Unanticipated Consequences of Smart Homes

Voices in the night: On the first night in his new home, Clint Basinger was unpacking boxes in the living room when, around midnight, he heard a voice echoing down the hallway from the other side of the house.

“Good night,” the voice said. “It’s bedtime.”

Then he heard the door locks click.

Basinger had spent fifteen years saving up to buy this three-bedroom split-level house in Asheville, North Carolina. He had not, in those fifteen years, anticipated that his dream home would come with a ghost.

Or rather, with something worse than a ghost: a previous owner had installed a comprehensive smart home system and hadn’t bothered to mention that he still had access to it.

He couldn’t do anything with the door, All the windows were armed, all the motion sensors were turned on. His house had, essentially, put itself to bed—and locked him inside it. The previous owner could change the lock codes, monitor the cameras, adjust the thermostat, and apparently enforce a bedtime. The house didn’t belong to the person who owned it. It belonged to whoever held the passwords.

Welcome to the age of the smart haunted house.

The Ghost in the Machine: The smart home was supposed to be a convenience. Install a few connected devices and your house becomes responsive, helpful, almost alive. The thermostat learns your preferences; the lights adjust to your schedule; the doorbell shows you who’s there without requiring you to get off the couch. The refrigerator—if you’ve truly committed to the vision—orders milk when you’re running low.

What nobody quite thought through was what happens when the person who set up all these helpful systems is no longer the person living with them.

When you sell a house with a conventional lock, you hand over the keys. The new owner changes the locks if they’re prudent. The transaction is complete. But a smart lock isn’t controlled by a physical key—it’s controlled by an account, and accounts live in the cloud. The lock doesn’t care who physically possesses the house. It cares who has the password. The same is true for smart cameras, smart thermostats, smart speakers, smart doorbells, smart light switches, smart ceiling fans, smart garage door openers, and the ever-expanding universe of devices that have been given internet connections for reasons that sometimes seem more aspirational than practical.

Each of these devices represents a potential point of control for someone who is no longer supposed to have control. Such as, The previous owner of your house. Or The landlord of your apartment. Or The ex-partner who moved out and took all of the passwords and the logins.

You should meet … Lindsey Song. She’s a co-chair of the New York Cyber Abuse Task Force and the deputy director of the Courtroom Advocates Project, a part of the Sanctuary for Families group. Her job involves helping survivors of domestic abuse, and in recent years, her job has increasingly involved helping survivors of a very modern form of abuse: the weaponization of the smart home.

There’s been a rollout of so many different technologies in the homes that are really beneficial, she points out, “… it’s also extremely invasive. We constantly see this used against survivors. The abusers have left the home and yet the abuser is still connected to them in that way—they’re still able to access their devices, accounts, and information.”

The forms this abuse takes are as varied as the devices themselves, and as creative as malice permits. Abusive partners can remotely turn up the heat on a smart thermostat on a searing summer day—a form of torture that leaves no marks but makes the home unlivable. They can turn lights off and on at random hours, disrupting sleep, creating the persistent sensation of being watched. They can display messages on smart televisions: “I’m watching you.” They can play triggering songs on smart speakers—wedding songs, perhaps, or songs associated with violent episodes. They can lock doors remotely, or unlock them. They can watch through cameras that were installed for security and now provide the opposite.

The statistics are stark. Around 62% of women who have experienced abuse report experiencing technology-based abuse by an intimate partner. This isn’t a rare edge case. It’s the majority experience.

What makes smart home abuse particularly insidious is its deniability. A thermostat set to 95 degrees doesn’t leave bruises. Lights that flicker at 3 AM don’t show up in police reports. When the victim complains that someone is controlling their house, they sound paranoid—exactly the impression the abuser wants to create. The technology enables gaslighting in its most literal form: manipulation of the physical environment to make someone doubt their own perceptions.

The Panopticon Next Door: Even when nobody is actively manipulating the smart home, the smart home is watching. That’s sort of the point of having a smart home.

Consider what a reasonably equipped smart home knows about its occupants. Doorbell cameras log everyone who arrives and departs, timestamped and often with facial recognition. Smart locks record every entry and exit. Motion sensors track movement through the house. Smart speakers listen for wake words—and sometimes record when they shouldn’t. Smart thermostats know when you’re home and when you’re away based on motion and temperature patterns. Smart water meters log usage, which reveals when you shower, when you run the dishwasher, when you’re home and when you’re not. Smart electricity meters do the same for power consumption.

