Your Conference Room TV Works for Someone Else

I’ve been away from writing for a few months. I needed a break; I needed to get back to my first book, and everyone I know was busy traveling, watching the World Cup, and getting business done before summer ran out. So I waited until after Labor Day, until the kids were back in school and the inboxes were open again.

I had a list of things to write about. That list changed a couple of days ago when I watched the Gamers Nexus investigation into LG smart TVs. If you haven’t seen it, it’s worth every minute of the 2.5 hours. Steve Burke and his team, working with Wendell from Level1Techs and independent researchers Mr. Bruh and U-Turn, bought new LG TVs off the shelf, watched what they sent over the network, decompiled the firmware, and tested them in a lab. LG didn’t respond to their questions.

Watch it here: 216,000,000 Spy TVs | The LG Smart TV Problem

We all know our privacy gets chipped at nearly every day. That isn’t news. What the research shows is that LG does it so openly, so completely, and so far past the line that, by my count, it runs into 7 privacy laws, maybe 8. And LG isn’t the only television company in this business. If you have one of these TVs in your office, your clinic, your boardroom, or your lobby, you’re not alone in your concern. Let’s talk about what they found.

The houseguest who never leaves

Here’s the picture I’d use at a dinner party. You buy a TV. What you actually bring home is a houseguest with a clipboard. Before you’ve agreed to anything, he’s walked the house, written down every device on your network, noted who owns each phone and smartwatch, checked the printer, and taken a look at the thermostat. In the researcher’s office, the TV inventoried 38 devices it had no reason to touch, including staff phones with usernames, servers, and the HVAC system.

Then he writes down the name and signal strength of every Wi-Fi network he can see from your living room. That’s enough to place the TV on a map without GPS. He logs when you turn the TV on and off. And every few seconds he fingerprints whatever is on the screen or coming out of the speakers, including the laptop you plugged in over HDMI for a client presentation, and mails it to a company called Alphonso, which does business as LG Ad Solutions. The researchers estimate about 4 GB of that data per TV per month.

None of that requires a hacker. That’s the product working as designed.

“We own the glass”

If you’re wondering whether this is an accident, LG answered the question for us. In a clip included in the investigation, the president of LG Ad Solutions, Serge Matta, describes the relationship this way: “We own the glass. We own the TV.” Not the customer. The company.

Sit with that for a second. You wrote the check. You carried it in. It’s on your wall. And the business model treats the screen in your conference room as their inventory and the people in front of it as the product. That isn’t a rogue engineer. That’s the plan, stated out loud by the executive who runs it.

And before anyone with a Samsung, Sony, Vizio, TCL, Hisense, or Roku set feels relieved, don’t. Content recognition is standard equipment across the industry. Vizio settled with the FTC over it back in 2017. Texas has sued a group of TV manufacturers over the same practice. What Gamers Nexus did was open one brand up in a lab and show us the plumbing. My working assumption is that the others are doing some version of the same thing, and I’d want proof before I believed otherwise.

The signature line trick

If you’ve ever bought a car, you know the move. The extended warranty somehow ends up on the same page as the title paperwork, and the pen is already in your hand.

LG’s consent screens work the same way. “Select All” is highlighted by default, and the advertising agreement is bundled with the terms you actually need to accept to use the television. “Do Not Sell My Personal Information” is buried in the menus and set to off before you’ve connected to the internet. Older TVs picked up advertising IDs through firmware updates with no agreement accepted at all.

It gets better. When you opt out, the TV sends one final snapshot of everything it collected. The device identifier that survives the opt-out is encrypted rather than hashed, and the key sits on the TV. So the hardware address can be recovered. And the content recognition keeps running after you disconnect from the internet, then transmits when you reconnect.

The microphone with a memory

LG has said publicly that its TVs do not collect, record, or store ambient conversations. The researchers found voice input transcribed to plain text logs on the TV. One of their test phrases was a Social Security number. It was sitting there in a file. The microphone stayed open 10 to 15 seconds after any speech, long enough to catch the people across the room, and it picked up normal conversation clearly from 60 to 70 feet away, around corners.

Clearing your data through the menu tells LG’s servers to clear. It leaves the local logs in place. The physical “mic off” switch disables the built-in microphone and nothing else. The remote’s mic, a USB webcam mic, and the audio coming through HDMI are all still available.

That’s a lock on the front door with the windows wide open.

Now hand it to someone with bad intentions

Everything above is out of the box. Here’s what happened once the researchers took control of a TV over the network, which they did with a fake “pair with mobile device” prompt. A second flaw that requires no user interaction at all is in responsible disclosure right now.

They recorded room audio with the TV appearing off. They recorded a video conference call playing through the TV’s speakers. They stored recordings on the TV while it was unplugged from the network and pulled them off after it reconnected. The TV has roughly 4 GB of usable storage and takes a USB stick if you’d like more. It works as a proxy and as a persistent foothold for moving deeper into a corporate network.

