Are Ecovacs Robot Vacuums Spying on You?
Recent findings have revealed that Ecovacs robot vacuums, which already suffer from significant cybersecurity vulnerabilities, are collecting photos, videos, and voice recordings from users’ homes to train the company’s artificial intelligence models. Ecovacs, the Chinese manufacturer behind the popular Deebot models, claims that users voluntarily participate in a product improvement program. However, when connecting through the smartphone app, it’s not clearly stated what data will be collected. Users are encouraged to review the details via a link, but that link is missing from the provided page.
What Data Does Ecovacs Collect?
According to Ecovacs’ privacy policy, the company may collect 2D and 3D maps of homes, voice recordings from the device’s microphone, and images from the robot’s cameras for research purposes. Even after users delete this data, it may remain on Ecovacs’ servers and be used for further development. Company representatives have confirmed that the collected data is used to train artificial intelligence, claiming that the information is anonymized at the device level.
Security Concerns and Previous Incidents
Cybersecurity experts are concerned about Ecovacs’ ability to protect such sensitive data. Previously, researcher Dennis Giese discovered vulnerabilities that allowed remote access to the vacuums’ cameras, raising serious questions about the safety of users’ private information. Giese also noted that even if the company has no malicious intent, it could still fall victim to industrial espionage or actions by other states.
Ecovacs, valued at $4.6 billion, has promised to fix the identified issues in its flagship models by November. The company also stated that data collected through the product improvement program is anonymized before being sent to servers and that access is restricted by strict management protocols.
Data Leaks in the Industry
There have already been cases of images taken by robot vacuums being leaked. In 2022, intimate photos captured by iRobot devices were found publicly available on Facebook, sparking widespread criticism over the security of data collected by such devices. These leaks occurred due to actions by contractors hired to analyze the collected data. One of the companies responsible, Scale AI, specializes in creating datasets for algorithm training, and its contractors have previously leaked user images to social networks.
New Solutions for Privacy
Meanwhile, researchers at the Australian Centre for Robotics have developed technology that could prevent similar incidents. Their solution changes how the robot’s camera works, making images unrecognizable while still providing enough information for navigation. This approach could be key to improving privacy in the future, but it is not yet ready for mass production.