Google's Purchase of Nest and the Rise of "Smart" Devices

The BBC and New York Times report that Google plans to purchase Nest Labs for $3.2 billion. The BBC describes Nest's primary product as "a thermostat capable of learning user behaviour and working out whether a building is occupied or not, using temperature, humidity, activity and light sensors."

The New York Times elaborates:

Rather than thermostats, Nest’s key technologies were described by [Chief Executive, Tony] Fadell in an interview last November as “communications, algorithms, sensors and user experience, running over a network to the cloud.” 

That is, Nest is interested in how people behave inside their houses; the thermostat was just the first step to understanding that. Its sensors gave information about interactions; after that, algorithms on everything from user preferences to battery power were deployed to give people a sense of control they had not had before. As Mr. Fadell put it at the time, “we’re focused on experience.”

When I heard about Google's plan to purchase Nest, I was reminded of Peter Bright's op-ed at Ars Technica a few days ago. That op-ed began:

If you believe what the likes of LG and Samsung have been promoting this week at CES, everything will soon be smart. We'll be able to send messages to our washing machines, run apps on our fridges, and have TVs as powerful as computers.

Bloomberg Businessweek covers some of the notable devices on display at the Consumer Electronics Show (CES) here. Technology companies seem to be moving in a direction where every device is a "smart" device that can connect to the internet. But Bright goes on to argue that these developments spell trouble for users' privacy.

The result is a whole lot of exposure to security problems. Even if we assume that these devices ship with no known flaws—a questionable assumption in and of itself if SOHO routers are anything to judge by—a few months or years down the line, that will no longer be the case. Flaws and insecurities will be uncovered, and the software components of these smart devices will need to be updated to address those problems. They'll need these updates for the lifetime of the device, too. Old software is routinely vulnerable to newly discovered flaws, so there's no point in any reasonable timeframe at which it's OK to stop updating the software.

. . .

Herein lies the problem, because if there's one thing that companies like Samsung have demonstrated in the past, it's a total unwillingness to provide a lifetime of software fixes and updates. Even smartphones, which are generally assumed to have a two-year lifecycle (with replacements driven by cheap or "free" contract-subsidized pricing), rarely receive updates for the full two years (Apple's iPhone being the one notable exception).

The trend towards "smart homes" at CES, and Google's purchase of Nest, indicates that internet connections will likely permeate people's lives beyond their computers, smartphones, and (in some cases) televisions. Nest's technology gathers information about building interiors and users' behaviors in an effort to provide more effective heating and cooling of buildings, among other services. While it is currently unclear how much, if any, of Nest's information will be shared with Google, it would not be surprising if this information ends up being shared. In the very least, Nest will likely take advantage of Google's cloud computing technology in bolstering its own products' capabilities.

Combining Nest's information-gathering technology with Google's cloud computing technology would mean that even more personal information will be uploaded to the internet (beyond the content users enter into browsers, emails, and other online services). As Bright points out, this information will probably be poorly-secured, and will therefore be an easy target for theft.

Beyond concerns about theft of personal information, the Google-Nest deal signals a trend that may have interesting Fourth Amendment implications. In Kyllo v. United States, the Supreme Court held that when police used a thermal imaging device on a house to spot heat radiating from marijuana grow-lights, this was a search under the Fourth Amendment. The technology the police used was not in general public use, and it revealed intimate details about the interior of the home. The Court held that when "the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a 'search' and is presumptively unreasonable without a warrant."

Will the logic of Kyllo apply in a world of Nest thermostats and smart appliances? In this world, people will constantly be uploading details of their home life to the cloud so that their appliances and homes work at maximum effectiveness. In the near future, it may be much harder to label as "intimate" the myriad details of the home that are shared with Google and other technology companies.