Incident: Smart TV Privacy Breach by LG: Data Collection Without Consent

Published Date: 2013-11-21

Postmortem Analysis
Timeline 1. The software failure incident involving LG Smart TVs leaking information about users happened in November 2013 as per the article published on November 21, 2013 [23373].
System 1. LG Smart TVs [23373]
Responsible Organization 1. LG Electronics - The software failure incident was caused by LG Smart TVs sending information about users' viewing habits to the manufacturer despite privacy settings being enabled [23373].
Impacted Organization 1. Users of LG smart TVs, specifically those who had their viewing habits and media file names transmitted to LG without their consent [23373].
Software Causes 1. Unencrypted details about each channel change being transmitted to LG's computer servers despite privacy settings [23373]
Non-software Causes 1. The smart TV was sending data about the owner's viewing habits back to the manufacturer despite the activation of privacy settings, indicating a potential privacy breach [23373].
Impacts 1. Personal viewing habits and data of users were being collected and transmitted to LG's servers without proper consent, even after privacy settings were enabled [23373]. 2. Details about each channel change, media files stored on external devices, and even file names containing sensitive information were being sent back to LG without encryption [23373]. 3. The incident raised concerns about user privacy and data security, potentially leading to a breach of trust between LG and its customers [23373].
Preventions 1. Implementing robust data encryption protocols for transmitting user data to prevent unauthorized access during transmission [23373]. 2. Conducting thorough security testing and audits on smart TV software to identify and address potential vulnerabilities that could lead to data leaks [23373]. 3. Providing clear and transparent privacy settings for users, ensuring that opting out of data collection is effectively implemented and respected by the software [23373].
Fixes 1. Implementing robust encryption protocols to ensure that sensitive user data is securely transmitted and stored [23373]. 2. Conducting a thorough review of the privacy settings and data collection mechanisms on LG Smart TVs to ensure that user consent is properly obtained and respected [23373]. 3. Enhancing testing procedures to detect and address any potential vulnerabilities or flaws in the software that could lead to unauthorized data collection [23373].
References 1. Jason Huntley's DoctorBeet blog [23373] 2. LG spokesperson 3. Information Commissioner's Office

