Spy-oT: Understanding How Users Learn to Use Internet of Things Devices For Abusive Purposes

Internet of Things (IoT) devices are internet-connected household devices that make homes "smarter". They can be used maliciously for unintended purposes, including for intimate partner abuse. While abuse is a known issue, there is a lack of understanding of how abusers discover malicious uses. We run an exploration-based "abusability" study to understand how people learn to use IoT devices maliciously, and which abuses are most easily discoverable. We found that users with a variety of levels of technical expertise all focused on non-technical attacks, and identified the common features that enable these abuses. We identified access control and logging as two features which require redesigns to better protect against domestic abuse, and discuss the trade-offs of alternative designs. Finally, we propose an updated "Functionality-Enabled" adversary model for technology-facilitated domestic abuse.