1

I have recently learned about a high-tech premium bed base that incorporates Bluetooth speakers, plus massage actuators and other features controllable via a smartphone app.

Like many insecure Bluetooth speakers, the ones in the bed base will pair with any Bluetooth device without any form of authentication, not even a pairing button.

This basically allows anyone with a smartphone to:

  • Walk within Bluetooth range of the device (for example from the street)

  • Open their phone and notice the device advertising itself on Bluetooth

  • Click on it to select it as audio output device

  • Play any kind of audio file on it

There is no microphone, so it is not possible to remotely record audio. This is not like insecure Bluetooth headsets which allow anyone within range to connect and use the microphone to record.

Neither hacking nor password is necessary to perform this feat, as the device advertises itself as available for connection, and simply accepts all incoming pairing requests. It may even be possible to control the bed position and massage features remotely.

Now I'm wondering what the legal implications are:

  • For someone who does not own the device, yet connects to it (perhaps by mistake) and plays audio on it without the owner's consent, or manages to remotely control the motors...

  • For the manufacturer: is it legal to even sell this? Can the buyers sue the manufacturer after the neighbor's kids decide to make the bed speakers play heavy metal at 4AM every night, rendering the bed base features unusable?

  • For the owner: I know if someone hosts an insecure WiFi and someone else connects to it and uses it for nefarious purposes, the owner of the insecure WiFi can face consequences. In this case the device uses Bluetooth not WiFi, and it is not connected to the internet, so this should not apply... unless maybe?

I'm definitely not planning to buy one of these (nor prank it) anyway, so I'm not focusing on any particular jurisdiction.

1
  • You do realise that most devices now use Bluetooth LE, which only has a range of about 10m. So, the only person that can prank you is your neighbor if there is an adjoining house on the other side of your bedroom wall. My bed, mattress, massage chair and sofas all have bluetooth support. May 29, 2023 at 2:03

1 Answer 1

3

It is legal for a manufacturer to sell a device which is capable of being misused. For example, a wifi-capable router can be sold even if it is "open" by default. A Bluetooth device has a shorter range than wifi, but in principle can connect to any other device. An owner's legal liability is not different given wifi vs. Bluetooth.

Whether or not there is criminal liability for a third person who connects to the device also does not specifically depend on whether the device uses Bluetooth technology, as opposed to some other technology. 18 USC 1030 is the general federal law prohibiting "unauthorized access". In the case of a bed, two legal question arise: is it a "computer", and is it "protected"? It is an electronic high speed data processing device which performs logical, arithmetic, storage and communications facilities, i.e. it is a computer (in the legal sense). It probably is not protected, because it is not "used in or affecting interstate or foreign commerce or communication", that is, it is not connected to the internet (unless it is). State laws tend to be broader, not having the "interstate commerce" limitation, so accessing the bed would violate Washington's analog of the federal law. However, under Washington law, the access is probably not "without authorization". That term is defined as

knowingly circumvent technological access barriers to a data system in order to obtain information without the express or implied permission of the owner, where such technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include white hat security research or circumventing a technological measure that does not effectively control access to a computer. The term "without the express or implied permission" does not include access in violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, with an internet service provider, internet website, or employer. The term "circumvent technological access barriers" may include unauthorized elevation of privileges, such as allowing a normal user to execute code as administrator, or allowing a remote person without any privileges to run code.

One question is whether there is any technological access barrier that the user circumvents (I don't know if it is possible to circumvent "hidden mode"). Since the term "may include ... allowing a remote person without any privileges to run code", and since playing music on speakers involves running code, then the remote user may be criminally liable. On the third hand, the language of that paragraph ("technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include ... circumventing a technological measure that does not effectively control access to a computer") clearly indicates a legislative intent to address deliberately overcoming active access barriers and not accidentally connecting to an unprotected, open system. Plus, the law also says that you are accessing the computer "in order to obtain information", but that is not the purpose of transmitting sound to speakers.

5
  • 1
    Obviously if you intentionally control a remotely controllable bed and hurt a person sleeping in it, that would be assault no matter how secure or insecure it was.
    – gnasher729
    May 28, 2023 at 19:06
  • Thank you, that was quite interesting. In this case "hidden mode" wouldn't apply since the loudspeaker/bed advertises its presence to any nearby phone. Hidden mode is something you enable on your own phone to prevent hackers from trying to access it. I believe the term "run code" means to upload and run the hacker's code on the device which allows the hacker to control it. It wouldn't make sense for it to mean "run code already present on the device" because it's already doing that.
    – bobflux
    May 28, 2023 at 20:26
  • And... yeah, in this case there are no barriers to access at all, as the device basically broadcasts "hey connect to me" to everyone in radio range and accepts all connections... so I think you're right, the prankster would not be committing a cyber felony... In fact, and quite worrying, if the device is an insecure bluetooth headset with microphone, the "hacker" can connect to it to "obtain information" but if it has no other authentication, then it wouldn't be unauthorized access.
    – bobflux
    May 28, 2023 at 20:35
  • There's been a bit of a scandal with a talking kid's doll ; they implemented it as a bluetooth headset and put the voice recognition and synthesis in a smartphone app. It had no authentication so anyone in range could connect to it and listen to the microphone. The Germans classified the doll as a spying device and pulled it from the market.
    – bobflux
    May 28, 2023 at 20:37
  • Being able to easily control what a talking doll says (which might only be heard by a child) is also potentially very harmful.
    – gnasher729
    May 30, 2023 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .