Homes That Understand Us: Artificial Intelligence in Connected Things

In autumn 2016 a piece of malicious software called Mirai enlisted about 600,000 internet-connected devices, mostly embedded Internet of Things devices, and aimed them together at prominent targets, knocking their services offline (Antonakakis et al., 2017). Many of the owners probably never knew that a forgotten gadget in the corner of the house had become a foot soldier in an attack. The story is the most honest way into the subject: everything that joins the network gives us comfort, and opens a door at the same time.

What does artificial intelligence add?

IoT Analytics estimated the number of connected devices at about 18.5 billion at the end of 2024 and about 21.1 billion in 2025, and it forecasts about 39 billion in 2030. These are the estimates of a commercial research firm, not settled figures. And the count alone means little: a sensor writes down a number, a camera captures a frame, and neither means anything until it is analysed.

This is where artificial intelligence comes in. It learns what counts as usual so that it can catch the unusual, and it turns a flood of readings into an alert or a decision. "Understanding" here does not mean awareness like ours; it is pattern detection (see the article "What Is Artificial Intelligence, Really? A Plain Explanation Without the Hype"). When we say the house "knows" you have fallen asleep, we mean that scattered data points have converged on a pattern that looks like sleep.

Intelligence moves closer to the device

Devices used to send their data to a distant data centre. Then edge computing spread: processing data close to where it originates. Shi and colleagues (2016) name four motives: speed of response, longer battery life, lower bandwidth costs, and the safety and privacy of data, which leaves the device less often.

That is a real gain for homes, but it has another side, which we note ourselves: when a device decides for itself in a fraction of a second, it is hard for the householder to know on what basis it decided. Local processing protects a secret, but it is no substitute for transparency and the ability to review decisions.

What movement reveals, even when encrypted

Many people assume encryption hides everything. Yet researchers at Princeton examined seven smart-home devices, including a sleep monitor, cameras, smart plugs and a voice assistant, and found that someone watching the network, such as an internet provider, can infer residents' activity from traffic rates alone, even when the contents are encrypted (Apthorpe et al., 2017). The sleep monitor showed when its owner went to bed and when they got up, and a camera showed when motion was detected. The researchers proposed hiding the patterns by sending data at a constant rate, padded with cover traffic, and estimated the cost at about 7.5 kilobytes per second for devices without audio or video. They also found that cutting off internet access is no solution: of the seven devices, three lost all function without it and four kept only limited function.

The lesson is that privacy in smart homes is not secured by encryption alone, and that asking "what is sent?" is not enough without asking "when is it sent, and in what pattern?". (For more on this, see the article "Privacy in the Age of AI: How Your Secrets Are Inferred, and How to Protect Them".)

The weakest link

When dozens of devices share a network, the weakest becomes a door for the rest. Mirai showed how a neglected device turns into a weapon against others (see the article "AI and Cybersecurity: One Key in Two Hands"). One regulatory step in this direction is a British law in force since 29 April 2024, which stops companies selling connected devices with easily guessed default passwords, and requires them to provide a channel for reporting vulnerabilities and to state how long a device will receive security updates.

What should be done

• Security by design: a device with a unique password and guaranteed updates, not a patch applied after a breach.
• Local processing of sensitive data: keep the data of private rooms close to its source wherever possible.
• Transparency for residents: they should know what is collected, why, and to whom it is sent, in language they can follow rather than in texts nobody reads.
• An off switch: people should keep the right to disable or disconnect a device without losing its basic functions.
• Legal protection: the Kingdom's Personal Data Protection Law has been enforceable since 14 September 2024, and the accompanying guidelines require that data be collected with the owner's consent, for an explicit purpose limited to what is necessary, and that the person be able to withdraw consent at any time.

Homes are sanctuaries, and guarding their residents' secrets is part of fulfilling a trust. Anyone buying a smart device should ask before purchase what it transmits, and anyone making one should remember that they are entering a home, not a laboratory. Technology is a good servant when its limits are set; and with reliance on God, taking the necessary precautions is never to be neglected.