How tech companies deceive you into giving up your data and privacy

Do you remember when you were a child,

you probably had a favorite toy
that was a constant companion,

like Christopher Robin
had Winnie the Pooh,

and your imagination
fueled endless adventures?

What could be more innocent than that?

Well, let me introduce you
to my friend Cayla.

Cayla was voted toy of the year
in countries around the world.

She connects to the internet
and uses speech recognition technology

to answer your child's questions,

respond just like a friend.

But the power doesn't lie
with your child's imagination.

It actually lies with the company
harvesting masses of personal information

while your family is innocently
chatting away in the safety of their home,

a dangerously false sense of security.

This case sounded alarm bells for me,

as it is my job to protect
consumers' rights in my country.

And with billions of devices such as cars,

energy meters, and even vacuum cleaners
expected to come online by 2020,

we thought this was a case
worth investigating further,

because what was Cayla doing

with all the interesting things
she was learning?

Did she have another friend she was
loyal to and shared her information with?

Yes, you guessed right. She did.

In order to play with Cayla,

you need to download an app
to access all her features.

Parents must consent to the terms
being changed without notice.

The recordings of the child,
her friends and family,

can be used for targeted advertising.

And all this information can be shared
with unnamed third parties.

Enough? Not quite.

Anyone with a smartphone
can connect to Cayla

within a certain distance.

When we confronted the company
that made and programmed Cayla,

they issued a series of statements

that one had to be an IT expert
in order to breach the security.

Shall we fact-check that statement
and livehack Cayla together?

Here she is.

Cayla is equipped with a bluetooth device

which can transmit up to 60 feet,

a bit less if there's a wall between.

That means I, or any stranger,
can connect to the doll

while being outside the room
where Cayla and her friends are,

and to illustrate this,

I'm going to turn Cayla on now.

Let's see, one, two, three.

There. She's on. And I'll ask a colleague

to stand outside with his smartphone,

and he's connected,

and to make this a bit creepier

(Laughter)

let's see what kids could hear Cayla say
in the safety of their room.

Man: Hi. My name is Cayla. What is yours?

Finn Myrstad: Uh, Finn.

Man: Is your mom close by?

FM: Uh, no, she's in the store.

Man: Ah. Do you want
to come out and play with me.

FM: That's a great idea.

Man: Ah. Great.

FM: I'm going to turn Cayla off now.

(Laughter)

We needed no password

or to circumvent any other
type of security to do this.

We published a report
in 20 countries around the world,

exposing this significant security flaw

and many other problematic issues.

So what happened?

Cayla was banned in Germany,

taken off the shelves
by Amazon and Wal-Mart,

and she's now peacefully resting

at the German Spy Museum in Berlin.

(Laughter)

However, Cayla was also for sale
in stores around the world

for more than a year
after we published our report.

What we uncovered is that there
are few rules to protect us,

and the ones we have
are not being properly enforced.

We need to get the security
and privacy of these devices right

before they enter the market,

because what is the point
of locking a house with the key

if anyone can enter it
through a connected device?

You may well think,
"This will not happen to me.

I will just stay away
from these flawed devices."

But that won't keep you safe,

because simply by
connecting to the internet,

you are put in an impossible
take-it-or-leave-it position.

Let me show you.

Like most of you, I have
dozens of apps on my phone,

and used properly,
they can make our lives easier,

more convenient,
and maybe even healthier.

But have we been lulled
into a false sense of security?

It starts simply by ticking a box.

Yes, we say,

I've read the terms.

But have you really read the terms?

Are you sure they didn't look too long,

and your phone was running out of battery,

and the last time you tried
they were impossible to understand,

and you needed to use the service now?

And now, the power
imbalance is established,

because we have agreed
to our personal information

being gathered and used on a scale
we could never imagine.

This is why my colleagues and I decided
to take a deeper look at this.

We set out to read the terms

of popular apps on an average phone,

and to show the world
how unrealistic it is

to expect consumers
to actually read the terms,

we printed them,

more than 900 pages,

and sat down in our office
and read them out loud ourselves,

streaming the experiment
live on our websites.

As you can see, it took quite a long time.

It took us 31 hours,
49 minutes, and 11 seconds

to read the terms on an average phone.

That is longer than a movie marathon
of the Harry Potter movies

and the Godfather movies combined.

(Laughter)

And reading is one thing.

Understanding is another story.

That would have taken us
much, much longer.

And this is a real problem,
because companies have argued

for 20 to 30 years against
regulating the internet better,

because users have consented
to the terms and conditions.

As we've shown with this experiment,

achieving informed consent
is close to impossible.

Do you think it's fair to put the burden
of responsibility on the consumer?

I don't.

I think we should demand
less take-it-or-leave-it

and more understandable terms
before we agree to them.

(Applause)

Thank you.

Now, I would like to tell you
a story about love.

Some of the world's most
popular apps are dating apps,

an industry now worth more than,
or close to, three billion dollars a year.

And of course, we're okay
sharing our intimate details

with our other half.

But who else is snooping,

saving, and sharing our information

while we are baring our souls?

My team and I decided to investigate this,

and in order to understand
the issue from all angles

and to truly do a thorough job,

I realized I had to download

one of the world's
most popular dating apps myself.

So I went home to my wife

(Laughter)

who I had just married.

"Is it OK if I establish a profile
on a very popular dating app

for purely scientific purposes?"

This is what we found.

Hidden behind the main menu
was a pre-ticked box

that gave the dating company access
to all my personal pictures on Facebook,

in my case more than 2,000 of them,

and some were quite personal.

And to make matters worse,

when we read the terms and conditions,

we discovered the following,

and I'm going to need to take out
my reading glasses for this one.

And I'm going to read it for you,
because this is complicated.

All right.