If your phone connects to the home Wi-Fi, the router logs that too. It knows which devices are in the house and when they arrived. It knows, by extension, which people are in the house and when they arrived—at least, which people brought their phones and connected to the house Wi-Fi.

This is an extraordinary amount of information about daily life, gathered continuously and stored indefinitely. For an abuser with access to these systems, it’s a comprehensive surveillance network. They know when you leave for work. They know when you come home. They know when someone else visits, and how long they stay, and whether they stay overnight. They know your patterns and can detect when you deviate from them.

The smart home, in other words, is a tool for intimate surveillance that would have made the Stasi weep with envy. The difference is that we installed it ourselves, and we did it because we wanted to adjust the thermostat from the couch.

The Challenge of Exorcism: Suppose you’ve recognized the problem. Suppose you’re Clint Basinger, living in your own home that’s run by the previous owner’s automation system, or you’re a domestic abuse survivor whose ex can still control the lights and furnace. How do you reclaim your house?

The answer is: with great difficulty and considerable expense.

Each smart device has its own account, its own app, its own password recovery process, its own customer service queue. Many devices can only be factory reset with physical access to a tiny button hidden on the device itself—assuming you can find it, and assuming the previous owner didn’t disable the reset function. Some devices, once linked to an account, cannot be unlinked without cooperation from that account holder. You can be standing in your own home, holding a device you legally own, and be unable to control it because someone else’s email address is in a database somewhere.

The time and cost of resetting or changing authorization for a comprehensive smart home system is enormous. Every device is its own project. The thermostat requires one process, the locks another, the cameras another, the speakers another. There is no master switch, no single reset button for the entire house. The system was designed to be easy to set up and very, very hard to undo.

For buyers of smart homes, the lesson is clear: negotiating the transfer of smart home access should be part of the purchase agreement, as routine as transferring the title. New owners should change all access codes immediately, and should assume that any device not explicitly reset might still be accessible to the previous owner. The real estate industry hasn’t caught up to this reality. Contracts that meticulously address who keeps the refrigerator say nothing about who keeps the ability to watch the living room through the doorbell camera.

For survivors of domestic abuse, the challenge is even more acute. They may not have the technical knowledge to identify every device in the home, much less reset them all. They may not have the financial resources to replace devices that can’t be reset. They may not have the time—safety often requires acting quickly, and debugging a smart home is not quick. Organizations like Sanctuary for Families provide guides and support, but the fundamental problem is structural: the technology was designed without considering that the person setting it up might not always be the person who should control it. [1]

Design Failure: The smart home abuse problem is, at its core, a design failure. Not a technical failure—the devices work exactly as intended. The failure is in the assumptions built into the design that lead to those Unanticipated Consequences.

Smart home devices were designed assuming that the person who sets up the device is the person who should control it, permanently. They were designed assuming that households are stable, that relationships don’t end, that the owner setting up the nursery camera will always be a loving parent and never a stalker. They were designed, in other words, for a world that doesn’t exist.

This isn’t unique to smart homes. Technology designers routinely assume benevolent users. Social networks were designed assuming people would share authentic content, not propaganda. Recommendation algorithms were designed assuming engagement was good, not that it might reward outrage. Email was designed assuming people would send legitimate messages, not that spam would eventually outnumber real correspondence a hundred to one.

The pattern is so consistent that it deserves a name. Call it the benevolent user fallacy: that is the assumption that technology will be used as intended by people with good intentions. It’s a comforting assumption, and it’s almost always wrong. Technology will be used by everyone who can use it, including people whose intentions are malicious, controlling, or simply different from what the designers imagined.

Designing for the malicious user isn’t paranoid; it’s realistic. It means asking: How could someone use this to harm another person? What happens when the person with control shouldn’t have it? How do we transfer control when circumstances change?

These questions weren’t adequately asked when smart home devices were designed, and millions of people are living with the consequences.

I hope you’re not one of them.

[1] Wirecutter has published a guide to protecting oneself from domestic abusers utilizing smart home devices. https://www.nytimes.com/2020/04/06/smarter-living/wirecutter/domestic-abusers-can-control-your-devices-heres-how-to-fight-back.html