Policing the smart home: The internet of things as ‘invisible witnesses’¹

2.1Smart homes, invisibility and domestication

Smart homes involve domestic IoT devices and services linked together for ‘forms of communication between people and things and among things’ (Bhat et al., 2017, p. 917). As Urquhart, Lodge and Crabtree (2019) state, ‘the promise of the IoT is greater convenience, security, safety, efficiency and comfort in a user’s everyday life’ (p. 2). IoT devices provide users with contextually appropriate services by collecting data through sensors in the environment, then analysing data to make inferences about occupant behaviour and routines over time. For example, smart fridges and fitness trackers aim to encourage healthier lifestyles by monitoring consumption and activity to prompt better choices. Unpacking contemporary domestication of IoT into everyday life requires us to briefly consider the history of IoT design and the earlier commitment to a vision of ‘invisibility in use’. Back in the early 1990’s, Marc Weiser’s ubiquitous computing was a key vision of post desktop computing where systems are all around us and “weave themselves into the fabric of everyday life until they are indistinguishable from it” (Weiser, 1990, p. 94). He inspired others to develop technical infrastructures necessary to realise his vision, such as building ‘seamless networking’ (i.e., networks that provide constant connectivity) and ‘ambient, calm user interfaces’ (i.e., ones that are there when needed, but in the background when not). The concept of Ubicomp evolved and new labels emerged, such as pervasive computing (Satyanarayanan, 2001), calm computing (Weiser & Seeley Brown, 1996), ambient intelligence (Aarts & Marzano, 2003), context aware computing (Abowd et al., 1998), and now the Internet of Things (Ashton, 1999). Ultimately, these visions were underpinned by a recurring theme, that of computers ‘disappearing’ (European Commission/NSF, 2004), becoming ‘invisible’ (Weiser, 1994) and becoming ‘unremarkable in use’ (Tolmie et al., 2002).

Whilst technical work had a particular framing of ‘invisibility’, socio-technical researchers recognised more profound societal shifts beyond clever interface design and networking. Drawing on work of Garfinkel (1967) and Sacks (1992), ethnomethodology researchers understood that embedding technologies into everyday life, to design them to be truly invisible and disappear, required a focus on mundane social practices and the ongoing work of accomplishing technologically mediated routines (Bell & Dourish, 2006; Suchman, 1987; Crabtree et al., 2012). Similarly, communications and surveillance studies scholars recognised the links between domestication of technology and everyday life. Silverstone et al. (1989) suggest domestication of technology happens when a user is able to ‘incorporate and control technological artefacts into [their] own technological culture’ and ‘to render them more or less ‘invisible’ within [their] daily routines’ (p. 24). Similarly, Lyon has argued, “computing machinery is embedded, more or less invisibly, in the environments of everyday life” (Lyon, 2018, p. 51). Importantly, domestication of technology is not a linear process which stops – instead it is a process where needs, practices, and the environment change with time (Sorensen 1994).

Within smart homes, complex social relations, hierarchies, domestic politics, and power asymmetries are also key to understanding the role of IoT in everyday life (Crabtree & Rodden, 2004). When domesticated and working as intended, these systems are largely invisible to users, making them a form of ‘invisible witness’. Smart home user studies highlight how the initial novelty of interfaces like smart thermostats become ‘mundane’ once these systems integrate into the users’ life and work (Yang & Newman, 2013). For example, Pridmore et al. (2019) studied implications of intelligent personal assistants (i.e., smart speakers) in 17 focus groups in the US and Netherlands and observed participant concerns about how speakers are ‘designed to learn from users’ everyday routines and behaviours and integrate into the smart home environment’ (p. 4). For Dutch participants, informational harms were a concern, such as with the ability to monitor behaviours that occur daily and the scope for eavesdropping by external people. For US participants, physical security implications were a greater concern e.g., entering a home due to smart locks being hacked.

We now turn to some examples of recent high-profile news stories to demonstrate how police are using domestic IoT data in criminal investigations.22 This is not exhaustive but instead provides illustrative examples reported in the press in the USA, UK, Germany, and Greece. This shows the range of devices and the variety of activities they have been used to make inferences about.

