LC-3 · Consumer Risk Bulletins

LrrK Kinematic Consumer Risk Bulletin

# LrrK Kinematic Consumer Risk Bulletin

**LRRK Watch / Open-Source Intelligence** — Signals across consumer systems that sense, move, and act in homes and yards.

**Issue type.** Monthly filing.

| Field | Value |
| --- | --- |
| Window | 1–31 October 2009 |
| Collection cutoff | 31 October 2009 |
| Platform | Quiet Systems |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Image rights require separate verification before publication. |
| Scope | Consumer kinematic electronics only (home, yard, companion, educational). |
| Classes in frame | Robot vacuums / mop combos · robotic lawn mowers · window-cleaning robots · pool-cleaning robots · robot pets / companion animals · social / desk companions · educational / programmable kits · robotic litter boxes · security / home patrol robots · consumer robotic arms · elder-care / assistive companions · kitchen / food-prep robots · toy / entertainment robots · niche outdoor / garden robots · emerging general-purpose or humanoid home robots |
| Spine | CPSC, Health Canada, EU RAPEX (2009 name; later Safety Gate), UK, manufacturer recall pages, named newsrooms, dockets. |
| Color | Message boards, consumer forums, and Reddit — annotated context only. Never Fact without a reputable primary. |

## Executive read

### BLUF

October’s consumer kinematic file is a trust path, not an injury path. University of Washington researchers present, then named newsrooms date, a UbiComp paper on three already-shipping home robots — WowWee Rovio, Erector Spykee, and WowWee RoboSapien V2 — whose cameras and microphones do not protect the room. No official recall. No CPSC, Health Canada, or RAPEX page. No official injury count.

### Key judgments

1. **[Assessment — High confidence]** On 2 October 2009 Denning, Matuszek, Koscher, Smith, and Kohno present “A Spotlight on Security and Privacy Risks with Future Household Robots” in UbiComp 2009 Session 4 (Orlando; conference 30 September–3 October). ACM dates the proceedings paper 30 September. UW News, MIT Technology Review, and an IDG piece reprinted by the New York Times all date 8 October.
2. **[Assessment — High confidence]** This is not a recall, not a shipping-injury file, and not a regulator page. The trust change is a family- and child-facing camera/mic robot already in some homes whose audio-visual streams and login secrets the authors and newsrooms describe as unprotected.
3. **[Assessment — High confidence]** No October CPSC Roomba, Scooba, robotic-mower, or companion-robot numbered page was located. Roomba 500 remains the live US robot-vac class and is background in the paper, not a test subject.

### Analytic labels
- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades
- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution (typical for forums)

---

## 01. UW / UbiComp — Rovio, Spykee, and RoboSapien V2 as mobile cameras without a privacy control fabric

*Event / publication dates: 2 October 2009 (UbiComp 2009 Session 4 — Security & Access, Orlando); 8 October 2009 (UW News; MIT Technology Review; IDG / New York Times reprint)*

**Product class.** Security / home patrol robots · toy / entertainment robots

**Verified record — [Fact — A1 / B1]** On 2 October 2009 Tamara Denning, Cynthia Matuszek, Karl Koscher, Joshua R. Smith, and Tadayoshi Kohno (University of Washington) presented “A Spotlight on Security and Privacy Risks with Future Household Robots” at the 11th International Conference on Ubiquitous Computing, Orlando. Conference window: 30 September–3 October 2009. ACM dates the proceedings paper 30 September 2009 ([doi:10.1145/1620545.1620564](https://doi.org/10.1145/1620545.1620564); author PDF at [cs.washington.edu](https://homes.cs.washington.edu/~yoshi/papers/robots/ubicomp09_robots.pdf)). Units under test were purchased in October 2008, plus one RoboSapien V2 obtained before December 2006.

