Do you know how many internet-connected devices there are inside your home? I certainly don’t. These days, it could be almost anything: a thermostat, a TV, a lightbulb, an air conditioner, or a refrigerator. But what I do know, thanks to some of the conversations I’ve had over the past few weeks, is just how much data they’re producing, and how many people can access that data if they want to. Hint: it’s a lot. 

I’ve been speaking to people who work in a field called IoT forensics, which is essentially about snooping around these devices to find data and, ultimately, clues. Although law enforcement bodies and courts in the US don’t often explicitly refer to data from IoT devices, those devices are becoming an increasingly important part of building cases. That’s because, when they’re present at a crime scene, they hold secrets that might be invisible to the naked eye. Secrets like when someone switched a light off, brewed a pot of coffee, or turned on a TV can be pivotal in an investigation. 

Mattia Epifani is one such person. He doesn’t call himself a hacker, but he is someone the police turn to when they need help investigating whether data can be extracted from an item. He’s a digital forensic analyst and instructor at the SANS Institute, and he’s worked with lawyers, police, and private clients around the world. 

“I’m like … obsessed. Every time I see a device, I think, _How could I extract data from there?_ I always do it on test devices or under authorization, of course,” says Epifani.

Smartphones and computers are the most common sorts of devices police seize to assist an investigation, but Epifani says evidence of a crime can come from all sorts of places: “It can be a location. It can be a message. It can be a picture. It can be anything. Maybe it can also be the heart rate of a user or how many steps the user took. And all these things are basically stored on electronic devices.” 

Take, for example, a Samsung refrigerator. Epifani used data from VTO Labs, a digital forensics lab in the US, to investigate just how much information a smart fridge keeps about its owners. 

VTO Labs reverse-engineered the data storage system of a Samsung fridge after it had primed the appliance with test data, extracted that data, and posted a copy of its databases publicly on their website for use by researchers. Steve Watson, the lab’s CEO, explained that this involves finding all the places where the fridge could store data, both within the unit itself and outside it, in apps or cloud storage. Once they’d done that, Epifani got to work analyzing and organizing the data and gaining access to the files. 

What he found was a treasure trove of personal details. Epifani found information about Bluetooth devices near the fridge, Samsung user account details like email addresses and home Wi-Fi networks, temperature and geolocation data, and hourly statistics on energy usage. The fridge stored data about when a user was playing music through an iHeartRadio app. Epifani could even access photos of the Diet Coke and Snapple on the fridge’s shelves, thanks to the small camera that’s embedded inside it. What’s more, he found that the fridge could hold much more data if a user connected the fridge to other Samsung devices through a centralized personal or shared family account. 

None of this is necessarily secret or undisclosed to people when they buy this model of refrigerator, but I certainly wouldn’t have expected that if I were under investigation, a police officer—with a warrant, of course—could see my hungry face each time I opened my fridge hunting for cheese. Samsung didn’t reply to our request for comment, but it’s following pretty standard practices within the world of IoT. Many of these sorts of devices access and store similar types of data. 

Devices don’t even have to be particularly sophisticated to prove helpful in criminal investigations, according to Watson and Epifani. 

Both of them have both worked on devices more discreet than smart fridges. Once, VTO Labs examined a circuit board from an ocean buoy in an effort to find out whether it contained any data about the shipping movements of drug traffickers. Watson says that the circuit board revealed a satellite communications provider and, ultimately, the account number associated with a smuggler. 

Just to compound the plentiful security and privacy risks, many IoT devices also run on out-of-date, and thus less secure, operating systems, because users rarely remember to update them. “Can you imagine people updating their fridge? No, they don’t,” says Epifani. 

This problem is only going to grow as we stuff our homes with more and more things that connect to the internet. Recently, the [Atlantic wrote a great piece](https://www.theatlantic.com/technology/archive/2023/01/smart-tvs-sony-lg-cheap/672614/) about the data that smart TVs collect on their couch-bound watchers. My colleague Eileen Guo [showed how Roomba vacuums can take invasive pictures](https://ter.li/uyl9w7), in an investigation about how data was collected on people who were testing the products.  

Watson is not especially worried about the government or the tech companies spying on you through your thermostat, per se. He’s more worried about all the ways your data is being sold and accumulated by data brokers.

