Human in the Loop

When Ring employees accessed thousands of video recordings from customers' bedrooms and bathrooms without their knowledge, it wasn't a sophisticated hack or a targeted attack. It was simply business as usual. According to the Federal Trade Commission's 2023 settlement with Amazon's Ring division, one employee viewed recordings of female customers in intimate spaces, whilst any employee or contractor could freely access and download customer videos with virtually no restrictions until July 2017. The company paid £5.6 million in refunds to affected customers, but the damage to trust was incalculable.

This wasn't an isolated incident. It's a symptom of a broader crisis facing consumers as artificial intelligence seeps into every corner of domestic life. From smart speakers that listen to your conversations to robot vacuums that map your home's layout, AI-powered consumer devices promise convenience whilst collecting unprecedented amounts of personal data. The question isn't whether these devices pose security risks (they do), but rather how to evaluate those risks and what standards manufacturers should meet before their products enter your home.

The Growing Attack Surface in Your Living Room

The numbers tell a sobering story. Attacks on smart home devices surged 124% in 2024, according to cybersecurity firm SonicWall, which prevented more than 17 million attacks on IP cameras alone during the year. IoT malware attacks have jumped nearly 400% in recent years, and smart home products now face up to 10 attacks every single day.

The attack surface expands with every new device. When you add a smart speaker, a connected doorbell, or an AI-powered security camera to your network, you're creating a potential entry point for attackers, a data collection node for manufacturers, and a vulnerability that could persist for years. The European Union's Radio Equipment Directive and the United Kingdom's Product Security and Telecommunications Infrastructure Regulations, both implemented in 2024, acknowledge this reality by mandating minimum security standards for IoT devices. Yet compliance doesn't guarantee safety.

Consumer sentiment reflects the growing unease. According to Pew Research Center, 81% of consumers believe information collected by AI companies will be used in ways people find uncomfortable or that weren't originally intended. Deloitte's 2024 Connected Consumer survey found that 63% worry about generative AI compromising privacy through data breaches or unauthorised access. Perhaps most telling: 75% feel they should be doing more to protect themselves, but many express powerlessness, believing companies can track them regardless of precautions (26%), not knowing what actions to take (25%), or thinking hackers can access their data no matter what they do (21%).

This isn't unfounded paranoia. Research published in 2024 demonstrated that GPT-4 can autonomously exploit real-world security vulnerabilities with an 87% success rate when provided with publicly available CVE data. The University of Illinois Urbana-Champaign researchers who conducted the study found that GPT-4 was the only large language model capable of writing malicious scripts to exploit known vulnerabilities, bringing exploit development time down to less than 15 minutes in many cases.

When Devices Betray Your Trust

High-profile security failures provide the clearest lessons about what can go wrong. Ring's troubles extended beyond employee surveillance. The FTC complaint detailed how approximately 55,000 US customers suffered serious account compromises during a period when Ring failed to implement necessary protections against credential stuffing and brute force attacks. Attackers gained access to accounts, then harassed, insulted, and propositioned children and teens through their bedroom cameras. The settlement required Ring to implement stringent security controls, including mandatory multi-factor authentication.

Verkada, a cloud-based security camera company, faced similar accountability in 2024. The FTC charged that Verkada failed to use appropriate information security practices, allowing a hacker to access internet-connected cameras and view patients in psychiatric hospitals and women's health clinics. Verkada agreed to pay £2.95 million, the largest penalty obtained by the FTC for a CAN-SPAM Act violation, whilst also committing to comprehensive security improvements.

Robot vacuums present a particularly instructive case study in AI-powered data collection. Modern models use cameras or LIDAR to create detailed floor plans of entire homes. In 2024, security researchers at DEF CON revealed significant vulnerabilities in Ecovacs Deebot vacuums, including evidence that the devices were surreptitiously capturing photos and recording audio, then transmitting this data to the manufacturer to train artificial intelligence models. When images from iRobot's development Roomba J7 series were leaked to Scale AI, a startup that contracts workers globally to label data for AI training, the images included sensitive scenes captured inside homes. Consumer Reports found that none of the robotic vacuum companies in their tests earned high marks for data privacy, with information provided being “vague at best” regarding what data is collected and usage practices.