2.2Recent examples of police use of IoT

2.3IoT traces and digital forensics

Traditionally, crime scene examination requires application of different forensic techniques to enable the recognition, collection, and preservation of physical evidence. Succinctly viewed as ‘every contact leaves a trace’, Locard’s (1928) Exchange Principle has long described the process of collection and interpretation of physical evidence e.g. fingerprints left at the crime scene. This principle assumes any contact and interaction between the victim, suspect, and crime scene involves an exchange of material (Locard, 1928). These different physical traces are commonly portrayed as ‘silent witnesses’ (Kirk, 1974, p. 2) at the crime scene.

This narrative of ‘exchange’ and ‘witnesses’ translates to digital forensics too (Reedy, 2021, p. 139; Zatyko & Bay, 2014). For example, Akinbi and Berry (2020, p. 271) state that apps integrated with Google Assistant can be a “silent witness to a crime” and facilitate a criminal investigation. IoT devices enable traces of offline activities from the physical environment they operate in. This could include inferences about device and user location (via GPS, MAC Address or cell data), frequency of user movements (via accelerometers, cameras, or movement sensors) and duration and type of physical activities (via use logs, data consumption, timestamps of pings between devices and routers/servers). Christenson, Oleson and Sørrenson (2021) discuss the importance of IoT devices enabling markers of ‘normal behaviour’, and being able to establish deviations from normality i.e., “each sensor serves not only to facilitate the little things that they help us with; it serves first and foremost to help the companies behind the devices infer what constitutes normal, routine activities in our homes” (p. 242). For police investigations, deviations from routine activities can help to construct case narratives e.g., use of excess volumes of water consumed in the middle of the night in the Amazon Echo murder case.

Digital forensics are playing an increasingly important role in investigations (House of Lords, 2019 as cited in Muir & Walcott, 2021). For example, in September 2020 the Director of Public Prosecutions in England and Wales stated smart home devices, such as smart doorbells, Alexa and Siri have provided valuable evidence.1616 However, despite the growing role of digital forensics labs analysing IoT devices and metadata (Casey et al., 2013; Wilson-Kovacs, 2020), the UK lacks a “standard national competency framework for digital forensic skills” and it needs greater consistency amongst police forces (Wilson-Kovacs et al., 2021). Concerningly, a recent small-scale study indicated that digital forensics can be prone to bias and the reliability of the observations, interpretations and conclusions of examiners can be low (Sunde & Dror, 2021). Given the centrality of inferences for interpreting IoT traces, this demonstrates the need to develop capacity in digital forensics for IoT. The policy landscape is changing here, and in response to criticism from the UK Information Commissioner Office on police compliance with the UK Data Protection Act 2018 when extracting data from mobile devices,1717 the UK College of Policing has recently released guidance on how to extract data from a range of digital devices and sets standards on best, legally compliant practices.1818

To support development of better practices around digital forensics with IoT trace data, we now reflect on some priority areas to be considered:

Comprehensiveness of data: Digital traces that can be uncovered from smart home IoT devices are often not comprehensive. These traces tell a partial story due to the nature of sensors focused on specific applications e.g., microphones only collecting voice data from smart speakers. As with traditional devices, users can delete data or can otherwise try to make them impossible to read or recover, such as by physically damaging a drive, (Battula et al., 2009). Users also can take privacy-conscious decisions due to the perceived intrusiveness of smart home devices and, for instance, physically block the view of cameras (Chalhoub et al., 2021). Data can be lost due to accidental events too, such as powering down a smart television (Sutherland et al., 2014).

Reliability of data: Data gathered throughout the digital forensics’ procedure requires thorough checks for reliability. For instance, using Global Navigation Satellite System (GNSS) data logs as evidence can face vulnerabilities due to signal blockage, errors, deliberate jamming of the receiver, spoofing of the signal, tampering with the device in case of on-board data storage and falsifying positions when data is stored elsewhere (Dempers, 2018).

Volume of data: The relative decrease in cost of data storage has led to more digital traces to manage and investigate. This creates challenges such as increasing time to sift, analyse and interpret data within investigations (Rogers, 2015). The increase in data volume may impact effective use in investigations due to limitations in technical capabilities to handle IoT traces (Rappert et al., 2020). The result-oriented and time-sensitive nature of forensic investigations generates demand for new tools to enhance efficiency, such as automating certain phases (Casey et al., 2013).