“That’s where the risks are that people don’t understand: if my bed tracks my sleep and tracks my heart rate, and that company is selling off this information to an insurance company that realizes you have a near cardiac event every time you go to sleep, or that you have sleep apnea or whatever,” he says.

“The more technology encroaches into our lives in every facet … we lose the ability to have any measure of control over where it’s going, how much is collected, who’s getting their hands on it, and what they are doing with it.”

How to hack a smart fridge

The internet can feel like a bottomless pit of the worst aspects of humanity. So far, there’s little indication that the metaverse—an envisioned virtual digital world where we work, play, and live—will be much better. [As I reported last month](https://www.technologyreview.com/2021/12/16/1042516/the-metaverse-has-a-groping-problem/), a beta tester in Meta’s virtual social platform, Horizon Worlds, has already complained of being groped.

Tiffany Xingyu Wang feels she has a solution. In August 2020—more than a year before Facebook announced it would change its name to Meta and shift its focus from its flagship social media platform to plans for its own metaverse—Wang launched the nonprofit [Oasis Consortium](https://www.oasisconsortium.com/), a group of game firms and online companies that envisions “an ethical internet where future generations trust they can interact, co-create, and exist free from online hate and toxicity.” 

How? Wang thinks that Oasis can ensure a safer, better metaverse by helping tech companies self-regulate.

Earlier this month, Oasis released its [User Safety Standards](https://www.oasisconsortium.com/usersafetystandards), a set of guidelines that include hiring a trust and safety officer, employing content moderation, and integrating the latest research in fighting toxicity. Companies that join the consortium pledge to work toward these goals.

​​“I want to give the web and metaverse a new option,” says Wang, who has spent the past 15 years working in AI and content moderation. “If the metaverse is going to survive, it has to have safety in it.”

She’s right: the technology’s success is tied to its ability to ensure that users don’t get hurt. But can we really trust that Silicon Valley’s companies will be able to regulate themselves in the metaverse?

### **A blueprint for a safer metaverse**

The companies that have signed on to Oasis thus far include gaming platform Roblox, dating company Grindr, and video game giant Riot Games, among others. Between them they have hundreds of millions of users, many of whom are already actively using virtual spaces. 

Notably, however, Wang hasn’t yet talked with Meta, arguably the biggest player in the future metaverse. Her strategy is to approach Big Tech “when they see the meaningful changes we’re making at the forefront of the movement.” (Meta pointed me to two documents when asked about its plans for safety in the metaverse: a [press release](https://about.fb.com/news/2021/09/building-the-metaverse-responsibly/) detailing partnerships with groups and individuals for “building the metaverse responsibly,” and a [blog post](https://www.oculus.com/blog/keeping-people-safe-in-vr-and-beyond/) about keeping VR spaces safe. Both were written by Meta CTO Andrew Bosworth.) 

> **_To support MIT Technology Review’s journalism, please consider [becoming a subscriber](https://forms.technologyreview.com/subscriptions/)_**.

Wang says she hopes to ensure transparency in a few ways. One is by creating a grading system to ensure that the public knows where a company stands in maintaining trust and safety, not unlike the system by which many restaurants showcase city grades for meeting health and cleanliness standards. Another is by requiring member companies to employ a trust and safety officer. This position has become increasingly common in larger firms, but there’s no agreed set of standards by which each trust and safety officer must abide, Wang says. 

But much of Oasis’s plan remains, at best, idealistic. One example is a proposal to use machine learning to detect harassment and hate speech. As my colleague Karen Hao [reported](https://www.technologyreview.com/2021/06/04/1025742/ai-hate-speech-moderation/) last year, AI models either give hate speech too much chance to spread or overstep. Still, Wang defends Oasis’s promotion of AI as a moderating tool. “AI is as good as the data gets,” she says. “Platforms share different moderation practices, but all work toward better accuracies, faster reaction, and safety by design prevention.”

The document itself is seven pages long and outlines future goals for the consortium. Much of it reads like a mission statement, and Wang says that the first several months’ work have centered on creating advisory groups to help create the goals. 

Other elements of the plan, such as its content moderation strategy, are vague. Wang says she would like companies to hire a diverse set of content moderators so they can understand and combat harassment of people of color and those who identify as non-male. But the plan offers no further steps toward achieving this goal.