Smart speakers like Amazon's Alexa and Google Home continuously process audio to detect wake words, and Amazon stores these recordings indefinitely by default (though users can opt out). In 2018, an Alexa user was mistakenly granted access to approximately 1,700 audio files from a stranger's Echo, providing enough information to identify and locate the person and his girlfriend.

IntelliVision Technologies, which sells facial recognition software used in home security systems, came under FTC scrutiny in December 2024 for making false claims that its AI-powered facial recognition was free from gender and racial bias. The proposed consent order prohibits the San Jose-based company from misrepresenting the accuracy of its software across different genders, ethnicities, and skin tones. Each violation could result in civil penalties up to £51,744.

These enforcement actions signal a regulatory shift. The FTC brought 89 data security cases through 2023, with multiple actions specifically targeting smart device manufacturers' failure to protect consumer data. Yet enforcement is reactive, addressing problems after consumers have been harmed.

Understanding the Technical Vulnerabilities That Actually Matter

Not all vulnerabilities are created equal. Some technical weaknesses pose existential threats to device security, whilst others represent minor inconveniences. Understanding the distinction helps consumers prioritise evaluation criteria.

Weak authentication stands out as the most critical vulnerability. Many devices ship with default passwords that users rarely change, creating trivial entry points for attackers. According to the National Institute of Standards and Technology, one of three baseline requirements for IoT device security is banning universal default passwords. The UK's PSTI Regulations, which took effect in April 2024, made this legally mandatory for most internet-connected products sold to UK consumers.

Multi-factor authentication (MFA) represents the gold standard for access control, yet adoption remains inconsistent across consumer AI devices. When Ring finally implemented mandatory MFA following FTC action, it demonstrated that technical solutions exist but aren't universally deployed until regulators or public pressure demand them.

Encryption protects data both in transit and at rest, yet implementation varies dramatically. End-to-end encryption ensures that data remains encrypted from the device until it reaches its intended destination, making interception useless without decryption keys. Ring expanded end-to-end encryption to more cameras and doorbells following privacy criticism, a move praised by Consumer Reports' test engineers who noted that such encryption is rare in consumer IoT devices. With end-to-end encryption, recorded footage can only be viewed on authorised devices, preventing even the manufacturer from accessing content.

Firmware update mechanisms determine whether devices remain secure over their operational lifetime. The PSTI Regulations require manufacturers to provide clear information about minimum security update periods, establishing transparency about how long devices will receive patches. Yet an Ubuntu survey revealed that 40% of consumers have never consciously performed device updates or don't know how, highlighting the gap between technical capability and user behaviour. Over-the-air (OTA) updates address this through automatic background installation, but they introduce their own risks if not cryptographically signed to prevent malicious code injection.

Network architecture plays an underappreciated role in limiting breach impact. Security professionals recommend network segmentation to isolate IoT devices from critical systems. The simplest approach uses guest networks available on most consumer routers, placing all smart home devices on a separate network from computers and phones containing sensitive information. More sophisticated implementations employ virtual local area networks (VLANs) to create multiple isolated subnetworks with different security profiles. If a robot vacuum is compromised, network segmentation prevents attackers from pivoting to access personal computers or network-attached storage.

The Adversarial AI Threat You Haven't Considered

Beyond traditional cybersecurity concerns, AI-powered consumer devices face unique threats from adversarial artificial intelligence, attacks that manipulate machine learning models through carefully crafted inputs. These attacks exploit fundamental characteristics of how AI systems learn and make decisions.

