# Ambient computing privacy: security of a connected home

**Ambient computing privacy** matters because the connected home is moving from a novelty to an expectation. The Wall Street Journal described a future in which computers are everywhere, all the time, with devices that monitor the fridge, suggest what to wear, project the calendar onto the bathroom mirror and adjust heating according to movement. Much of that future already exists on a smaller scale, and every added connection brings data and risk.

## A network of everyday devices

Ambient computing extends beyond the home into workplaces and mobility. Driverless cars could move people through traffic and park without intervention, while intelligent systems regulate heating, ventilation and air conditioning according to employee movements and schedules. Buildings could communicate with utilities to improve energy production and storage. Experts place the full revolution within five to ten years, and it is already present on a smaller scale, since most people own at least one smart device such as a virtual assistant or a smart thermostat. Precedence Research estimates that more than half of American households, 53.9%, will actively use smart-home devices within a year, and that the global smart device market will reach 581 billion dollars by 2030.

## APIs as connective tissue

Each of these devices connects through application programming interfaces. More APIs mean more risk, because they are the connective tissue between everything digital. When someone adjusts the living room lighting through a phone app, that communication travels through an API. The same devices collect sensitive data about daily life, from sleep patterns to the times a person leaves and returns home. Giving [interconnected devices](/en/ecorner/2023/iot-italy-growth.html) access to that data makes life easier and creates implications that deserve attention. A coffee machine that starts when the household wakes is convenient. A health insurance premium adjusted according to the packaged sweets ordered by a smart freezer is a different prospect.

## Sensitive data and open questions

Even in a world with policies that protect consumers, the information remains stored and available. Risks range from identity theft to data used dishonestly for marketing, to the consequences that a change of government could have on citizens. Information persists and can be used decades later. The priority is to strengthen API security and the authorisation regimes around it, along with the ways data is used and the guarantees that protect all parties. The growth in the number of APIs created, managed and used in these environments, combined with rising traffic and data volumes, is a genuine problem. Add micro-services and device-to-device connections, and the risk grows further. For an attacker who knows what to do, exploiting those connections after finding a vulnerability can be relatively simple.

## Security at scale

Scaling a security team exponentially to protect an expanding and vulnerable environment is not feasible. What works is more intelligent analysis of information in motion, able to respond at the speed and scale of the data. Automation is essential to close the gap between what a security team can afford and the large attack surface that exists today, and that surface will grow sharply with the spread of ambient computing in mobility, homes and workplaces. Whether a person looks forward to a smart home or is still adjusting to a virtual assistant, API security affects everyone. As ambient computing evolves, automation plays a vital role in protecting APIs, and each user contributes by improving their own awareness.

## Frequently asked questions

**What is ambient computing?**
It is the model in which computing spreads across everyday environments, connecting devices in homes, workplaces and mobility so that they monitor, anticipate and act without explicit commands.

**Why does it increase security risk?**
Each device connects through APIs, and more connections mean a wider attack surface. The devices also collect sensitive data about daily routines that becomes valuable to attackers.

**Which data is most exposed?**
Sleep patterns, presence at home, movement, consumption habits and device interactions. Combined, they describe routines in detail and remain stored for a long time.

**What reduces the risk?**
Strong API security and authorisation regimes, automation that analyses traffic at scale, and greater awareness among users and organisations that deploy these systems.

## Sources

The Wall Street Journal — the future of ambient computing — https://www.wsj.com/
Precedence Research — smart home market forecast — https://www.precedenceresearch.com/
OWASP — API Security Top 10 — https://owasp.org/www-project-api-security/
European Commission — data protection in the EU — https://commission.europa.eu/law/law-topic/data-protection_en