The consortium will also expect member companies to share data on which users are being abusive, which is important in identifying repeat offenders. Participating tech companies will partner with nonprofits, government agencies, and law enforcement to help create safety policies, Wang says. She also plans for Oasis to have a law enforcement response team, whose job it will be to notify police about harassment and abuse. But it remains unclear _how_ the task force’s work with law enforcement will differ from the status quo.

### **Balancing privacy and safety**

Despite the lack of concrete details, experts I spoke to think that the consortium’s standards document is a good first step, at least. “It’s a good thing that Oasis is looking at self-regulation, starting with the people who know the systems and their limitations,” says Brittan Heller, a lawyer specializing in technology and human rights. 

It’s not the first time tech companies have worked together in this way. In 2017, some agreed to exchange information freely with the Global Internet Forum to Combat Terrorism. Today, GIFCT remains independent, and companies that sign on to it self-regulate.

Lucy Sparrow, a researcher at the School of Computing and Information Systems at the University of Melbourne, says that what’s going for Oasis is that it offers companies something to work with, rather than waiting for them to come up with the language themselves or wait for a third party to do that work.

Sparrow adds that baking ethics into design from the start, as Oasis pushes for, is admirable and that her research in multiplayer game systems shows it makes a difference. “Ethics tends to get pushed to the sidelines, but here, they \[Oasis\] are encouraging thinking about ethics from the beginning,” she says.

But Heller says that ethical design might not be enough. She suggests that tech companies retool their terms of service, which have been criticized heavily for taking advantage of consumers without legal expertise. 

Sparrow agrees, saying she’s hesitant to believe that a group of tech companies will act in consumers’ best interest. “It really raises two questions,” she says. “One, how much do we trust capital-driven corporations to control safety? And two, how much control do we want tech companies to have over our virtual lives?” 

It’s a sticky situation, especially because users have a right to both safety and privacy, but those needs can be in tension.

For example, Oasis’s standards include guidelines for lodging complaints with law enforcement if users are harassed. If a person wants to file a report now, it’s often hard to do so, because for privacy reasons, platforms often aren’t recording what’s going on.

This change would make a big difference in the ability to discipline repeat offenders; right now, they can get away with abuse and harassment on multiple platforms, because those platforms aren’t communicating with each other about which users are problematic. Yet Heller says that while this is a great idea in theory, it’s hard to put in practice, because companies are obliged to keep user information private according to the terms of service.

“How can you anonymize this data and still have the sharing be effective?” she asks. “What would be the threshold for having your data shared? How could you make the process of sharing information transparent and user removals appealable? Who would have the authority to make such decisions?”

“There is no precedent for companies sharing information \[with other companies\] about users who violate terms of service for harassment or similar bad behavior, even though this often crosses platform lines,” she adds. 

Better content moderation—by humans—could stop harassment at the source. Yet Heller isn’t clear on how Oasis plans to standardize content moderation, especially between a text-based medium and one that is more virtual. And moderating in the metaverse will come with its own set of challenges.

“The AI-based content moderation in social media feeds that catches hate speech is primarily text-based,” Heller says. “Content moderation in VR will need to primarily track and monitor behavior—and current XR \[virtual and augmented reality\] reporting mechanisms are janky, at best, and often ineffective. It can’t be automated by AI at this point.”

That puts the burden of reporting abuse on the user—as the Meta groping victim experienced. Audio and video are often also not recorded, making it harder to establish proof of an assault. Even among those platforms recording audio, Heller says, most retain only snippets, making context difficult if not impossible to understand.

Wang emphasized that the User Safety Standards were created by a safety advisory board, but they are all members of the consortium—a fact that made Heller and Sparrow queasy. The truth is, companies have never had a great track record for protecting consumer health and safety in the history of the internet; why should we expect anything different now?

Sparrow doesn’t think we can. “The point is to have a system in place so justice can be enacted or signal what kind of behaviors are expected, and there are consequences for those behaviors that are out of line,” she says. That might mean having other stakeholders and everyday citizens involved, or some kind of participatory governance that allows users to testify and act as a jury.

One thing’s for sure, though: safety in the metaverse might take more than a group of tech companies promising to watch out for us.

