top | item 13585104

What Vizio was doing behind the TV screen

888 points| Deinos | 9 years ago |ftc.gov

333 comments

order
[+] mikeryan|9 years ago|reply
So I have a bit of intimate knowledge of this.

Not sure what I can answer but for years my company worked on an Automatic Content Recognition project using tools from a team called Cognitive Networks who were bought by Vizio and makes up the tech that did this. If I understand correctly the founder of Vizio kept this tech for himself in the sale of Vizio.

When developing this we would work directly with Cognitive checking sync'd apps. We knew for a long time that they could see our content in their office while we tested.

Note LG got caught on this about 2-3 years ago and made ACR apps opt-in which pretty much killed it for LG.

AFAIK Samsung never did the exact same thing a bunch of providers saw the writing on the wall and dumped this sort of technology a few years back. It had some really cool applications for interactive sync to broadcast apps but the privacy concerns killed it for a lot for a lot of manufacturers.

[+] AJ007|9 years ago|reply
Thanks for posting this. When I saw the original FTC story I recalled reading about this once or twice in the past but couldn't think of any key phrases or sources.

In response to some of the other comments here, basically what they are guilty of isn't spying but failing to properly disclose and opt-in users. There is a particular major AV vendor who is selling raw clickstream data of millions of their user's internet usage directly to marketers and other parties right now. As far as I can tell, as long as it is buried somewhere in the terms and conditions no one cares.

Of course, other companies that are actually serving the content are doing far more than just passively monitoring your viewing habits.

From my best guess, Facebook is logging every signal it can from content/pictures/videos it displays to users. Even if you didn't click like, comment, or click through the link it knows the story captured your attention.

I had an interesting case with Instagram where after viewing enough pictures of women's butts it started also showing men's bare butts in my feed too.. at least until I never opened any of them, and they disappeared.

Users should consider that content providers are going to have extremely deep data sets of even the most minute dimensions of their political leanings, porn viewing habits, dating preferences, and gullibilities. All of this will make what TV shows you watched between Netflix and NBC beyond mundane.

With an open web, where we get content from the source, this shouldn't actually be possible. Thank the platform business model.

[+] Archio|9 years ago|reply
I'm curious, did anyone on your team raise any ethical concerns in regards to the potential privacy violation? If not, how was the topic handled by employees/management?
[+] Shivetya|9 years ago|reply
going to be really curious how siri/alexa/google voice activated devices in home are going to be treated in the future. eventually even these will likely have video in ability
[+] pdimitar|9 years ago|reply
What proof do you have for what you're claiming, please? If you have intimate knowledge then you should know that many (me included) could accuse you of trying to push an agenda or divert the attention by posting what you did.

How do you really know LG stopped their data collection? Sure they might have made a checkbox be switched off by default, but what does that say about the underlying software? IMO, nothing. It might have been a PR damage control campaign without an actual change.

[+] jasonwilk|9 years ago|reply
It's not worth buying any of these 'Smart' TVs. I don't know whether it is a shoddy developer experience provided by the likes of Samsung / Vizeo etc or if it's the developers themselves (Hulu I'm looking at you) who do not maintain their apps which are constantly bug filled.

I much prefer my old dumb TV that has a Roku plugged into it. Oh yeah, and I know it's not WATCHING ME.

[+] wrsh07|9 years ago|reply
If you want a high end tv you don't have much choice.

But also, why do you not expect your Roku / apple tv / etc to be watching you?

[+] jaimex2|9 years ago|reply
I caught my TV doing this and went to war.

For the last two years I have had a service running that floods garbage data back to the collection point from several addresses throughout the Internet.

You're welcome.

[+] voltagex_|9 years ago|reply
I know we can't expect the "average" consumer to do this, but thanks for caring and running tcpdump on your network! It amazes me that with a lot of these stories there's no one popping up with a pcap showing exactly what's going on.

I'm hoping projects like Turris Omnia [1] will allow people to be more in control of what goes in and out of the LAN - my network, my rules.

1: https://omnia.turris.cz/en/

[+] ktta|9 years ago|reply
Is it an unsecured or secured connection? Can you make a connection?

You might want to check if they just blocked your IP addresses and your connections are being dropped. Although if you're been running it for 2 years(!), I think you have it covered.

Just a tip: It's very easy to clean up completely garbage data from a database. Any data scientist worth their salt would do that. Getting rid of your garbage data just needs a couple lines of code. What you need to do is, skew the data so that it isn't suspicious but eventually will mess up their inferences.

