Privacy and Surveillance: How Generation Z and Millennials See the Internet of Things

Imagine not being able to escape online surveillance. The Internet of Things (IoT) is composed of technology that optimize our lives and is deployed in the thousands. However, the convenience these devices add to our lives comes at a cost—privacy. In 2019, China had more than 960 million IoT devices, many of them surveillance cameras, making this country a full-surveillance state.¹ This system powers a social credit program that offers privileges to citizens with good scores.² With IoT there’s no place to hide from the constant surveillance, specifically cameras, health-care devices, GPS services, home assistants, and other technology used daily to make life easier. Recently, millions of users downloaded FaceApp, putting their facial-recognition data into an unknown server controlled by a third party. Millions more willingly put IoT devices in their homes, many individuals install video doorbells outside their houses to track visitors, and many people don’t even think about the convenience of photo tollbooths, all of which record interactions and store that data. These things are all done to make our lives easier. When you think about it, the idea of a convenient, yet surveilled state under a nonauthoritarian regime isn’t such a crazy idea—it’s even appealing.

We wanted to explore people’s thoughts and attitudes about IoT by age range. From there, as a team, we discussed what that could mean for the future of privacy and surveillance. This article is the second in a two-part series on the ways that Millennials (those born between 1981 and 1996) and Generation Z (those born between 1997 and 2012) use the Internet. F5 Labs had three high school interns conduct a survey of more than 700 individuals, with participants from all over the US and the world about their digital habits, thoughts on security, and feelings toward IoT.

In part 1 of this series, we discussed some of the initial results and general trends, including demographic information, including the n value of each age cluster.³ Part 1 also discussed the results of the trends around digital habits, noting that there was less difference between the online habits of Millennials and Generation Z as the team thought there would be.

In part 2 of this series we discuss thoughts and attitudes toward IoT and how IoT may be seen differently generationally. This leads to a discussion about the possible implications for a society that could progress and value convenience over privacy.

Why We Asked the Questions We Did About IoT

Survey participants and answers collected around the questions related to IoT were the same as those mentioned in part 1 of this series. Sections of the 50-question survey were specifically designed to learn more about respondents’ attitudes and thoughts around IoT devices. A number of questions allowed for responses on a scale of 1 to 10, while others were simple yes/no or multiple-choice questions. None required a write-in answer, although some offered participants the option to add to their answer. In asking these questions, the team was interested in seeing if the difference in attitude toward IoT by age represents a conscious acceptance of the risks of using these devices or an unconscious acceptance.

What IoT Devices Do People Use?

The team asked survey participants which IoT devices they had in their homes. Respondents had the option of checking multiple items that included smart TVs, gaming consoles, wireless routers, kitchen appliances, baby monitors, WiFi cameras, security cameras, virtual assistants, DVRs, and toys. Respondents could also write in additional devices, with smart thermostats given as an example. Overall, survey participants had an average of 3.26 IoT devices in their homes. For an age breakout, see Table 1.

Table 1. Answers to the question: Number of internet of things (IoT) devices do you have in your home? (Check all that apply) 11 choices

While the average and median are similar throughout the age groups, that could be because almost everyone answered that they had some combination of a wireless router, smart TV, or gaming console. Taking a closer look at the numbers, the team postulated that respondents in the 36-plus age group had more discretionary income, thus more devices. However, it is clear that overall most participants had the same number of IoT devices, with three being the magic number.

Notably, in response to the question, “What IoT devices are in your home?” (see Figure 1), three respondents commented in the “Other” category that they did not trust any IoT devices while still noting that they had wireless routers in their homes. While many people do not typically think of routers as an IoT device, routers are some of the most vulnerable IoT appliances.⁴ As F5 Labs reported in volume 5 of the Hunt for IoT report series, and again in volume 6 part 1, IoT botnets target home routers in an effort to spy on and collect data on individuals as well as to launch DDoS attacks.

People Use IoT Devices, But Do They Trust Them?