Three consumer SKUs, as the paper writes them: **WowWee Rovio** — late-2008 Wi-Fi mobile webcam marketed to adults for home surveillance and telepresence; camera, microphone, speaker; web control, including over the Internet when the owner so configures it; advertised about US $349.99; default account not password-protected. **Erector / Meccano Spykee** — late-2008 Wi-Fi “spy” toy; camera, microphone, speaker; child-facing marketing; advertised about US $299.99. **WowWee RoboSapien V2** — 2005 infrared-remote toy with an embedded color camera used for object tracking; about US $250; the original RoboSapien is cited as 1.5 million units in its first five months (paper, citing secondary). The authors call some findings “quite serious, such as the possibility of an attacker compromising a Rovio or a Spykee and leveraging the built-in video camera to spy on a child in her bedroom.”

Named-newsroom copy, all 8 October 2009: UW News — robots’ audio and video streams “can be intercepted on the home’s wireless network or in some cases captured over the Internet”; only some robots give an audible or other alert when a user logs on; researchers recommend turning on home-network encryption and disabling Internet access to the robot’s controls. [UW News](https://www.washington.edu/news/2009/10/08/household-robots-do-not-protect-users-security-and-privacy-researchers-say/). MIT Technology Review (Kristina Grifantini) independently dates unencrypted audio-visual streams, unencrypted usernames and passwords, and remote takeover, and quotes the researchers’ site line that someone might “drive your robot around your home, look around the house, listen in on conversations, and knock over small objects.” [MIT Technology Review](https://www.technologyreview.com/2009/10/08/209503/home-robots-may-be-the-next-target-for-hackers/). IDG, reprinted the same day by the New York Times: Kohno — “We were shocked at how easy it was to actually compromise some of these robots”; Denning — consumers should know someone could “listen in on their robot and take over their robot and have mobile eyes and ears in their home.” [NYT / IDG](https://archive.nytimes.com/www.nytimes.com/external/idg/2009/10/08/08idg-how-dangerous-could-a-hacked-robot-possibly-be-72478.html).

No CPSC, Health Canada, or RAPEX page. No official injury or incident count is stated. The work is a lab analysis of purchased units, not a regulator census.

**Threat landscape.** Kinematic objects that see and hear the room, including a child-marketed “spy” toy and an adult-marketed home-surveillance bot that can stay live on the dock. Physical harm is not alleged by a regulator. Trust boundaries: unprotected audio-visual streams; login secrets that newsrooms describe as sent without encryption; remote drive when the owner has enabled Internet reach; missing or weak cues that someone new is watching.

**Forum / community notes.**
- none found.

**Intelligence assessment.** [Assessment — High confidence] The 2 October session date, the three SKUs, the camera/microphone claims, and the unprotected-stream finding are as the ACM paper and the 8 October named newsrooms write them. [Inference — Moderate confidence] Child-bedroom camera language plus a family-room surveillance SKU is the 2009 companion/patrol trust path (continuity and perception), not a laceration or fire path. [Uncertainty] How many Rovio or Spykee units were actually in homes, and whether WowWee or Erector issued a dated security notice in this window, are unpublished in the opened copy. [Uncertainty] Internet reach depends on owner configuration; the paper does not treat every unit as remotely exposed by default.

**Opportunity.** A dated manufacturer security notice, a default-credential lock, and an actual CPSC / RAPEX / Health Canada file (none found).

**LRRK relevance.** Control Fabric (Wi-Fi identity of a moving camera). Passport: camera + child-facing toy as a trust SKU. Watch: any official Rovio / Spykee / RoboSapien action (none this window).

**Confidence.** High on the 2 October presentation, the 8 October newsroom date, the three product names, and the camera/mic intercept finding as published. Moderate on how often units were configured for Internet reach. Low on in-home inventory and on whether any household was actually watched.

---

## Forward indicators

1. Any WowWee or Erector manufacturer security notice that actually closes the published camera path.
2. Any CPSC / Health Canada / RAPEX Rovio, Spykee, robot-vac, or robotic-mower file.
3. Any official iRobot Roomba recall (500-class remains the live US SKU; none found through this cutoff).
4. Any RAPEX robotic-mower blade or sensor alert.
5. Any companion / toy-robot official action.

> **Collection integrity.** One signal graduated. **Excluded:** Roomba 500 as a test subject (paper background only; no official Roomba recall). No October CPSC robot-vac or robotic-mower numbered page. No RAPEX robotic-mower weekly report in this window. Forum empty.


*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C3</span></p>