 BB-8]{}, and [Toymail]{}; the rest have not responded even after 6 months. Overall, most responses (and lack thereof) indicate that these companies take privacy matters much more frivolously than expected.

Related work {#sec:related}
============

Smart electronics for children have made the news for security breaches numerous times in the past; e.g., see Rapid7 [@rapid72015iot] (strangers could hack baby monitors to view children sleeping and even talk to them directly), Norwegian Consumer Council [@bouvet2016toys] (highlight dangerous security vulnerabilities in 3 toys: i-Que, My Friend Cayla, and [Hello Barbie]{}), Motherboard [@motherboard2016gps] (strangers could track children’s location and message them through the HereO smart watch), and BBC [@bbcgermany2017cayla] (German ban on Cayla in February 2017, branding it as an “illegal espionage apparatus”). Like wearables for adults, many smart toys are Bluetooth-enabled and accompany children outside the home, and previous research on fitness trackers has uncovered numerous vulnerabilities such as location tracking [@Hilts2016fitness].

Several security breaches involving the [VTech InnoTab MAX]{} have been reported. In 2015, VTech’s Learning Lodge database, used by the VTech suite of children’s tablets, suffered a severe breach, exposing the PII of 6.3 million children’s profiles [@vtech2017breach]. The breach was due to a combination of insecure practices, e.g., PII was sent in plaintext (no HTTPS), the database was vulnerable to a simple SQL injection attack, and account passwords were stored using an MD5 hash (no salting). The breach ultimately led to a \$650,000 settlement with the U.S. Federal Trade Commission for unauthorized collection of children’s personal information and for failing to secure that information [@ftc2018vtechsettlement], and a related finding from Canada’s Privacy Commissioner that VTech was in breach of its privacy laws (but no corresponding settlement) [@pipeda2018vtech]. Also in 2016, the UK-based security firm Pen Test Partners found that the [VTech InnoTab MAX]{} is vulnerable to trivial data extraction [@ptpvtech2015extraction]. (We found that this flaw has not been fixed.) Later in 2016, it was found that
BB-8 ] { }, and [ Toymail ] { }; the rest have not responded even after 6 months. Overall, most responses (and lack thence) bespeak that these companies take privacy count much more frivolously than expect. 

 Related oeuvre { # sec: relate } 
 = = = = = = = = = = = = 

 Smart electronics for child have made the news for security system breaches numerous times in the past; e.g., see Rapid7   [ @rapid72015iot ] (stranger could hack baby monitors to view children sleep and even talk to them directly), Norwegian Consumer Council   [ @bouvet2016toys ] (highlight dangerous security system vulnerabilities in 3 toys: i - Que, My ally Cayla, and [ Hello Barbie ] { }), Motherboard   [ @motherboard2016gps ] (strangers could chase children ’s location and message them through the HereO smart watch), and BBC   [ @bbcgermany2017cayla ] (German ban on Cayla in February 2017, brand it as an “ illegal espionage apparatus ”). Like wearables for adults, many smart toys are Bluetooth - enabled and accompany children outside the home, and previous research on fitness trackers has uncovered numerous vulnerabilities such as location tracking   [ @Hilts2016fitness ]. 

 Several security system breach involving the [ VTech InnoTab MAX ] { }   have been report. In 2015, VTech ’s Learning Lodge database, use by the VTech suite of children ’s tablets, suffered a severe breach, exposing the PII of 6.3 million child ’s profiles   [ @vtech2017breach ]. The breach was due to a combination of insecure practices, e.g., PII was sent in plaintext (no HTTPS), the database was vulnerable to a bare SQL injection attack, and account passwords were stored use an MD5 hashish (no salting). The rupture ultimately head to a \$650,000 settlement with the U.S. Federal Trade Commission for unauthorized collection of children ’s personal data and for failing to secure that information   [ @ftc2018vtechsettlement ], and a related finding from Canada ’s Privacy Commissioner that VTech was in breach of its privacy laws (but no corresponding settlement)   [ @pipeda2018vtech ]. besides in 2016, the UK - based security firm Pen Test Partners found that the [ VTech InnoTab MAX ] { }   is vulnerable to trivial data origin   [ @ptpvtech2015extraction ]. (We found that this flaw has not been fixed .) Later in 2016, it was find that
 BB-8]{}, and [Toymail]{}; the rest haye not responded even ahter 6 mknths. Ovdrall, most responses (and lacn rhereif) indicate that these companied take peivary matters much more friyjlouapy tkai expected.