Adversarial attacks create inputs with subtle, nearly imperceptible alterations that cause models to misclassify data or behave incorrectly. Research has shown that attackers can issue commands to smart speakers like Alexa in ways that avoid detection, potentially controlling home automation, making unauthorised purchases, and eavesdropping on users. The 2022 “Alexa versus Alexa” (AvA) vulnerability demonstrated these risks concretely.

Tenable Research discovered three vulnerabilities in Google's Gemini AI assistant suite in 2024 and 2025 (subsequently remediated) that exposed users to severe privacy risks. These included a prompt-injection vulnerability in Google Cloud's Gemini Cloud Assist tool, a search-injection vulnerability allowing attackers to control Gemini's behaviour and potentially leak users' saved information and location data, and flaws enabling data exfiltration.

The hardware layer introduces additional concerns. Researchers disclosed a vulnerability named GATEBLEED in 2025 that allows attackers with access to servers using machine learning accelerators to determine what data trained AI systems and leak private information. Industry statistics underscore the scope: 77% of companies identified AI-related breaches, with two in five organisations experiencing an AI privacy breach or security incident. Of those incidents, one in four were malicious attacks rather than accidental exposures.

Emerging Standards and What They Actually Mean for You

The regulatory landscape for AI consumer device security is evolving rapidly. Understanding what these standards require helps consumers evaluate whether manufacturers meet baseline expectations.

NIST Special Publication 800-213 series provides overall guidance for integrating IoT devices into information systems using risk-based cybersecurity approaches. NISTIR 8259A outlines six core capabilities that IoT devices should possess: device identification, device configuration, data protection, logical access to interfaces, software updates, and cybersecurity state awareness. These technical requirements inform multiple regulatory programmes.

The Internet of Things Cybersecurity Improvement Act of 2020 generally prohibits US federal agencies from procuring or using IoT devices after 4 December 2022 if they don't comply with NIST-developed standards. This legislation established the first federal regulatory floor for IoT security in the United States.

The EU's Radio Equipment Directive introduced cybersecurity requirements for consumer products as an addition to existing safety regulations, with enforcement extended to August 2025 to give manufacturers adequate time to achieve compliance. The requirements align with the UK's PSTI Regulations: prohibiting universal default passwords, implementing vulnerability management processes, and providing clear information about security update periods.

The Cyber Resilience Act, approved by European Parliament in March 2024, will apply three years after entry into force, establishing comprehensive cybersecurity requirements for products with digital elements throughout their lifecycle, creating manufacturer obligations for security-by-design, vulnerability handling, and post-market monitoring.

The US Cyber Trust Mark, established by the Federal Communications Commission with rules effective August 29, 2024, creates a voluntary cybersecurity labelling programme for wireless consumer IoT products. Eligible products include internet-connected home security cameras, voice-activated shopping devices, smart appliances, fitness trackers, garage door openers, and baby monitors. Products meeting technical requirements based on NIST Report 8425 can display the Cyber Trust Mark label with an accompanying QR code that consumers scan to access security information about the specific product. According to one survey, 37% of US households consider Matter certification either important or critical to purchase decisions, suggesting consumer appetite for security labels if awareness increases.

Matter represents a complementary approach focused on interoperability rather than security, though the two concerns intersect. Developed by the Connectivity Standards Alliance (founded by Amazon, Apple, Google, and the Zigbee Alliance), Matter provides a technical standard for smart home and IoT devices ensuring compatibility across different manufacturers. Version 1.4, released in November 2024, expanded support to batteries, solar systems, home routers, water heaters, and heat pumps. The alliance's Product Security Working Group introduced an IoT Device Security Specification in 2023 based on ETSI EN 303 645 and NIST IR 8425, with products launching in 2024 able to display a Verified Mark demonstrating security compliance.

A Practical Framework for Evaluating Devices Before Purchase

Given the complexity of security considerations and opacity of manufacturer practices, consumers need a systematic framework for evaluation before bringing AI-powered devices into their homes.

