s head. In February, a teenager hacked 150,000 printers to raise awareness of the dangers of leaving printers exposed online without a firewall. The US Food and Drug Administration recently recalled almost half a million pacemakers due to fears they were vulnerable to hacking in a way that could see their battery run down, or even deployed to alter their users’ heartbeat.
Government regulation will probably ensure that the security of medical devices has improved. But when it comes to smart toasters, the incentives simply don’t exist. Security for internet-of-things devices doesn’t just need to be built in at the start, which takes time and money, it needs to be upgradable over time, as threats evolve and criminals fight back. With global supply chains competing mainly on cost, this is one problem the market cannot and will not solve on its own.
Much more needs to be done. The government’s cyber-security strategy – such as it is – is targeted at security services, critical national infrastructure and big business. They are not looking at toasters, much less dildos. And yet at the same time, it is encouraging us to take up smart meters – opening up our homes to attack.
I’ve repeatedly asked the government to ensure that households will not be left vulnerable to attacks, but I’ve only received poor and confused answers. It appears they have no sense of how to ready the country for the next wave of technological change that is breaking over us.
We need ministers to set out how they intend to protect ordinary people’s cameras, gaming consoles and baby monitors from attacks in the future. Walk-by dildo hacking is the sexy end of the growing security risk posed by the internet of things. I only hope the government sees it coming.