After gathering information from participants about which devices they had in their homes, the team asked a series of questions regarding attitudes about and behaviors toward IoT devices, specifically home assistants. The questions specifically asked how comfortable participants were with IoT devices in a series of situations, grading their comfort level on a scale of 1 to 10, where 1 meant very comfortable or not bothered and 10 meant very uncomfortable or very bothered. Specifically, the series asked about feelings toward home assistants listening to but not recording, recording conversations with the device, and always recording (conversations with the device and with other people). Table 2 shows a 95% confidence level, average, and median for each group, with a standard error. Both the median and the mean appear on these tables because the average alone does not give context to the data set. The mean is particularly susceptible to influence by outliers. The confidence interval gives us a range on either side of our sample mean (+ or –) into which the population mean will fall 95% of the time, given this sample size.¹

The questions in this series included the following:

1. How comfortable are you with Alexa, Google Home, Siri, and similar programs constantly listening to your conversations but not recording them?
2. How comfortable are you with Alexa and other home devices recording the conversations you have with the device?
3. How comfortable are you with Alexa and other home devices recording the conversations you have with other people?

Table 2. Generation Z results to a series of questions about how comfortable they are with IoT devices doing different things.

Notably for Generation Z, participants felt fairly neutral about IoT devices listening but not recording their conversations. Participants in older age groups were increasingly uncomfortable with the devices even listening to their conversations but not recording. As the home assistant surveillance level increased, Generation Z had the largest differences between categories of what they would be comfortable with.

Turning to results from Millennials (see Table 3), it is notable that there is little difference in participants’ feelings toward devices listening to but not recording and devices recording conversations with the device. When taking the 95% confidence level into account, the two averages overlap considerably. When compared with Generation Z numbers, this is one of the clearest breaks between the two generations. The team hypothesizes that this could be due to the later introduction of technology into every facet of life for many Millennials, as compared with many in Generation Z.

Table 3. Millennial results to a series of questions about how comfortable they are with IoT devices doing different things.

When looking at the results for participants aged 36-plus (see Table 4), the median is an engaging metric because it does not change from 10 (highly uncomfortable). The team postulates that this could be because of a generational distrust of virtual assistants. Notably though, the percentage of participants who said they had a virtual assistant in their home is about equal throughout. Virtual assistants make up 12.29% of IoT devices Generation Z participants said they had, 12.04% of IoT devices Millennials owned, and 11.97% of IoT devices participants 36-plus had in their homes. While participants 36-plus may not be comfortable with virtual assistants, it did not seem to stop them from owning and using these devices.

Table 4. Age 36-plus results to a series of questions about how comfortable they are with IoT devices doing different things

Given the increasing levels of discomfort around IoT devices listening to and recording conversations, the team continued to ask participants if they changed the privacy settings for devices that could listen to them (had a microphone), as shown in Figure 2.

In each age group, 10% to 20% of participants said that they did not change any device settings, while the majority changed some or all of these settings. In response to a different question, 23% of Generation Z participants did not know these settings could be changed; this number declined among older age groups. While no formal correlation can be made, the team attributes this to the increased levels of education and awareness among older survey participants.

Are People Concerned About Malicious Use of IoT Devices?

Survey participants were asked a series of yes/no questions over concerns about hackers maliciously using IoT devices, for example, actors listening through their devices, watching videos through their devices, and using them to drive cyberattacks against different targets. The team did not specify who these malicious actors may be (this is further discussed in the Methodology, Constraints, Limitations, and Assumptions section) and allowed participants to define hackers however they saw fit. Abuse by malicious threat actors exploiting vulnerabilities, malicious use by corporations exploiting service level agreements (SLAs) and built-in features, or surveillance by nation-state actors are all propositions that make different people uncomfortable in different ways.

The questions asked in this series included:

1. Are you concerned about hackers watching you through video-enabled IoT devices in your home?
2. Are you concerned about hackers listening to you through audio-enabled IoT devices in your home?
3. Are you concerned about hackers launching physically destructive cyberattacks against your home appliances? (For example, someone could turn off your refrigerator remotely.)
4. Are you concerned about hackers using your home IoT devices to launch cyberattacks against other people and businesses?

Of the different questions asked, participants across all age groups were most concerned with hackers maliciously abusing cameras to watch videos or spy on them (see Figure 3). This fear could be realized due to the popularity and number of vulnerabilities related to cameras and videos. A search of the Common Vulnerabilities and Exposures (CVE) database for camera returned more than 70 results, and a search for video returned hundreds of results.¹

Overall, survey participants were most concerned with being listened to or watched by malicious actors. Closely following that, all age groups were concerned with their IoT devices being used to launch cyberattacks against other homes or businesses. This is relevant, as many IoT devices are exploited in order to form botnets and conduct DDoS attacks against specific targets. The level of concern about their own IoT devices being used to launch attacks against devices inside their own homes was substantially lower. This may be because individuals don’t see themselves as a target until something happens that affects them personally.

