User Perceptions and Experiences with Smart Home Updates

### Overview This presentation details an empirical research study conducted in collaboration with Julie Haney at the National Institute of Standards and Technology (NIST) examining how consumers perceive and experience software and firmware updates for smart home IoT devices. With approximately half of U.S. households owning at least one IoT device, updates serve as a primary mechanism for manufacturers to patch security flaws and deliver functionality. However, consumer hesitation, disruption, and lack of technical savvy often impede timely patching. To address the lack of large-scale empirical studies in this area, the researchers surveyed 412 demographically diverse adult participants who were active users and administrators of smart home devices across five key categories: virtual voice assistants/smart speakers, smart thermostats, smart security devices, smart sensors, and smart lighting.

### Key Topics - **Device Ownership and Category Differences**: Participants owned an average of nine smart devices, with 35% owning 10 or more. The study examined how perceptions varied across device types with varying levels of sophistication and perceived privacy/security exposure. - **Perceptions of Update Importance and Urgency**: Assessing whether consumers view IoT device updates as critical and time-sensitive. - **Current vs. Preferred Update Modes and Notifications**: How updates are handled (automatic vs. manual), how users are informed of new updates, and how they would prefer these mechanisms to work. - **Security and Privacy Concerns**: Consumer trust in device security and privacy, and how concern levels correlate with update behaviors.

### Technical Details & Survey Findings - **Importance and Urgency**: Overall, 86% of participants agreed that smart home updates are important, and 83% agreed they should be urgent. However, pairwise comparisons revealed significant differences: lighting updates were viewed as significantly less important and less urgent than other categories, while security devices were rated significantly more urgent and important than voice assistants. - **Update Delivery Modes**: Automatic updates were the most commonly implemented method across all categories and were preferred for voice assistants and thermostats. In contrast, users preferred manual updates for security devices and sensors. Between 13% and 21% of respondents did not know how updates were currently handled on their devices. - **User Agency and Preferences**: Over 50% of participants expressed a desire to choose between automatic and manual updates and to select their notification methods. Additionally, 40% wanted the capability to uninstall an update if it caused issues or disruptions. Companion apps were the most common and preferred notification channel, though roughly 25% reported having to learn about updates independently via social media, websites, or friends. - **Security and Privacy Perceptions**: Only about one-third of participants were moderately or extremely concerned about security across all device categories. Voice assistants (perceived as always listening) and security devices elicited higher security and privacy concerns than thermostats, sensors, or lighting. Crucially, 77% of respondents believed their devices were secure, and 77% believed their devices actively protected their privacy—assumptions the speaker noted as surprisingly optimistic given typical IoT vulnerability profiles.

### Takeaways & Manufacturer Guidance - **Transparency and Communication**: Manufacturers should clearly communicate the purpose of updates, when they are applied, and what changes they make, potentially leveraging cybersecurity labels to help non-technical consumers evaluate device security. - **Configurable Control and Agency**: Rather than imposing a rigid, one-size-fits-all automatic update model, manufacturers should offer configurable options, such as choices between manual and automatic updates, scheduling installations for convenient times, and providing fallback/uninstall options when updates introduce compatibility or functionality defects. - **Centralized Management**: To alleviate the burden of managing updates across dozens of devices, centralized apps or smart home hubs should consolidate notifications and coordinate update processes across multiple vendors.