This group of tech firms just signed up to a safer metaverse

Later next month, Maeghan Easler will have a box fan propped in the window, blowing cold February air into her apartment in Des Moines, Iowa. She’ll have cooling packs—tights filled with ice cubes—stuffed into her cycling kit.

And she’ll be pedaling like crazy. 

Easler will compete with dozens of other e-cyclists from around the globe in the UCI Cycling Esports World Championships on February 26. It will be the second such contest ever—the first was held in 2020—and will take place entirely in a video-game-like environment, representing a futuristic Manhattan, on the e-cycling platform Zwift. A total of 100 female and 100 male competitors will join the races remotely, pedaling hard on a stationary bike as their onscreen avatars follow the twists and turns of the specially designed track.

Easler, a lab technician by day, is among the best e-cyclists in America and recently qualified online for USA Cycling’s world championship team. She hasn’t decided yet whether she’ll invite any friends and family over to cheer her on during the race.

“It might just be me by myself in my apartment,” she says, “just going really hard.”

Lockdowns and travel restrictions have boosted e-cycling’s popularity during the pandemic. Fitness platforms such as Peloton and Wahoo [have reported a big spike in users](https://www.bikebiz.com/the-rise-of-indoor-during-lockdown/), and Zwift is no exception. The firm keeps its current active user count a secret but says that, to date, it has clocked the activation of roughly 4 million Zwift accounts in total. Its user base more than doubled last year, it claims. 

> **_To support MIT Technology Review’s journalism, please consider [becoming a subscriber](https://forms.technologyreview.com/subscriptions/)_**.

Ultimately, Zwift’s founders hope this new form of competitive cycling will one day appear at the Olympics—which could happen if the Olympic cycling body, the UCI, were to lend its backing. Things are arguably moving in this direction already. Last June Zwift made its debut at a new event called the Olympic Virtual Series, which was set up by the International Olympic Committee. And one of the differences between e-cycling and other elite track events is that it’s relatively easy for anyone to take part.

“Anyone, anywhere in the world, from the comfort of their own home, could go through a process of eligibility,” says Zwift’s strategy director, Sean Parry.

### Working through the ranks

That’s how Easler made the cut. She was unsuccessful during a qualifying round open to users across the Americas but made it onto the USA’s national team via a separate qualifying process. She’s not a total newbie, having taken part in triathlons as a student. But when she hops on her indoor cycling trainer to take part in a virtual race, she says, she can sense the adrenaline rushing through her.

Easler and her fellow competitors in the world championships will all receive the same smart trainer—a device that replaces the rear wheel on a stationary bike— so that they can compete on a level virtual playing field. Smart trainers automatically increase or decrease resistance to match the feel of the virtual road surface on a Zwift course. It’s even possible to simulate cobbles.

Data plays a big role on platforms such as Zwift, and riders tend to monitor their performance constantly. Their heart rate, speed, and power output in watts, among other statistics, are visible on screen at all times during a race. Commentators can pick out some of these stats live, to show spectators just how hard an individual competitor is working. 

Easler, for instance, knows that she needs to keep her heart rate (measured in beats per minute) below a certain level in order to avoid crashing out. “I can recover if my heart rate hits 185, but if I hit 195, I can’t,” she says. Tracking her numbers on screen allows her to approach her limit without overstepping it, and it’s something she says she’s grown better at over time.

Real-time data on each rider’s performance will also allow Zwift and UCI officials to spot any possible cheaters at the championships. Unsporting competitors might use a variety of tricks—from lying about their weight, which could give them a power advantage, to trying to rig the game. 

In 2019, [one Zwifter was temporarily banned](https://www.theguardian.com/sport/2019/oct/04/first-british-eracing-champion-banned-for-using-bot-to-gain-unfair-advantage) for using a computer program to access a more powerful virtual bike that he then used in races. At the World Championships, riders’ power output will be monitored via the smart trainers and a separate device such as a power meter built into the bike pedals. Any discrepancies should be easy to spot, and competitors’ performance must also be in line with data recorded from previous virtual and outdoor races that they’ve taken part in.

“We have a very accurate understanding of their physical capabilities,” says Zwift spokesman Chris Snook. “Anything outside of that range would be immediately flagged.”