[+] hoppa_liza|9 years ago|reply
Care to elaborate on this? How you caught it, what and how are you sending back to them?
[+] noonespecial|9 years ago|reply
It would be nice to rope in some chan-ners and a bot net or two. I think the data should say that the entire country watched a certain Rick Astley video on repeat for the next year.
[+] alirazaq|9 years ago|reply
Glad to know someone is giving them hell. I purchased a Vizio TV on black friday and suspected that all manufacturers would be doing something like this. For that reason I never configured it to access my wireless network. Scary to realize that it was actually happening and at this scale.
[+] hueving|9 years ago|reply
Well played. This is the kind of stuff botnets should be put to work doing. :)
[+] deadbunny|9 years ago|reply
And it will have taken them no effort to blacklist your IP for sending junk data.
[+] sosborn|9 years ago|reply
I'd love more details on this. It would make a great supplement to something like Pie-hole.
[+] TwoBit|9 years ago|reply
Good luck defending those cyber hacking charges that are going to be brought against you.
[+] passivepinetree|9 years ago|reply
The amount of money they made from that data is probably orders of magnitude more than the paltry $2.2 million penalty.

I hate to get all paranoid, but it seems like every day there's news of a company's data being hacked, and what information isn't being hacked is being actively sold.

What can an average citizen do (short of living Ron Swanson-style in a cabin in the woods) to protect their privacy?

[+] TheGRS|9 years ago|reply
On the individual level, probably not much. But I think you could help much more on a societal level. Help monitor what these devices are sending back when they contact their servers and report on it. Is there a database for that sort of thing?

But also, giving to litigation groups that fight this sort of thing. EFF comes to mind, but I'm sure there are others.

[+] EdSharkey|9 years ago|reply
Isn't there money to be made in simply selling honest software and hardware that doesn't spy? A profitable consumer electronics and software company could be established whose products didn't monitor, aggregate, or stalk its customers with ads.

I should think there's enough awareness of these kinds of antics in the market now that a successful company could be established soon that has the creation of honest, respectful tech as its M.O. A venture like that could be profitable AND disruptive.

I suppose to guarantee the privacy of its customers, such a company would necessarily have to have vast product offerings - or lots of like-minded partners - to compose a comprehensive landscape of services that could replace the privacy-violating services their consumers currently rely on. A sort of privacy walled-garden.

[+] elorant|9 years ago|reply
Build a blacklist of companies that adopt such policies and boycott the shit out of them.
[+] Narkov|9 years ago|reply
"orders of magnitude more" ? As in, ~$200m? No chance.

With a little bit of industry knowledge, I would posit that they made roughly the same quantum as the fine.

[+] rmc|9 years ago|reply
> What can an average citizen do (short of living Ron Swanson-style in a cabin in the woods) to protect their privacy?

Talk to your politicians. Tell them that data privacy is important. If you're in the USA lobby for something like the EU's Data Protection law (even at the constitutional level). If you're in EU, lobby for stronger data protection (no more sharing data with the USA)

[+] noonespecial|9 years ago|reply
When the penalty is less than the profit, it has a different name. Tax.
[+] awfgylbcxhrey|9 years ago|reply
Vizio collected a selection of pixels on the screen that it matched to a database of TV, movie, and commercial content.

I would like to know more about that process. I find it ethically abhorrent, but technically very interesting.

Like, is it grabbing, say, three pixels in constant locations across the screen and matching their color change over time? Is it examining a whole block? Is it averaging a block at some proportional location on the screen?

[+] cracell|9 years ago|reply
I'm also curious if they'd be able to match different encodings of the same video or would only be able to match against specific encodings in their collection.
[+] JohnBooty|9 years ago|reply
If nobody's started one yet, I think there would be an audience for a blog/vlog/whatever that reviews non-smart TVs. And/or a place that evaluates which "smart" TVs function acceptably as "dumb" when they are not connected to a network.

Realistically, this would have to include evaluating things beside consumer TVs for use as living room devices, since "smart" features in consumer TVs are nearly unavoidable at this point.

Because I'm going to have to start looking into the world of commercial displays for my next TV, I guess. At least I think those don't have "smart" features. Yet?

[+] ktta|9 years ago|reply
Rather than avoiding such TVs, I think we're better off taking some good precautionary measures.

Why buy commercial displays which usually are pretty expensive, when you can buy consumer ones and be smart about how you use it? Of course, even if they start coming with in-built wifi, just don't let them connect to anything.