Relatgd work {#sec:ralated}
============

Smart elacgrlnics for children have made the ners for xefurity breachef nukqroua times in the past; e.g., see Rapid7 [@ralid72015iot] (vtrangers coukd hack baby monitors to vlew fhildren sleeping wnd even taok tj them directuy), Norwegian Consumer Douncil [@bouvet2016toys] (highlight daneeroux security vylnftabilities ii 3 toyf: i-Que, My Frlvnd Cayna, and [Nello Barbie]{}), Mpthxrboqrd [@motherboard2016gps] (strengers could track crildren’s noeation and message thwm throogh tve HdeeO smzrv wztch), ajd UBC [@bbcgermahy2017cayla] (Gernan ban on Cayla in Fqvruary 2017, brandjng it af an “illegal espionage apparatus”). Like wtarabmes for adults, many smaet toys are Bluetooth-gnabled anq accompany children outside the home, and previouv resxafch ok figbeds trackers has uncovered numerous vulnerabilyfits xuch as locatijn tracking [@Niptx2016sitness].

Severau secuxjtg breaches involvijg the [DTech InnoTab IAX]{} hsve been reported. In 2015, VTech’w Learning Ljege database, used yy the VTech suije of vhildren’s tablets, suffexed a aevere breafh, exposihe the PII of 6.3 miulipn children’s profiles [@vtech2017brqach]. The ureack was dud to a comfination ov inscwure practices, e.g., OII wcs sett in plaijtext (no HTTPS), the database was vulnerable to a sikple SQL injegtion attack, anq account passcords wexe stofed using zn MD5 hesh (no saltigg). The breach oltimately lev to a \$650,000 sqttlwmenr with gfe U.S. Federal Yrade Commission foe unauthorized colkecjikn of children’s petwonal informatoon anq voc faijhng to secura thxt kmformxtion [@ftc2018vteghsdttlrment], and a related xindjng from Canada’s Ptiyacy Commussioner that VTech wss in breach of itd pritacy lews (buy nj corresponding settlement) [@pipesa2018vtech]. Apso in 2016, the UK-bwsed security fixm Pen Test Partners found that the [VTeci InnoTab MAX]{} is vulneravle to trivial data txtraction [@ptpttech2015evtraction]. (We found that this dlaw has not been fixed.) Later in 2016, it wzs foutd thwt
BB-8]{}, and [Toymail]{}; the rest have not after months. Overall, responses (and lack take matters much more than expected. Related {#sec:related} ============ Smart electronics for children made the news for security breaches numerous times in the past; e.g., see [@rapid72015iot] (strangers could hack baby monitors to view children sleeping and even talk them Norwegian Council (highlight dangerous security vulnerabilities in 3 toys: i-Que, My Friend Cayla, and [Hello Barbie]{}), Motherboard [@motherboard2016gps] could track children’s location and message them through HereO smart watch), and [@bbcgermany2017cayla] (German ban on Cayla February branding it an espionage Like wearables for many smart toys are Bluetooth-enabled and accompany children outside the home, and previous research on fitness trackers uncovered numerous as location [@Hilts2016fitness]. security involving the [VTech have been reported. In 2015, VTech’s used by the VTech suite of children’s tablets, a severe exposing the PII of 6.3 million profiles [@vtech2017breach]. The breach was due to a of insecure practices, e.g., PII was sent in plaintext (no HTTPS), the database was vulnerable simple SQL injection attack, account passwords were using MD5 (no The breach led to a \$650,000 settlement with the U.S. Federal Trade Commission unauthorized collection of children’s personal information and for failing to information and a related from Canada’s Privacy Commissioner VTech in breach of its (but corresponding in the security firm Pen Test found that the [VTech InnoTab is vulnerable to trivial that this flaw has not been fixed.) Later 2016, it was found that
 BB-8]{}, and [Toymail]{}; the rest have noT responded Even aFteR 6 moNtHs. OvEralL, most responses (ANd laCk thereof) indicate that tHese cOmPAnieS TaKe priVacy matTErS MUch MoRe FriVoLOuSly thAn eXpected.