Authentication mechanisms should be your first checkpoint. Does the device support multi-factor authentication? Will it force you to change default passwords during setup? These basic requirements separate minimally secure devices from fundamentally vulnerable ones. Reject products that don't support MFA for accounts controlling security cameras, smart locks, or voice assistants with purchasing capabilities.

Encryption standards determine data protection during transmission and storage. Look for devices supporting end-to-end encryption, particularly for cameras and audio devices capturing intimate moments. Products using Transport Layer Security (TLS) for network communication and AES encryption for stored data meet baseline requirements. Be suspicious of devices that don't clearly document encryption standards.

Update commitments reveal manufacturer intentions for long-term security support. Look for manufacturers promising at least three years of security updates, ideally longer. Over-the-air update capability matters because manual updates depend on consumer vigilance that research shows is inconsistent. Cryptographic signing of firmware updates prevents malicious code injection during the update process.

Certification and compliance demonstrate third-party validation. As the Cyber Trust Mark programme matures, look for its label on eligible products. Matter certification indicates interoperability testing but also suggests manufacturer engagement with industry standards bodies. For European consumers, CE marking now incorporates cybersecurity requirements under the Radio Equipment Directive.

Data practices require scrutiny beyond privacy policies. What data does the device collect? Where is it stored? Who can access it? Is it used for AI training or advertising? How long is it retained? Can you delete it? Consumer advocacy organisations like Consumer Reports increasingly evaluate privacy alongside functionality in product reviews. Research whether the company has faced FTC enforcement actions or data breaches. Past behaviour predicts future practices better than policy language.

Local processing versus cloud dependence affects both privacy and resilience. Devices performing AI processing locally rather than in the cloud reduce data exposure and function during internet outages. Apple's approach with on-device Siri processing and Amazon's local voice processing for basic Alexa commands demonstrate the feasibility of edge AI for consumer devices. Evaluate whether device features genuinely require cloud connectivity or whether it serves primarily to enable data collection and vendor lock-in.

Reputation and transparency separate responsible manufacturers from problematic ones. Has the company responded constructively to security research? Do they maintain public vulnerability disclosure processes? What's their track record with previous products? Manufacturers treating security researchers as adversaries rather than allies, or those without clear channels for vulnerability reporting, signal organisational cultures that deprioritise security.

What Manufacturers Should Be Required to Demonstrate

Current regulations establish minimum baselines, but truly secure AI consumer devices require manufacturers to meet higher standards than legal compliance demands.

Security-by-design should be mandatory, not aspirational. Products must incorporate security considerations throughout development, not retrofitted after feature completion. For AI devices, this means threat modelling adversarial attacks, implementing defence mechanisms against model manipulation, and designing failure modes that preserve user safety and privacy.

Transparency in data practices must extend beyond legal minimums. Manufacturers should clearly disclose what data is collected, how it's processed, where it's stored, who can access it, how long it's retained, and what happens during model training. This information should be accessible before purchase, not buried in privacy policies accepted during setup.

Regular security audits by independent third parties should be standard practice. Independent security assessments by qualified firms provide verification that security controls function as claimed. Results should be public (with appropriate redaction of exploitable details), allowing consumers and researchers to assess device security.

Vulnerability disclosure and bug bounty programmes signal manufacturer commitment. Companies should maintain clear processes for security researchers to report vulnerabilities, with defined timelines for acknowledgment, remediation, and public disclosure. Manufacturers treating vulnerability reports as hostile acts or threatening researchers with legal action demonstrate cultures incompatible with responsible security practices.

End-of-life planning protects consumers from orphaned devices. Products must have defined support lifecycles with clear communication about end-of-support dates. When support ends, manufacturers should provide options: open-sourcing firmware to enable community maintenance, offering trade-in programmes for newer models, or implementing local-only operating modes that don't depend on discontinued cloud services.

Data minimisation should guide collection practices. Collect only data necessary for product functionality, not everything technically feasible. When Ecovacs vacuums collected audio and photos beyond navigation requirements, they violated data minimisation principles. Federated learning and differential privacy offer technical approaches that improve models without centralising sensitive data.

Human oversight of automated decisions matters for consequential choices. When AI controls physical security systems, makes purchasing decisions, or interacts with vulnerable users like children, human review becomes essential. IntelliVision's false bias claims highlighted the need for validation when AI makes decisions about people.

Practical Steps You Can Take Right Now

Understanding evaluation frameworks and manufacturer obligations provides necessary context, but consumers need actionable steps to improve security of devices already in their homes whilst making better decisions about future purchases.

Conduct an inventory audit of every connected device in your home. List each product, its manufacturer, when you purchased it, whether it has a camera or microphone, what data it collects, and whether you've changed default passwords. This inventory reveals your attack surface and identifies priorities for security improvements.

Enable multi-factor authentication immediately on every device and service that supports it. This single step provides the most significant security improvement for the least effort. Use authenticator apps like Authy, Google Authenticator, or Microsoft Authenticator rather than SMS-based codes when possible, as SMS can be intercepted through SIM swapping attacks.

Change all default passwords to strong, unique credentials managed through a password manager. Password managers like Bitwarden, 1Password, or KeePassXC generate and securely store complex passwords, removing the burden of memorisation whilst enabling unique credentials for each device and service.

Segment your network to isolate IoT devices from computers and phones. At minimum, create a guest network on your router and move all smart home devices to it. This limits blast radius if a device is compromised. For more advanced protection, investigate whether your router supports VLANs and create separate networks for trusted devices, IoT products, guests, and sensitive infrastructure. Brands like UniFi, Firewalla, and Synology offer consumer-accessible products with VLAN capability.

Review and restrict permissions for all device applications. Mobile apps controlling smart home devices often request excessive permissions beyond operational requirements. iOS and Android both allow granular permission management. Revoke location access unless genuinely necessary, limit microphone and camera access, and disable background data usage where possible.

Disable features you don't use, particularly those involving cameras, microphones, or data sharing. Many devices enable all capabilities by default to showcase features, but unused functionality creates unnecessary risk. Feature minimisation reduces attack surface and data collection.

Configure privacy settings to minimise data collection and retention. For Alexa, enable automatic deletion of recordings after three months (the shortest option). For Google, ensure recording storage is disabled. Review settings for every device to understand and minimise data retention. Where possible, opt out of data sharing for AI training, product improvement, or advertising.

Research products thoroughly before purchase using multiple sources. Consult Consumer Reports, WIRED product reviews, and specialised publications covering the device category. Search for “product name security vulnerability” and “product name FTC” to uncover past problems. Check whether manufacturers have faced enforcement actions or breaches.

Question necessity before adding new connected devices. The most secure device is one you don't buy. Does the AI feature genuinely improve your life, or is it novelty that will wear off? The security and privacy costs of connected devices are ongoing and indefinite, whilst perceived benefits often prove temporary.

The Collective Action Problem

Individual consumer actions matter, but they don't solve the structural problems in AI device security. Market dynamics create incentives for manufacturers to prioritise features and time-to-market over security and privacy. Information asymmetry favours manufacturers who control technical details and data practices. Switching costs lock consumers into ecosystems even when better alternatives emerge.

Regulatory intervention addresses market failures individual action can't solve. The PSTI Regulations banning default passwords prevent manufacturers from shipping fundamentally insecure products regardless of consumer vigilance. The Cyber Trust Mark programme provides point-of-purchase information consumers couldn't otherwise access. FTC enforcement actions penalise privacy violations and establish precedents that change manufacturer behaviour across industries.