What Does the Future of IoT Look Like?

After considering all of this data, we wondered what this means for the future of the IoT. The data shows that education about configuration of devices isn’t widely distributed and that Generation Z more than any other generation is the most comfortable putting devices in their homes that can listen to their conversations. We wondered if the widespread adoption of devices in homes and in public areas would normalize the use of technology to track, monitor, and surveil individuals. Over time people will become more desensitized to the technology we once balked at. Is the United States going down the same path as China and creating a surveillance society? We continue to ask questions and discuss both internally with team members and with others in the industry¹ about what it could mean to have an identity stolen in this interconnected world. Pages and pages could be written about any one of these topics (and they are!).

So, what’s stopping the United States from implementing a social credit system and a full-surveillance society? Technologically, not much. From a social and political standpoint, this idea may be considered unthinkable across many regions of the United States. Even though many are opposed to the idea of a surveillance society, those same people are looking to invest in their safety, along with making their lives easier. One writer at Business Insider documented 49 surveillance cameras in New York City on his commute to work.² All of these cameras were installed in the name of safety and security.

The United States also has full-surveillance cities implemented in the name of security. Medina, Washington, and Camden, New Jersey, are two examples that couldn’t be more different. Camden has been on the most dangerous cities in America list,³ while Medina is one of the most affluent suburbs of Seattle, housing billionaires such as Bill Gates and Jeff Bezos. Both cities implemented strong surveillance programs in order to deter and keep our crime.^4 ,5Through city governments and social services, both cities chose to implement this kind of surveillance and forego the privacy once afforded their citizens. Along with the safety aspects, it also makes life more convenient, and crimes are solved more quickly. The difference between these U.S. cities and China is that the national government is not yet involved, even as citizens are normalizing the constant surveillance they’re under.

Surveillance technology is also used throughout the United States in the name of making our lives easier—photo tollbooths capture a picture of your car and millions put their biometric data into cell phones in order to make them easier to use. Apps also constantly track locations, and parents often install tracker apps on their children’s phones. The idea of what is private is changing, and Generation Z is adjusting accordingly.

Conclusions

As with any technology, IoT devices come with risks and vulnerabilities. It is clear that IoT devices are permanent fixtures in the homes and hearts of many people, in all age ranges. According to the survey participants, Generation Z seems to be more trusting of IoT devices, but more concerned with them being hacked and used with malintent. Thus, education on adjusting privacy settings and properly configurating these devices is paramount.

Considering the number of IoT botnets (thingbots) found in the wild and used for different purposes, one should closely consider all the consequences before purchasing and installing an IoT device in a home. From an enterprise standpoint, it is also clear that digital habits are not changing based on the different kinds of devices. With so many young people unaware that privacy settings can even be changed on many IoT devices, it is essential that companies take this into consideration when creating default configurations.

Do you trust your devices? Join us on social media to continue the conversation about Millennials, Generation Z, and IoT.

Methodology: Constraints, Limitations, and Assumptions for This Data Set

The constraints, limitations, and assumptions for this survey are detailed in part 1 of this article series. Assumptions are used to narrow scope and are taken as fact in order to accommodate limitations. We made the following additional assumptions when looking at the subset of data regarding thoughts on IoT.

• One large assumption the team made was using the word surveillance. We often don’t specify who is doing the surveilling, which is left up to the participant’s imagination. Surveillance by malicious threat actors exploiting vulnerabilities, surveillance by corporations exploiting SLAs and built-in features, and surveillance by nation-state governments exploiting both are all different propositions that make different people uncomfortable in different ways. For the purposes of this survey we sometimes used the word hackers in a question, but we did not specify what that term means.
• In addition to this assumption, specific to the IoT questions, the team assumed that survey participants knew what IoT is. This is an important assumption, as devices such as wireless routers and gaming consoles were listed as IoT devices that many people do not traditionally think of as IoT.
• The team also assumed that all survey participants answered honestly and accurately to the best of their abilities.
• Lastly, the team assumed that younger participants answered accurately, even though many might be living with their parents and might not have buying power over the IoT devices. This could skew the results to indicate that Generation Z participants own more devices than they might if they were living on their own.

As with any survey, the order in which questions are asked, the exact wording of questions, and the nature of the questions may influence participants. The team assumed that the research done ahead of time and the quality checks the entire F5 Labs team placed on the survey questions would be sufficient to combat this bias.