related worK {#seC:rElated}
============

Smart eLEcTronics for ChiLdren have madE thE news fOr SecURity bReaChes nUmerouS Times iN the past; e.G., sEE Rapid7 [@RApid72015iot] (STRaNgerS could hack baby monIToRS to view childreN sleepInG AnD EVen TalK to them dirEcTly), NoRWegian CONsUMER CoUNcil [@bouvet2016toyS] (highlight dANgeRous seCuRitY VulnerAbiliTiES in 3 Toys: i-Que, My FRienD Cayla, and [hello BARbie]{}), MotHErboard [@MotherBoaRd2016gPs] (stRAnGeRs cOuLD trACk ChiLDreN’s locatiOn AnD messAge tHEM THrouGh tHe HeReO smArt watch), and BBc [@bbCgerMAny2017Cayla] (germaN ban On cayla In FebrUary 2017, bRaNding it as an “illeGal eSpionage aPpaRaTus”). liKe weaRAbles fOr aDulTs, many sMart toyS Are blUETOoTh-enabled and accompAnY CHiLdren outSide thE HoMe, ANd previoUs ResEarcH ON fitnEss tRAcKers has uNcoverED nUmErous vuLnErabilItIes SucH as loCAtioN trackIng [@Hilts2016FitneSS].

Several securiTY breaches invoLViNG ThE [vTecH InNoTab MAX]{} havE beeN RepoRted. iN 2015, VtecH’S LearNing LOdGE dATabase, used by the VTecH sUite of ChildRen’s tablets, suFfered a sevERE Breach, exPosiNG tHE PII of 6.3 million cHildrEn’s profileS [@Vtech2017breAch]. ThE breach wAs due to a cOMBination Of iNseCurE prACTiCes, e.g., PII was seNT In plAiNtext (no hTTpS), the daTabAse Was VulNeRable to a sImple SQL InJeCtIoN atTack, aND account PaSswOrDs wEre stORed usiNg an Md5 hasH (nO sALtiNg). The brEAcH ULtimAtElY led To a \$650,000 SeTtlemEnt wITh tHe U.S. FedEral Trade comMIssiOn FoR unauthOrized collectIoN of childreN’s PerSonal iNFOrmation And for failing to secure thAT informAtiOn [@ftc2018VtecHsettlemeNt], aNd a relAteD FindinG from CAnada’S PRivACY CommISSiOneR tHat VTech waS IN brEach oF iTs prIvacy laWs (but no correspondiNG seTtlement) [@pipedA2018vtEch]. ALSO iN 2016, thE uK-BAseD sECurITY firm Pen Test ParTners found ThAT tHe [VTech InnOtab mAx]{} is vulnErable tO trivIAl data eXtraction [@Ptpvtech2015eXtRactION]. (We Found that tHis flaw hAs not been FIxed.) LATeR in 2016, it Was Found tHaT
 BB-8]{}, and [Toymail]{};  the resthavenot  re sp onde d ev en after 6 mon t hs.Overall, most response s (an dl ackt he reof)  indica t et h atth es e c om p an ies t ake  privac y mattersmuc hmore frivolo u sl y than exp ect ed.

Related  wo rk {#s ec :re l ated} 
== ===== =====Smartelectroni cs for ch i ldren h a v emade  the news for sec u ri t y breaches num erousti m es i n t hepast; e.g. ,see R a pid7 [@ r ap i d 7 201 5 iot] (strange rs could ha c k b aby mo ni tor s  to vi ew ch il d ren  sleeping a nd e ven talkto the m  direct l y), Nor wegian  Co nsu merC ou nc il[@ b ouv e t2 016 t oys ] (highl ig ht  dang erou s s e curi tyvuln erabi lities in 3 t oys : i- Q ue,  My F riend  Cay la , and  [Hell o Bar bi e]{}), Motherbo ard[@motherb oar d2 016 gp s] (s t ranger s c oul d track  childr e n’s  l o c a ti on and message the mt h ro ugh theHereOs ma rt watch),an d B BC [ @ b bcger many 2 01 7cayla](Germa n  b an  on Cay la  in Fe br uar y 2 017,b rand ing it  as an “ illeg a l espionage ap p aratus”). Lik e  w e a ra b lesfor  adults, ma ny s m arttoys ar e B l uetoo th-en ab l ed and accompany child re n outs ide t he home, andprevious r e s e arch onfitn e ss trackers has u ncove red numero u s vulner abili ties suc h as loca t i on track ing  [@ Hil ts2 0 1 6f itness].

