Are Your Child's Wi-Fi Toys Being Used to Spy on You? - NBC Connecticut

Are Your Child's Wi-Fi Toys Being Used to Spy on You?

(Published Tuesday, May 10, 2016)

Your children's toy could be used to spy on them.

Some Wi-Fi toys or "smart toys" capture video, pictures and even sound, then transmit that information through the internet.  

NBC Connecticut Troubleshooters took a closer look at the privacy and security of Next Generation Toys and were surprised at what information is being kept about children, and also how little security some of Wi-Fi toys have.

One little gadget is called the Rover Revolution Wireless Spy Car. It comes with its own Wi-Fi signal, so you can control it from your cell phone or tablet.

It zips around capturing video and pictures that you can save or post online.

The problem is, anyone within range of this toy’s Wi-Fi signal can get on it and have full access to take video and pictures of their own allowing someone to see images of you or your children. 

NBC Connecticut Troubleshooters showed the toy to a group of 14-year-olds. While they played with it for a while, NBC Connecticut Troubleshooters' AJ Walker slipped outside to demonstrate how she can take photos and videos without the teens knowing. 

Jessica Lynch, the mother of one the teenagers, said the easy access to spy car device is quite a concern for her.

“It’s surprising. It’s kind of shocking to me that there wouldn’t be bigger security measures of something that video and audiotaped children,” said Lynch.

What may be more disturbing is the spy car has a feature called Stealth Mode during which, a person can capture video and listen in with the toy, while looking like it’s turned off.

“No lights were on and it was still filming you,” said teenager Maeve Lynch. “That really freaked me out.”

While the Wi-Fi connection range for the Rover Revolution is only about 200 feet, tech expert Will Genovese said with a Wi-Fi signal booster, someone could connect from farther away.

“I could be like quarter mile down the street with my laptop and I can actually be looking at the device, connect to the device and look at the camera,” said Genovese.

We tested the signal range for ourselves.

A woman who lives on the fourth floor of a building allowed NBC Connecticut Troubleshooters to put the rover up in her apartment. Troublshooters were able to get crystal clear video inside her apartment without any booster signal at all.

NBC Connecticut reached out to Brookstone which makes the Rover Revolution multiple times to ask about the privacy and security of it but they did not return messages for comment. 

No matter what the age, kids today are tech savvy so toys have to do more to keep their attention.

The CogniToy Dino aims to do just that. A child can talk to it, name it, and interact with it to make it their own, and it responds!

Parents should be aware that their children's voices are being recorded and sent back to the company’s New York headquarters via Wi-Fi. A team of CogniToy staffers are listening and analyzing everything the child says to their Dino buddy and the information and children’s voices are stored on the company’s servers.

“From its inception, we knew that privacy was going to be a big deal,” said the one of the company’s founders, J.P. Benini. “Our users are 5-year-olds. They are children and we want to do right by the parents and the kids. We try to lock down there data as much as possible.”

When a parent gets the Dino, they need to download the app, which asks for parents and children’s information.

Benini said the server is secure and can’t be accessed from outside of the company . He also said the feed between the Dino and the cloud storing the information is encrypted.

Having a secure database and transferring data in an encrypted form is critical to keeping information Safe. In December, toymaker VTech announced it had been hacked, compromising the profiles of more than 6 million children across the world.

A lack of security (encryption) on the company’s systems may have led to the data breach. A VTech spokesperson told NBC Connecticut that before the cyber attack, not all of the data transferred to VTech servers was encrypted, but after reviewing their security, all of the data now transferred to VTech servers through the Learning Lodge service is transferred in encrypted form.

VTech said it has since done updates to make the product secure again.

Though Wi-Fi toys pose a risk for privacy, Benini said interactive toys are here to stay.

“This type of technology is inevitable. We will see implementations of it,” said Benini. “Even if this first wave doesn’t necessarily change the game for anyone, there will be other attempts that get better and better until we hit that point where they do become ubiquitous and understood.”

The Federal Trade Commission said there is a law that says companies that collect information on children under the age of 13 must disclose that they are doing so, as well as state what they intend on doing with the information.

    processing...

    NEWSLETTERS