Security: Threats & Defense · Study deck
IoT Privacy Threats
A smart lock records one door event.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- distinguish excessive collection, aggregation, inference, and third-party sharing as privacy threat categories
- use identifiability, linkability, detectability, and disclosure as privacy threat vocabulary
- explain why single-field mitigation fails against multi-identifier re-identification
- apply mitigation patterns (data minimization, local processing, aggregation, retention limits) to a worked example
Major section
In 60 Seconds
A smart lock records one door event.
- That single record may seem harmless.
- Many records can reveal sleep, work, travel, visitors, or an empty home.
- This map does not prove legal compliance or remove every risk.
- The deeper sections explain tracking, inference, weak notice, access, retention, and safer design controls.
Major section
A Normal Feature Can Still Tell a Story
Intuition only: you do not need to be breached to be tracked.
- IoT privacy threats are not limited to stolen data.
- Privacy review starts by separating security from privacy.
- Security asks whether unauthorized parties can access or change data.
- Privacy asks whether the data should be collected, retained, linked, or shared at all.
Major section
A Normal Feature Can Still Tell a Story (continued)
A wearable logs activity, a thermostat records changes, a smart lock records entry events, or a camera stores motion clips.
- IoT devices can reveal patterns even when each single reading looks harmless.
- Each feature may have a legitimate purpose.
- AggregationOrdinary readings become revealing when they are joined over time or across devices.
Major section
A Normal Feature Can Still Tell a Story (continued)
The privacy question is whether the system also creates a record of a person's routine, health, location, visitors, or habits.
- InferenceLinked data reveals occupancy, routines, visitors, or health-related patterns that were not directly collected.
- Many such records can be joined across time or devices.
- Inference supports profiling.
Major section
A Normal Feature Can Still Tell a Story (continued)
Aggregation enables inference.
- A system can be secure against attackers and still harm privacy by collecting too much data, keeping it too long, combining it into sensitive inferences, or sharing it with parties the user did not expect.
- Third-party sharingData leaves the user's expected trust boundary through analytics, SDKs, partners, or onward sharing.
- Sharing then moves that profile beyond the first system and makes it harder to control.
Major section
A Normal Feature Can Still Tell a Story (continued)
That joined data can reveal when a home is empty, who visits, or what routine a person keeps.
- A service may block outside attackers yet still cause harm through approved data capture, links, long storage, or release.
- Profiling becomes harder to control once it is shared outside the original system.
- Privacy Threat VocabularyIdentifiability An observation can be tied to a specific individual, not just an anonymous event.
Major section
Follow the Data Before You Trust the Feature
Privacy review should follow the data, not just the device.
- A review is weak if it only names the sensor and skips the downstream recipients.
- The privacy risk appears when those events are linked.
- Repeated temperature changes may suggest wake and sleep patterns.
- Lock events may suggest home and away periods.
Major section
Follow the Data Before You Trust the Feature (continued)
Motion events may suggest room use.
- Wearable activity may reveal routines or periods of inactivity.
- None of those conclusions require a breach; they can come from normal data collection.
- The labels Local, sharing boundary, and retention limit divide Figure: A privacy review follows data from device collection into responsibility, decision, and consequence.
Major section
Follow the Data Before You Trust the Feature (continued)
Their exact meanings support the claim that a privacy review follows data from device collection through local processing, cloud storage, analytics, and external sharing, checking minimization and control points along the way.
- That support is what the Follow the Data Before You Trust the Feature narrative needs before proceeding.
- The threat: every shop, station, or venue that logs nearby MAC addresses records this device.
- The mitigation: MAC randomization replaces the real address with a rotating random one, so a device seen in two places no longer presents the same identifier and the sightings cannot be linked by that address alone.
Major section
Follow the Data Before You Trust the Feature (continued)
The requirement: the randomization must actually change between contexts and not be undermined by other stable fields, or the linkage returns.
- At Figure: Wi-Fi probe review starts with the scan event, Probe/connect is not interchangeable with: AP, signal, and place? Shows why the distinction matters.
- That specific contrast demonstrates wi-Fi probe review starts with the scan event, then checks whether the address, observed metadata, logs, gateway, app, cloud, or SDK path can still reveal the same place or device.
