Skip to content
Naked Security Naked Security

Why you shouldn’t trust baby health monitors

Gadgets to monitor your baby's health not only could pose a security risk, they could also be worse than useless, potentially causing real harm

Consumer gadgets to track the health of your baby could be a waste of money, according to new reports from the US – and worse, they may either lead you to believe your child is in danger when he or she is fine, or offer false reassurance when there’s an actual problem. The issue appears to be that a handful of people are treating shop-bought trinkets as a substitute for proper medical assessment.

One case has emerged on the Philly.com site, in which parents took their child to the Children’s Hospital of Philadelphia because its apnea monitor kept going off. The staff were anticipating readings from an industrial-strength apnea monitor; they were surprised when the gadget turned out to be a monitor in the child’s nappy. Happily the child was fine.

And of course, there are many concerns around the security of devices that are connected to the internet, all the more so if it’s a device collecting the data of a child. Mark Noctor of IoT security company Arxan says:

Aside from the idea of a malicious stranger accessing their baby’s medical information being unnerving for any parent, it’s also worth remembering that medical records continue to be a lucrative item on the black market. The partial data delivered by a baby sensor may not be worth as much, but if the device is easy to attack it will still be an attractive target for financially motivated cyber criminals.

There is also the ongoing issue of poorly secured devices being co-opted for botnets. Says Noctor:

The Mirai botnet was able to infect millions of connected devices because so many are still using their factory default login information. It should be standard practice for all devices to force users to change their details when they set the device up. Until this is enforced – by law if necessary – it will be child’s play for even an inexperienced attacker to access and manipulate most devices.

One of the doctors involved has co-written an article in the Journal of the American Medical Association to point out that devices like this are not checked by the Food and Drug Agency for safety or efficacy. They are available in forms from inserts for socks or onesies, nappy attachments and a great many other variants, and they communicate with a smartphone app, sending alerts when such a thing is deemed necessary. They are not, however, clinically approved.

The manufacturer behind the widget in the Philly.com story, Owlet, pointed out in a statement that it has a device going through medical accreditation right now. In addition, it pointed out:

Due to innovations developed by Owlet to lessen false alarms, many users will use the Owlet Sock for several months without ever getting a false alarm, greatly reducing the risk over diagnosis. Additional product enhancements and features include use of wireless technology to eliminate cords as well as a smartphone connectivity integration that fits parents’ lifestyle.

It has also undergone other safety testing to bring it to American standards.

We’ve been here before. Smart watches offering heart-rate monitoring can be a useful guide but are no substitute for clinically calibrated equipment. Ditto home blood pressure testing gear. Indeed, Owlet points to the fact that it uses the same technology as the Apple Watch and Fitbit as a badge of honour.

These gadgets are fine for a rough idea but not for a formal diagnosis. Trust your child’s health to one of them and take no other input and you’re bound to be in trouble. The question is how many false positives will they throw up (Owlet says you can go “months” without a false alarm, which isn’t all that reassuring) – and worse, if they can err in one direction, will they also fail to detect occasionally when there is actually an issue?

There’s a message in here related to the one about using satnavs for road safety rather than watching the road, or social media apps for social life instead of talking to actual people; a connected device is a useful addition to, but not a substitute for, human experience and scrutiny. Whether connecting your child’s health data, flawed or otherwise, to an app is the most secure thing to do is yet another debate.


2 Comments

Aren’t they practicing medicine without a license? And, most likely, they’re practicing from another state without a license there, either.

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!