First, off taking control of your own home network is crucial. Get a good router, something you can install pfSense or linux on. You'll basically have to get an NUC and learn how to manage firewalls. I suggest pfSense or just plain jane ubuntu server if you aren't very good with these systems. Then, a wifi access point can be connected to it for your wireless devices.

Prevent external network access to all the devices, and then whitelisting them (probably only your computers) is the way to go. Unless you bother to teach every one who lives in your house about the terrible things that some companies do, just block everything.

I don't think we can prevent IoT just like we couldn't stop phones. Home automation can be the best thing since mobile phone. As nuts as it sounds, you might just realize the comfort factor of having a "smart home". Just have to be careful, just like you're careful with your phones, and what they do. Read up on basic security, common exploits targeting IoT devices, etc.

[+] radiorental|9 years ago|reply
There was a similar thread here on HN a month or two ago with a comment about swapping out the 'smart' logic board for a generic 'dumb' board.

Doesn't work for all boards but it makes sense that for some makes and models, the screen is relatively generic and can be driven by something you can buy off of ebay.

That or source an industrial display

[+] tracker1|9 years ago|reply
Personally, I'd be pretty happy with very high quality monitor-only sets... I mostly run everything through my AVR anyways. Though some of the smart tv options are getting compelling, I tend to find the integrated devices are always a letdown after a couple years.
[+] swsieber|9 years ago|reply
I'd also like non-smart Blu-ray players. Well, speaking over HDMI is okay, but no internet crap.
[+] ams6110|9 years ago|reply
I think it's not just TVs. Any internet-connected home devices have to be viewed with suspicion until proven to be good household citizens.
[+] pdimitar|9 years ago|reply
"Vizio has agreed to stop unauthorized tracking".

As if there's any human-measurable way of confirming this. Yes they can be forced by a court. And no, the court can't know if they stopped all of the software copies on all TVs and no, the court can't know if they didn't re-activate them in the future back again.

What actual proof do we have that LG actually stopped? What actual proof can we have that Vizio will stop doing this?

[+] ComputerGuru|9 years ago|reply
A 2.2M settlement is absolute peanuts compared to the mountains of cash they likely made.
[+] criley2|9 years ago|reply
Just further confirms that "Smart" TV's are a ripoff at best and a scam at worst.

Never, ever, ever buy a television described as smart. For any reason at all. All of the solutions are miserably pathetic. All of the solutions are riddled with bugs, design omissions and potentially nasty security zero days. All implementations have little to no update support from major third parties.

And, in many cases from many companies, the units spy on you as aggressively as could be to sell data for marketing purposes.

"Smart" tv's are lose lose lose lose. You pay more, you get inferior software, inferior hardware and ultimately have your privacy abused.

EDIT: To be fair, I love my Vizio dumb TV I just got. 40" 1080p dumb TV for $167 inc. taxes this past black friday. Got a HDR/4K Roku for an additional $70 and this TV is beautiful and the Roku is so much impossibly better in both hardware, software and third party support than any "smart" solution ever could be, and costs far less than the "smart" upgrade!

[+] neotek|9 years ago|reply
"Smart" TVs are the worst TVs I've ever used, I really don't understand the appeal whatsoever.

They're almost universally clunky and slow with horrific UI / UX choices and painfully high latency on simple things like browsing a list of files or even just registering button presses, provide fuck all useful benefit over and above the regular TV experience, are usually running some long-deprecated version of Android which is riddled with security holes that will never get patched - why does anyone actually want this?

A Raspberry Pi running OSMC is everything you could ever want out of a home media setup, it'll work with good old regular "dumb" TVs that can't invade your privacy, with an interface so simple your grandparents can use it, and can be put together for well under $50.

[+] fencepost|9 years ago|reply
This sounds like an excellent reason to simply never connect the TV to the Internet and to simply connect your own system to the TV whether it be a stick PC or something with a little more oompf.
[+] abandonliberty|9 years ago|reply
This is promising and is a good start towards IOT precedent, and perhaps even operating systems of our devices (Windows 10).

- Explain your data collection practices up front.

- Get consumers’ consent before you collect and share highly specific information about their entertainment preferences.

- Make it easy for consumers to exercise options.

- Established consumer protection principles apply to new technology.

I wonder how many technical teams are scrambling to undo their spying now - though this is a fairly insubstantial fine. I could see the data being potentially worth more than $2.2m

[+] diamondlovesyou|9 years ago|reply
What I'm about to say may go against what many of the HN community believes. This isn't an attack on anyone's beliefs; I'm merely expressing my thoughts in an attempt to solicit constructive discourse.