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to privacy issues with LG Smart TVs sending information about users' viewing habits to the manufacturer has happened within the same organization. The incident was reported by a British blogger, Jason Huntley, who discovered that his LG TV was sending unencrypted details about channel changes and media file names back to LG's servers despite privacy settings being enabled [23373]. LG is investigating the claim and stated that customer privacy is a top priority for them. (b) There is no information in the provided article about the software failure incident happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in the article is related to the design phase. The failure occurred due to the smart TV's design flaw where unencrypted details about each channel change were transmitted to LG's computer servers even after the user enabled privacy settings. This flaw was discovered by the IT consultant Jason Huntley, who found that his TV was sending data about his family's viewing habits back to the manufacturer despite his attempts to opt-out of data collection [23373]. (b) The software failure incident is also related to the operation phase. The failure was exacerbated by the operation of the smart TV, as the user's actions, such as enabling privacy settings and attaching an external hard drive to the TV, revealed further flaws in the system's operation. For example, the TV not only transmitted channel change details but also sent the names of media files stored on the external drive back to LG, including sensitive information like children's names. This indicates a failure in the operation of the system to handle user data securely [23373].
Boundary (Internal/External) within_system (a) The software failure incident reported in the article is within_system. The LG smart TVs were found to be sending data about the owner's viewing habits back to the manufacturer, LG, despite privacy settings being enabled. This indicates a failure within the system where the TV was transmitting unencrypted details about channel changes and media file names to LG's servers without the user's consent [23373].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the article was primarily due to non-human actions. The LG smart TVs were found to be sending data about users' viewing habits back to the manufacturer's servers despite the activation of privacy settings. This transmission of unencrypted details about channel changes and media file names occurred without direct human intervention, indicating a failure in the software system itself [23373]. (b) However, human actions were also involved in the incident. The user, Jason Huntley, discovered the data transmission issue and attempted to investigate by enabling and disabling privacy settings, as well as attaching an external hard drive to observe the TV's behavior. Additionally, he intentionally created a mock video clip to test if the TV was sending back information about the media files stored on the drive [23373].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The incident involved LG smart TVs sending data about users' viewing habits back to the manufacturer, LG, despite privacy settings being enabled [23373]. - The issue was discovered by an IT consultant, Jason Huntley, who found that unencrypted details about channel changes and media files stored on external drives were being transmitted to LG's servers [23373]. (b) The software failure incident related to software: - The software failure in this incident was primarily due to the smart TV's software design and functionality, which allowed for the unauthorized collection and transmission of user data to LG's servers [23373]. - The failure involved a flaw in the software that did not properly respect the privacy settings chosen by users, leading to the inadvertent sharing of sensitive information [23373].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident in this case appears to be non-malicious. The incident involved LG Smart TVs sending information about users' viewing habits back to the manufacturer despite privacy settings being enabled. The data transmission included unencrypted details about channel changes and even media file names from external devices connected to the TV. This issue was discovered by a British blogger, Jason Huntley, who found that his family's viewing data was being shared without consent. LG is investigating the claim and has stated that customer privacy is a top priority for them [23373].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident reported in Article 23373 can be attributed to poor_decisions. The incident involved LG Smart TVs allegedly sending information about users' viewing habits back to the manufacturer despite privacy settings being enabled. This transmission of unencrypted data, including details about channel changes and media file names, without user consent indicates a lack of proper decision-making regarding user privacy and data security [23373].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the article can be attributed to development incompetence. The incident involved LG Smart TVs sending data about users' viewing habits back to the manufacturer despite privacy settings being enabled. The data transmission included unencrypted details about channel changes and even media file names from external devices connected to the TV. This indicates a lack of professional competence in handling user data privacy and security within the software development of the smart TVs [23373]. (b) Additionally, the incident can also be categorized as accidental. The data transmission of sensitive information like media file names, including personal details like children's names, back to LG was not intentional on the part of the users. It was discovered accidentally by the blogger Jason Huntley when he connected an external hard drive to the TV's USB slot and found the data being sent back to LG without his explicit consent. This accidental exposure of private information highlights a flaw in the software system's handling of user data, leading to unintended consequences [23373].
Duration permanent From the provided article [23373], the software failure incident related to LG Smart TVs leaking information about users' viewing habits appears to be a permanent failure. The incident involved the TV continuously sending unencrypted details about channel changes and media file names back to LG's servers, even after the user had disabled the option for data collection. This continuous transmission of sensitive information without user consent indicates a persistent issue in the software system of the smart TVs, making it a permanent failure.
Behaviour value, other (a) crash: The software failure incident in the article does not involve a crash where the system loses state and does not perform any of its intended functions. The issue reported is related to data collection and transmission without proper consent or encryption [23373]. (b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, it involves the unauthorized collection and transmission of user data without consent [23373]. (c) timing: The software failure incident is not related to the system performing its intended functions correctly but too late or too early. The issue reported is about the transmission of unencrypted data about the user's viewing habits to the manufacturer despite privacy settings being enabled [23373]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. Specifically, the LG smart TVs were sending data about the owner's viewing habits back to the manufacturer even after privacy settings were enabled, indicating a failure in handling user data properly [23373]. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions. The issue reported is more about the unauthorized collection and transmission of sensitive user data without proper encryption or consent [23373]. (f) other: The software failure incident involves a privacy breach where the LG smart TVs were found to be sending unencrypted details about each channel change and even media file names back to the manufacturer, including sensitive information like children's names. This behavior goes beyond a simple bug or glitch and raises serious concerns about user privacy and data security [23373].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving LG smart TVs resulted in the unauthorized collection and transmission of sensitive data about users' viewing habits back to the manufacturer, LG. This included details about each channel change, media files stored on external devices connected to the TV, and even personal information such as photos labeled with children's names. The incident led to a breach of customer privacy and the sharing of viewing information without consent, impacting users' data and potentially their personal information [23373].
Domain entertainment (a) The failed system in this incident was related to the entertainment industry. The software failure incident involved LG smart TVs collecting and transmitting data about users' viewing habits back to the manufacturer, LG Electronics [23373]. This incident directly impacts the entertainment sector as it involves the monitoring of TV viewing behavior and content consumption on smart TVs.

Sources

Back to List