11

According to CNET, the My Friend Cayla doll was banned in Germany because it has been classed as an illegal "hidden espionage device":

If you're considering purchasing a connected toy for your offspring, you might want to think twice.

In Germany, regulators have determined that the My Friend Cayla doll could be up to no good, given its potential to steal information about children who play with it. And they say that German parents whose children are in possession of a Cayla doll should destroy the toy.

The Federal Network Agency said in a press release Friday that it has removed Cayla dolls from the market in Germany and will not look to prosecute parents who have purchased one. It does expect, however, that parents who have bought a doll will assume responsibility for destroying it.

Cayla dolls, which incorporate microphones and ask kids questions about themselves and their parents, are classified as "hidden espionage devices," the possession and selling of which are banned by German law.

I did a bit of research about the toy previously when someone asked about the toy, and although it does seem slightly inappropriate to be sending your children's speech to a cloud server, it's not exactly hidden; the device is advertised as 'smart' and connected to the Internet.

Are there other flaws with the doll that made it illegal (hacking, maybe?), or was it banned simply due to the privacy concerns of sending data to the manufacturer?

Improve this question
1
  • 2
    It might be worthwhile to point out that, given the current trend, the right question should be "Why was the internet-connected whatever not banned as a hidden espionage device" ...
    – gbr
    Commented Nov 1, 2017 at 16:01

4 Answers 4

Reset to default
15

As I understand the issues, there are two particular points in which the Cayla doll differs from similar allowed toys:

Together this means that a 3rd party can pair their phone with the doll, switch off the sending indicator and and listen to the unsuspecting people around the doll. So this isn't "only" about 3d parties not being aware of the sending capabilities, this is about hidden sending capability that is almost unavoidable with the device being used according to its purpose.
"Common sense knowledge" (knowing that the doll has internet connectivity and sending capabilities and its sending light is not on) is not sufficient to ensure privacy here - at the very least, one would need to know these exploits and then take additional precautions accordingly.

The press release of the Bundesnetzagentur says:

Ohne Kenntnis der Eltern können die Gespräche des Kindes und anderer Personen aufgenommen und weitergeleitet werden. [...] Weiter kann ein Spielzeug, wenn die Funkverbindung (wie Bluetooth) vom Hersteller nicht ausreichend geschützt wird, von in der Nähe befindlichen Dritten unbemerkt genutzt werden, um Gespräche abzuhören.

rough translation:

Without knowledge of the parents, the conversations of the child and others can be recorded and sent [to the internet/3rd parties]. [...] Furthemore, if the radio transmission (e.g. bluetooth) isn't properly secured the toy can be used by 3rd parties in the vicinity to tap conversations unperceived.

Improve this answer
10

it's not exactly hidden; the device is advertised as 'smart' and connected to the Internet.

Okay but if you're not the one who bought it, you may not be aware that it is recording your speech and sending it to the internet! Just buy one and give it as a gift to someone you wish to spy on; they'll think it's just a doll. Hence, it very much is a hidden espionage device.

Improve this answer
3
  • 1
    That could be avoided by "do not take gifts from strangers" rules. But the doll in question apparently can be taken over by 3rd parties leaving owners unsuspecting who do know about the sending capability (but not about the exploits).
    – cbeleites
    Commented Feb 19, 2017 at 21:37
  • 1
    "Do not take gifts from strangers" rules don't cancel out "do not give dangerous spy-y things to strangers" rules.
    – Lightness Races in Orbit
    Commented Feb 19, 2017 at 23:37
  • 1
    :-) No, of course not. Point is, both are not enough here.
    – cbeleites
    Commented Feb 20, 2017 at 16:52
8

The news in Germany where reporting that under german laws the doll is considered as hidden espionage device as it looks like a normal toy without any electronical parts to people who do not know about the functions of it, altough it is able to record and send data.

This falls under "§ 90 Missbrauch von Sende- oder sonstigen Telekommunikationsanlagen" of the Telekommunikationsgesetz (TKG) and is therefore banned within the country.

Sources:

Improve this answer
2
  • 2
    I think there's actually a bit more to that. Dolls that send are allowed as long as they indicate sending status.
    – cbeleites
    Commented Feb 19, 2017 at 21:35
  • Which this one doesn't. Or, at least, doesn't always.
    – Robert Columbia
    Commented Mar 7, 2017 at 10:50
6

One of the key issues with My Friend Cayla is that the audio files it sends are not saved securely. Ken Munro has carried out extensive analysis on this (and many other IoT devices) and points out that the audio files are available on the Internet, with poor access controls!

So not only is everything your child says going to a server somewhere, others can listen to it...

(piece of advice - for IoT security, follow Ken Munro. You'll be surprised at the access he gains to not just IoT devices, but through them to home computers, passwords and more!)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.