One more. Of the 2,851 apps they tested in LG’s app store, 1,213 contained code to turn the TV into a residential proxy for third parties. That’s 43 percent. Amazon and Roku had already banned the practice.

And if you’re a business that bought a consumer model, you can’t audit any of this. LG’s commercial TVs allow custom certificates so IT can inspect outbound traffic. Consumer models block it. The people who most need to know what’s leaving the building are the ones who can’t look.

Then there’s where it goes. LG is a South Korean company, and the researchers found data processed overseas. Set aside the politics. This is a jurisdiction question. A patient conversation, a client call, a board discussion about an acquisition, captured in an American office and stored on a server your lawyers can’t subpoena, under privacy rules your regulators don’t enforce. Is anyone in your organization comfortable with that? Would your cyber insurer be, if they knew?

Where the laws come in

This is the part where I stop being a storyteller and put on the risk hat. I’m not a lawyer, and every one of these needs counsel. But here’s my count.

• HIPAA. A device that captures speaker audio and ambient speech in a clinical setting, sends it to third parties, and processes it overseas is an unencrypted channel the covered entity doesn’t control.
• CCPA and CPRA. “Do Not Sell” off by default, an opt-out that transmits data, and an identifier that survives the opt-out all cut against what the statute was written to do. LG’s own policy says it may sell or share identifiers, internet activity, commercial activity, and geolocation.
• California Business and Professions Code 22948.20, the 2015 connected television law. It prohibits running voice recognition without prominent notice and prohibits using voice recordings for advertising. Worth asking whether the ambient capture and the Alphonso pipeline pass that test.
• California Penal Code 632, the all-party consent law. The TV records people who never agreed. LG’s terms shift that problem onto you by requiring you to get consent from every household member and guest.
• GLBA. A financial advisor taking client calls near one of these TVs has the same exposure as the physician down the hall.
• FERPA. Put one of these in a classroom, a counselor’s office, or a school conference room and it’s capturing student names, conversations, and the devices on the school network. That’s protected education data leaving the building with no agreement from the school, the parent, or the student.
• GDPR. LG’s 2022 claim that content recognition was double opt-in and compliant with global privacy rules doesn’t match the single opt-in the researchers observed.

That’s 7. Add the Federal Trade Commission’s authority over unfair and deceptive practices, and I’d argue for 8. Reasonable people can debate the count. Nobody can debate the pattern.

Why this is a business risk and not a gadget story

I’ve spent 25 years telling CEOs that cyber risk is a financial risk. This is the cleanest example I’ve seen in a while, because there’s no code to write and no phishing email to fall for. The risk walked in the door on a delivery cart.

• Insurability. Your cyber insurer asks whether you control every device on your network. A TV that inventories the network and can record the boardroom is an unmanaged endpoint, and you told the underwriter you didn’t have any.
• External scrutiny. Try explaining to a regulator, a buyer in due diligence, or a plaintiff’s attorney that the breach traced back to the television in the conference room. There’s no version of that story where you look prepared.
• Your remedy is gone. LG added forced arbitration and a class action waiver to its terms after the first investigation aired. The normal consumer path is closed.
• You can’t fix it yourself. DMCA Section 1201 makes it a potential federal offense for you, or a company you hire, to strip the tracking software off a TV you own.

Read that last one again. You paid for the hardware. You’re not allowed to make it stop watching you.

What I’d do this week

You don’t need a project plan for this. You need an afternoon.

• Walk the building and count the smart TVs. Conference rooms, lobbies, exam rooms, classrooms, break rooms, the CEO’s office. Write down the make and model.
• Pull consumer models off the business network. If a TV needs to stay connected, it goes on an isolated network segment with nothing else on it.
• Turn off content recognition. On LG sets it lives under Settings, General, System, Advanced Settings, Live Plus. Then assume it may not have fully stopped, because the researchers found that it doesn’t always.
• Use the TV as a dumb display. Plug in an external streaming box you control and disable the built-in smart features.
• Add every TV to your asset inventory and hand the list to whoever manages your security. If they didn’t already have the TVs on their list, that tells you something about the list.
• If you buy new, buy the commercial version and require the ability to inspect outbound traffic before you sign the PO.

This is also a job for state legislators. They can require “Do Not Sell” and content recognition to be off by default, prohibit network scanning unrelated to the TV’s job, require a real hardware cutoff for every microphone, bar forced arbitration for privacy violations, and direct hospitals and schools to pull consumer TVs off their networks pending review. None of that is exotic. It’s the minimum.

If you only take one line from this: the TV is a computer with multiple microphones and a network scanner, sold at a loss and paid for with your data. Everything else follows from that.

Mike Fitzpatrick

Founder and CEO, NCX Group

Independent cyber risk advisory since 2002. Distinguished Fellow, Ponemon Institute. ncxgroup.com

PS: My grandmother used to lower her voice when she talked about money, even in her own kitchen. I thought it was an old habit from a different era. Turns out she was just early.