- Local processingKeep raw readings on the device or gateway and send only the service result.
Major section
Follow the Data Before You Trust the Feature (continued)
Mitigation PatternsData minimization Collect fewer values, sensors, and samples when the feature does not need fine-grained raw data.
- AggregationReport coarser summaries instead of detailed timelines where precision is not required.
- If you can trace a data item from collection to sharing, and then identify the stable fields that link it to a person or place, you can review the practical privacy threat.
- Because the MAC is stable, those logs can be joined across locations into a movement history, tying visits together and often to a person.
Major section
When Re-Identification Uses More Than One Identifier
Privacy risk grows as data moves from direct readings to derived profiles and then to decisions.
- A responsible design documents each step and limits how far raw data can travel.
- Effective unlinkability requires rotating all correlatable identifiers together and at the same boundaries, such as address, fingerprint-affecting fields, counters, and names, and doing so at moments that do not themselves leak.
- Common PitfallsTaken together, these checks make the section reviewable.
Major section
When Re-Identification Uses More Than One Identifier (continued)
Privacy against linkage is a property of the whole set of exposed identifiers, not of the single one you happened to protect.
- Higher-layer namesA stable hostname or service name is an identifier the MAC randomization never touched.
- Rotate togetherUnlinkability requires changing all correlatable identifiers at the same boundary, not just one.
- Strong mitigation removes unnecessary data first, then rotates or suppresses all remaining correlatable identifiers together.
Major section
When Re-Identification Uses More Than One Identifier (continued)
At the boundary, the address, advertised capabilities, counters, cached network names, local service names, and app-visible identifiers should either change together or stop being exposed.
- Evidence should include paired captures from before and after a rotation event, plus a short explanation of which fields changed together and which fields were intentionally suppressed.
- If the same gateway log, analytics event, or service advertisement can still join the sessions, the privacy control is incomplete.
- That order exposes inferences and secondary use that a device-only view would miss, carrying the privacy analysis into a defensible lifecycle decision.
Deck summary
Key takeaways
A smart lock records one door event.
- Intuition only: you do not need to be breached to be tracked.
- A wearable logs activity, a thermostat records changes, a smart lock records entry events, or a camera stores motion clips.
- The privacy question is whether the system also creates a record of a person's routine, health, location, visitors, or habits.
- Aggregation enables inference.
Retrieval practice
Recall check 1 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q1How can an IoT system be secure against attackers yet still create a privacy threat?
Show answer
Answer: C A secure system can still harm privacy by over-collecting, over-retaining, or combining data into sensitive inferences.
Retrieval practice
Recall check 2 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q2How can an IoT device create a privacy threat even when it is not breached and every component works as designed?
Show answer
Answer: A Privacy threats arise from ordinary behavior, not just attacks.
Retrieval practice
Recall check 3 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q3A wearable broadcasts a fixed hardware MAC address whenever it scans for WiFi. What privacy threat does this create, and what is the primary mitigation?
Show answer
Answer: B A persistent identifier turns independent sightings into a movement profile - linkability, often leading to identifiability.
Retrieval practice
Recall check 4 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q4A smart lock, thermostat, and motion sensor each collect ordinary operational events. When combined over several weeks, the events reveal when the home is usually occupied. Which privacy threat is most directly illustrated?
Show answer
Answer: C The individual events may be ordinary, but combining them over time creates an occupancy inference that was not directly collected as a single value.
Retrieval practice
Recall check 5 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q5A device randomizes its MAC address but is still tracked across locations. What is the most likely explanation?
Show answer
Answer: B Linkability needs only one stable attribute.
Print reference
Answers
Answer key.
- C · A secure system can still harm privacy by over-collecting, over-retaining, or combining data into sensitive inferences.
- A · Privacy threats arise from ordinary behavior, not just attacks.
- B · A persistent identifier turns independent sightings into a movement profile - linkability, often leading to identifiability.
- C · The individual events may be ordinary, but combining them over time creates an occupancy inference that was not directly collected as a single value.
- B · Linkability needs only one stable attribute.