I'mma be honest. I don't understand the repulsion at the possibility of corporation X knowing my personal info, (excluding the usual things like bank account info, SSNs, etc) like my location, search history, etc. To be clear, I'm 10000000% against warrantless (FISA court "warrants" excluded) government access to this information. Here's my reasoning:

* Governments

Have the power to arrest and detain on a whim. Not to mention, use drone strikes.

* Corporations

... Don't. These entities have self-interested incentives to provide tools which are economically productive for users. For example, a smarter smartphone, whatever that may be.

Regarding Vizio, my grip is that Vizio's goal (for this product at least) is to make a profit producing TVs. So, after the TV is sold, the product is individually "finished" (not considering support stuff). So, then, what other product is the data collection for, and what does this product give me in return for my data? The answer to both is no, and not just for Vizio.

Maybe I'm naive.

[+] jeanvaljean2463|9 years ago|reply
Huge schocker /s

Pretty sure that Samsung does very similar things. I've been interested in actually capturing outgoing pcap data for this purpose. Looks like I have a new project to add the pile.

[+] silveira|9 years ago|reply
> Consumers have bought more than 11 million internet-connected Vizio televisions since 2010.

> The order also includes a $1.5 million payment to the FTC and an additional civil penalty to New Jersey for a total of $2.2 million.

> Vizio then turned that mountain of data into cash by selling consumers’ viewing histories to advertisers and others.

$2.2 million / 11 million tvs = $0.20 per tv

[+] troydavis|9 years ago|reply
It's amazing this was settled for a few million dollars. It's easy to imagine an alternative press release where the settlement was 10x or even 100x larger.
[+] csours|9 years ago|reply
>On a second-by-second basis, Vizio collected a selection of pixels on the screen that it matched to a database of TV, movie, and commercial content. What’s more, Vizio identified viewing data from cable or broadband service providers, set-top boxes, streaming devices, DVD players, and over-the-air broadcasts. Add it all up and Vizio captured as many as 100 billion data points each day from millions of TVs.

> The order also includes a $1.5 million payment to the FTC and an additional civil penalty to New Jersey for a total of $2.2 million.

[+] zeropoint46|9 years ago|reply
So I actually worked at cognitive networks up until the end of 2014. I've read this thread and thought I would address some things here that didn't seem to get fully concrete answers (in no particular order).

The ACR technology that cognitive used was/is in vizio and LG tvs. during the time I worked there we only had a deal to use it actively on vizio tvs. I guess lg was just testing the waters to see how it'd work. The ACR technology that CG used is based on RGB values from sampled patches on regions of the image. There was no audio finger printing used. There were a number of items that would mess up the "recognition". Some of those included aspect ratio of content, watermarks from different providers, overlays and basically anything that modified either the size of the original image or obstructed it. For the server infrastructure, what we did was we ingested live feeds from the major network providers, these feeds had to be ahead of what tvs were watching by at least 5-10 seconds so we actually had the fingerprint data in our database to be recognized. we would pair the ingested fingerprints to TV scheduling data and voila, we "knew" what you were watching. Now clearly if we didn't have the content in our database we had no idea what was being shown on your screen.

What did we use the ACR data for. Well there were 2 "deals" going on while I was there. One was ratings, something to compete with the likes of neilsons. Different content providers, distributors, marketing agencies, etc. would want ratings info. Additional there were other "data mining" companies that build profiles based off public IP addresses that would want to use our data to enhance and augment their data. The other application that was the one that everybody was after want "interactive advertising". This would allow us to pop up an HTML5 app/page based on the ACR. So for example your selling a car, your ad comes up, you pop up your app and allow the user to schedule a test drive or look at the car in more detail. The use cases were endless though.

The ACR technology ONLY worked on content that was viewed from the HDMI ports. Any built in apps like netflix or hulu that were run, ACR was force disabled. One thing I remember about that was that netflix is huge about NOBODY getting viewing data/ratings information about netflix and it's users. Only netflix has that data apparently. One somewhat reassuring thing about disabling the technology is at one point vizio did notice a bug on one of its TVs where ACR was not being disabled when the user opted out of "interactivity". This was a big deal and we were required to solve it ASAP.

AMA if I missed something.

[+] myrandomcomment|9 years ago|reply
1. Press the Menu button or open the HDTV Settings. 2. Select System. 3. Select Reset & Admin. 4. Select Smart Interactivity. 5. Right arrow to Off.