Interpretation of data: The interpretation of digital evidence may require tying activity to the account holder, a common issue in digital forensics. Given IoT in smart homes may be in communal spaces shared by householders, the account holder may not be the (only) user of the device, unlike with a smartphone which is more often personal. So, if an IoT device has the account holder signed in, supporting evidence may be needed to increase certainty that activity links to that account holder (Rogers, 2015). For example, location data from mobile phones can be used to determine whether the device was in the home or not, with rough estimates of locations based on GSM signals being possible since 1996 (Drane et al., 1998). But finding the presence of a picture or a GPS coordinate may not be enough to do this and instead, multiple traces need to be examined (Kaart & Laraghy, 2014). Combined with other types of data, such as online browsing activity and biometric data, location data can pinpoint if a particular user of the device was at home. Further, Kim et al. (2020) have shown that smart home devices contain data regarding other online activities including phone calls, TV viewing behaviour, use of certain applications alongside recording digital traces of offline actions. This includes whether a person was moving around, if they entered or left the home or whether they engaged in a particular activity at the time, for example through data from sensors or voice commands. Such data helps link activity on a shared device to a particular user, creating the necessary link before it can be used to support police investigations.

Tampering with data: As with traditional evidence, it is possible to tamper with and falsify digital evidence too, with a plethora of tools and techniques enabling users to remove digital traces or prevent their creation. These include encryption, secure methods of data deletion, the removal of operating system artefacts, the removal of traces of online activities (Lees, 2013), deleting frames in video recordings (Shanableh, 2013) and faking timestamps (Cho, 2013). It is also possible to fake certain type of biometric data, such as face ID (Cho & Jeong, 2017) or fingerprints for the purposes of unlocking a smart phone (Bontrager et al., 2018; Tait, 2021). Some other technological challenges include maintaining the chain of custody as devices usually ‘actively intercommunicate among themselves including the cloud servers’ when they are seized (Janarthanan et al., 2021, p. 232). Solutions might include the use of digital forensic readiness frameworks for smart homes to enable evidence gathering e.g. as exist for cases of cybercrime attacks (Philomin et al., 2020).

Narrative Building from Data. In using IoT trace data, novel risks arise for police narrative building. For example, partial data might be ‘interrogated’ and interpreted to make inferences that help to confirm a specific hypothesis leading to confirmation bias (Innes, 2007; O’Brien, 2009). Traces might help to find a link between an individual and the crime scene, resulting in a ‘suspect-centred approach’ where personal bias and tunnel vision of investigators might skew judgment (Tung & Bowling, 2006). This is particularly problematic if this leads to prioritisation and targeting of wrong individuals (Innes, 2007). IoT data needs to be contextualised to make sense of what human activity is being inferred. This is a shift from traditional forensics, where it goes beyond the presence of a piece of trace evidence (e.g., a fingerprint present at a scene) to help construct a narrative (e.g., the perpetrator was present at this location). Instead, with IoT traces, there is need to construct what the data shows in the first place e.g., high levels of water usage at an unusual time of day on a water meter – is this a leak? Or evidence of a crime scene being washed down?

Legal Implications. Whilst this paper does not focus in depth on the legal issues of IoT digital forensics, there are some key challenges to note. IoT raises cross border policing issues for accessing remote cloud servers for evidence acquisition (Wall, 2017; Walden, 2013). It also highlights reliance on state-industry cooperation e.g., as seen with Amazon or Apple resisting court orders to hand over data.1919 International legislative initiatives are changing the landscape here, for example, with the recently negotiated Second Protocol to the Council of Europe Cybercrime Convention which adds new rules for law enforcement access to cloud data and cross border cooperation. There are growing trends in edge and fog computing to manage latency, privacy and storage issues of current IoT, which means next generation IoT devices are less reliant on the centralised cloud and instead store data (and even perform analytics) locally (Satyanarayanan, 2017). This could change how evidence is acquired, where more data might be on device, rather than being split in the cloud and device. There are also evidentiary questions around admissibility of IoT data following investigations, and how intrusions by police into private and family life by seizing hybrid digital/physical IoT devices might be justified (or not) under human rights law and police procedure rules.

Key Point 1. Invisible in use

The first key point is that smart devices are embedded in settings where our interactions and everyday life occur (Lyon, 2018). Traces of such interactions are captured and made visible by devices which are designed to be invisible (Tolmie et al., 2002; Weiser, 1994). They are embedded in settings where our interactions and everyday life occur (Lyon, 2018), but they are designed to be unseen. Acting as ‘invisible witnesses’, they not only capture mundane practices and routines, but also observe and enable control dynamics and power asymmetries in the domestic setting (Crabtree & Rodden, 2004).