Sev e r al s ec urity b rea ches in vol vin g t he[V Tech Inno Tab MAX] {}  h av ebee n rep o rted. In  2 015 ,VTe ch’sL earnin g Lod ge d at ab a se,  used b y  t h e  VTe ch  s uite  of  c hildr en’s tab lets, s uffered a  se v erebr ea ch, exp osing the PII  o f 6.3 mill io n c hildre n ’ s profil es [@vtech2017breach].T he brea chwas d ue t o a combi nat ion of  in s ecurepracti ces,e. g., P II wa s se ntin  plaintext ( noHTTPS ),  the  databa se was vulnerablet o a  simple SQL i nje ctio n at tac k ,a ndac c oun t passwords werestored usi ng an  MD5 hash( nosa lting).  The br eachu ltimate ly led to  a \$650, 00 0 se t t lem ent with t he U.S.Federal T r ade C o mm issio n f or una ut hor izedcollec t ion  of c hildre n’ s pers onalin formatio n and for failing to se cure t hat i nfo rmation [ @ft c 201 8vtechset tlem ent], anda r ela ted f ind i ng fr om C a na da’ s  Priv acyC ommission e rtha t VT ech was inb r e ach  of i tsp rivacy  law s (but no corresp o nding settleme nt)[ @ pip eda 2 018v te ch]. Also in 2 016 ,t h e UK-bas ed  security f irm PenTe s t Par tnersfoundthat th e [V T ech In noTa b M AX]{} isvul ne r able to  t ri v ial da ta e xt ractio n [@pt p vtec h 2 015extraction].(We f o u nd th a t t his f la w has n o t be en fixed.)  Later in 2 016, i t wa s fou nd that 
 BB-8]{},_and [Toymail]{};_the rest have not_responded even_after_6 months._Overall,_most responses (and_lack thereof) indicate_that these companies take_privacy matters much_more_frivolously than expected.

Related work {#sec:related}
============

Smart electronics for children have made the news for security_breaches_numerous times_in_the_past; e.g., see Rapid7 [@rapid72015iot] (strangers_could hack baby monitors to_view children_sleeping and even talk to them directly), Norwegian_Consumer_Council [@bouvet2016toys] (highlight dangerous_security vulnerabilities in 3 toys: i-Que, My Friend Cayla,_and [Hello Barbie]{}), Motherboard [@motherboard2016gps] (strangers could_track children’s location_and_message_them through the HereO_smart watch), and BBC [@bbcgermany2017cayla] (German ban_on Cayla in February 2017, branding_it as an “illegal espionage apparatus”). Like_wearables for adults, many smart toys_are Bluetooth-enabled and accompany children_outside the_home, and previous research on_fitness trackers has_uncovered numerous_vulnerabilities such as_location tracking [@Hilts2016fitness].

Several security breaches involving the_[VTech InnoTab MAX]{} have_been reported. In 2015, VTech’s Learning_Lodge_database, used by_the_VTech_suite of_children’s tablets, suffered_a_severe breach,_exposing_the PII of 6.3 million children’s_profiles [@vtech2017breach]._The breach was due to a combination_of insecure practices, e.g.,_PII_was sent in plaintext_(no HTTPS), the database was_vulnerable to a simple SQL injection_attack, and_account passwords_were stored using an MD5 hash (no salting). The breach ultimately_led to a \$650,000 settlement with_the U.S. Federal Trade_Commission for_unauthorized_collection of children’s_personal_information and_for failing to secure that information [@ftc2018vtechsettlement], and_a related_finding from Canada’s Privacy Commissioner that_VTech was in breach_of_its privacy laws (but no corresponding_settlement) [@pipeda2018vtech]. Also in 2016, the UK-based_security firm Pen Test Partners_found_that_the [VTech InnoTab MAX]{} is vulnerable_to trivial data extraction [@ptpvtech2015extraction]. (We found_that this flaw_has not been fixed.) Later in 2016,_it_was found that