Yet regulations lag technical evolution and typically respond to problems after they've harmed consumers. The Ring settlement came years after employee surveillance began. Verkada's penalties followed after patients in psychiatric hospitals were exposed. Enforcement is reactive, addressing yesterday's vulnerabilities whilst new risks emerge from advancing AI capabilities.

Consumer advocacy organisations play crucial roles in making security visible and understandable. Consumer Reports' privacy and security ratings influence purchase decisions and manufacturer behaviour. Research institutions publishing vulnerability discoveries push companies to remediate problems. Investigative journalists exposing data practices create accountability through public scrutiny.

Collective action through consumer rights organisations, class action litigation, and advocacy campaigns can achieve what individual purchasing decisions cannot. Ring's £5.6 million in customer refunds resulted from FTC enforcement supported by privacy advocates documenting problems over time. European data protection authorities' enforcement of GDPR against AI companies establishes precedents protecting consumers across member states.

Looking Ahead

The trajectory of AI consumer device security depends on technical evolution, regulatory development, and market dynamics that will shape options available to future consumers.

Edge AI processing continues advancing, enabling more sophisticated local computation without cloud dependence. Apple's Neural Engine and Google's Tensor chips demonstrate the feasibility of powerful on-device AI in consumer products. As this capability proliferates into smart home devices, it enables privacy-preserving functionality whilst reducing internet bandwidth and latency. Federated learning allows AI models to improve without centralising training data, addressing the tension between model performance and data minimisation.

Regulatory developments across major markets will establish floors for acceptable security practices. The EU's Cyber Resilience Act applies in 2027, creating comprehensive requirements for products with digital elements throughout their lifecycles. The UK's PSTI Regulations already establish minimum standards, with potential future expansions addressing gaps. The US Cyber Trust Mark programme's success depends on consumer awareness and manufacturer adoption, outcomes that will become clearer in 2025 and 2026.

International standards harmonisation could reduce compliance complexity whilst raising global baselines. NIST's IoT security guidance influences standards bodies worldwide. ETSI EN 303 645 is referenced in multiple regulatory frameworks. If major markets align requirements around common technical standards, manufacturers can build security into products once rather than adapting for different jurisdictions.

Consumer awareness and demand for security remains the crucial variable. If consumers prioritise security alongside features and price, manufacturers respond by improving products and marketing security capabilities. The Deloitte finding that consumers trusting providers spent 50% more on connected devices suggests economic incentives exist for manufacturers who earn trust through demonstrated security and privacy practices.

Security as Shared Responsibility

Evaluating security risks of AI-powered consumer products requires technical knowledge most consumers lack, time most can't spare, and access to information manufacturers often don't provide. The solutions outlined here impose costs on individuals trying to protect themselves whilst structural problems persist.

This isn't sustainable. Meaningful security for AI consumer devices requires manufacturers to build secure products, regulators to establish and enforce meaningful standards, and market mechanisms to reward security rather than treat it as cost to minimise. Individual consumers can and should take protective steps, but these actions supplement rather than substitute for systemic changes.

The Ring employees who accessed customers' bedroom camera footage, the Verkada breach exposing psychiatric patients, the Ecovacs vacuums collecting audio and photos without clear consent, and the myriad other incidents documented in FTC enforcement actions reveal fundamental problems in how AI consumer devices are designed, marketed, and supported. These aren't isolated failures or rare edge cases. They represent predictable outcomes when security and privacy are subordinated to rapid product development and data-hungry business models.

Before AI-powered devices enter your home, manufacturers should demonstrate: security-by-design throughout development; meaningful transparency about data collection and usage; regular independent security audits with public results; clear vulnerability disclosure processes and bug bounty programmes; incident response capabilities and breach notification procedures; defined product support lifecycles with end-of-life planning; data minimisation and federated learning where possible; and human oversight of consequential automated decisions.