The International Testing Agency, which runs anti-doping programs for the Olympic Games, will also carry out checks on riders during the championships.

All of this represents a high level of scrutiny, says Frederik Broché, technical director at Belgian Cycling, which runs the nation’s traditional cycling teams. He and his colleagues recently selected competitors to represent Belgium in the e-cycling world championships after receiving around 50 applications from across the country. 

Roughly half of those applicants are riders who prioritize Zwift over other forms of cycling. It has quickly become a “specialty” sport, he says. The top Zwifters don’t necessarily have a huge amount of experience in traditional outdoor cycling and may well not be very competitive in that arena. Some, for example, aren’t familiar with how to tuck in their arms, hunker down, and generally position their bodies neatly in order to reduce drag. 

“You don’t have wind on the rollers, so your position doesn’t matter at all,” says Broché. “On the road, it matters a lot.”

Besides selecting individuals for the team on the basis of their overall fitness and Zwift stats, Broché is also, naturally, taking a tactical approach. He can comb through riders’ past performance and statistics, and he wants competitors whose experience on the platform suggests that they will tackle the course well.

This year’s world championships will take place on Knickerbocker, one of Zwift’s fantasy New York routes. It’s a vision of the city 100 years from now, with elevated glass cycle-ways snaking past skyscrapers. Competitors will complete two laps of the route, equivalent to just under 55 kilometers of cycling in real life.

### MarioKart plus Peloton

“There are chances to attack everywhere,” says Parry, who adds that Zwift places great emphasis on designing races for their entertainment value. Spectators will be able to watch the peloton of virtual riders sweep along the course but will also get intermittently livestreamed footage of individual participants’ faces from their living room or training center.

The drama is heightened by another possibility. In Zwift, unlike real life, competitors can briefly improve their performance with power-ups—such as a 15-second aerodynamic improvement or a 30-second increase in virtual weight that allows their cycling avatar to descend a hill faster. Among the features that Zwift is currently developing for the platform are [“boost cells”](https://www.zwift.com/news/22056-futureworks?__znl=en-gb#boost) that will offer a power increase for a short period of time. It’s like a mashup of Mario Kart and Peloton.

Despite this, and the fantastical design of the race route, Zwift aims to keep the terrain reasonably realistic as a cycling surface. There are no gradients steeper than 20%, for example. 

As this sport’s popularity grows, regular cycling coaches are also increasingly incorporating e-cycling into their training regimes. And they are finding that some clients want their help in preparing for virtual races as well as outdoor ones. 

Ric Stern, a cycling coach based near Brighton in the south of England, has entered cycling races every year since 1984. He’s also been a professional coach since 1998. E-cycling platforms and cycling simulators such as RGT Cycling make riding indoors a lot more fun than it used to be, he says.

But outdoor cyclists need to develop a certain bravery for tackling corners quickly, or racing close to other cyclists in a peloton, which can be nerve-racking in real life. Zwift doesn’t help people establish that sort of skill, he argues.

Sandra Beaubien, a mountain biker and coach at Ride Ottawa in Canada, enjoys using Zwift as a tool for improving fitness. It’s easy for her and her clients to focus on that without having to watch out for tree branches or stray rocks on a steep hill descent. On the flip side, they lose the experience of steering over undulating, mountainous terrain. That’s something you can only really get outdoors. 

Zwift is currently testing compatibility with the Bluetooth-enabled Elite Sterzo Smart steering plate, a sort of swiveling plinth placed underneath a bike’s front wheel, for capturing steering data that will allow them to control their digital avatar more precisely and steer for real during the race. Current races are judged on speed and power, with the position in the peloton automatically assigned.

Beaubien says she enjoys racing in Zwift but would like to see a greater number of women on the platform so that she could take part in more women-only races.

Still, Easler and other female competitors are on equal ground with men at the world championships. There are the same number of competitors in the men’s and women’s races, they will travel the same distance along the route, and the winners will receive equal prize money: 8,000 euros ($9,000) for first place.

“Going up against the best e-racers in the world, at least as far as Zwift goes—that’s kind of scary,” says Easler, noting that she is happy simply to have qualified. But the possibility of reaching new levels of greatness has undeniably crept closer. And so, like a true competitor she adds, “Top 10 would be great.”