These aren't unreasonable requirements. They're baseline expectations for products with cameras watching your children, microphones listening to conversations, and processors learning your routines. The standards emerging through legislation like PSTI and the Cyber Resilience Act, voluntary programmes like the Cyber Trust Mark, and enforcement actions by the FTC begin establishing these expectations as legal and market requirements rather than aspirational goals.

As consumers, we evaluate security risks using available information whilst pushing for better. We enable MFA, segment networks, change default passwords, and research products before purchase. We support regulations establishing minimum standards and enforcement actions holding manufacturers accountable. We choose products from manufacturers demonstrating commitment to security through past actions, not just marketing claims.

But fundamentally, we should demand that AI consumer devices be secure by default, not through expert-level configuration by individual consumers. The smart home shouldn't require becoming a cybersecurity specialist to safely inhabit. Until manufacturers meet that standard, the devices promising to simplify our lives simultaneously require constant vigilance to prevent them from compromising our security, privacy, and safety.

---

Sources and References

Federal Trade Commission. (2023). “FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras.” Retrieved from ftc.gov

Federal Trade Commission. (2024). “FTC Takes Action Against Security Camera Firm Verkada over Charges it Failed to Secure Videos, Other Personal Data and Violated CAN-SPAM Act.” Retrieved from ftc.gov

Federal Trade Commission. (2024). “FTC Takes Action Against IntelliVision Technologies for Deceptive Claims About its Facial Recognition Software.” Retrieved from ftc.gov

SonicWall. (2024). “Cyber Threat Report 2024.” Retrieved from sonicwall.com

Deloitte. (2024). “2024 Connected Consumer Survey: Increasing Consumer Privacy and Security Concerns in the Generative Age.” Retrieved from deloitte.com

Pew Research Center. “Consumer Perspectives of Privacy and Artificial Intelligence.” Retrieved from pewresearch.org

University of Illinois Urbana-Champaign. (2024). “GPT-4 Can Exploit Real-Life Security Flaws.” Retrieved from illinois.edu

Google Threat Intelligence Group. (2024). “Adversarial Misuse of Generative AI.” Retrieved from cloud.google.com

National Institute of Standards and Technology. “NIST Cybersecurity for IoT Program.” Retrieved from nist.gov

National Institute of Standards and Technology. “NISTIR 8259A: IoT Device Cybersecurity Capability Core Baseline.” Retrieved from nist.gov

National Institute of Standards and Technology. “Profile of the IoT Core Baseline for Consumer IoT Products (NIST IR 8425).” Retrieved from nist.gov

UK Government. (2023). “The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.” Retrieved from legislation.gov.uk

European Union. “Radio Equipment Directive (RED) Cybersecurity Requirements.” Retrieved from ec.europa.eu

European Parliament. (2024). “Cyber Resilience Act.” Retrieved from europarl.europa.eu

Federal Communications Commission. (2024). “U.S. Cyber Trust Mark.” Retrieved from fcc.gov

Connectivity Standards Alliance. “Matter Standard Specifications.” Retrieved from csa-iot.org

Consumer Reports. “Ring Expands End-to-End Encryption to More Cameras, Doorbells, and Users.” Retrieved from consumerreports.org

Consumer Reports. “Is Your Robotic Vacuum Sharing Data About You?” Retrieved from consumerreports.org

Tenable Research. (2025). “The Trifecta: How Three New Gemini Vulnerabilities Allowed Private Data Exfiltration.” Retrieved from tenable.com

NC State News. (2025). “Hardware Vulnerability Allows Attackers to Hack AI Training Data (GATEBLEED).” Retrieved from news.ncsu.edu

DEF CON. (2024). “Ecovacs Deebot Security Research Presentation.” Retrieved from defcon.org

MIT Technology Review. (2022). “A Roomba Recorded a Woman on the Toilet. How Did Screenshots End Up on Facebook?” Retrieved from technologyreview.com

Ubuntu. “Consumer IoT Device Update Survey.” Retrieved from ubuntu.com

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Discuss...