Unsurprisingly, few people have considered the inherent dangers of robot vacuums, aside perhaps from the early buyers who saw them track pet poop through every room. Yet companies and hackers have used them to spy, eavesdrop, map houses, and worse. Now federal rules are placing almost all future robot vacuums in a new category of “advanced robotic devices” that foreign manufacturers cannot import into the U.S. without the government’s conditional approval.
Are Roombas going to be illegal? Will you have to turn yours in and get another upright vacuum? Briefly, no and no. The models on shelves now have FCC equipment authorization, and older models are grandfathered in.
The FCC’s Covered List and Its Rules
Under a 2019 federal law, the Federal Communications Commission must maintain the Covered List, identifying communications equipment or services that could potentially endanger the U.S. or American users. This covers any device or service that a foreign entity could use to redirect data traffic, view user data, disrupt U.S. communications providers, or otherwise “pose an unacceptable risk.” The government will forbid the import of any devices determined to be unsafe.
The FCC has recently added new categories to the Covered List, including “foreign-produced advanced robotic devices.” In its National Security Determination on the Threat Posed by Foreign-Produced Advanced Robotic Devices, the FCC notes that mobile robots and devices “collect data that could be leveraged by malign actors to surveil Americans … or to remotely commandeer the robots.” It cites several examples, including the story of Sammy Azdoufal, a software engineer who accidentally discovered how to access the cameras and maps of 7,000 other DJI Romo robot vacuums besides his own. He reported the problem, but other hackers have used robot vacuums to invade privacy and alarm pets.
The FCC’s definition of “advanced robotic devices” includes humanoids and quadrupeds, but it also covers any device that is capable of locomotion and obstacle avoidance that can be operated at a distance, provided it:
- Can perceive its environment
- Has network connectivity
- Has software that controls the robot's navigation and data collection.
See the National Security Determination for full details. This definition covers robot lawnmowers as well as vacuums and other mobile robots.
Here, the government defines “foreign-produced” items to include products with a specific percentage of foreign-sourced components, as per 48 CFR § 25.101. Because tech manufacturing and supply chains depend so heavily on imported goods, the National Security Determination is likely to affect every robotics brand. Even so, the law does not ban currently available FCC-certified robot vacuums and older models. Consumers can legally continue their use — although that may not guarantee their safety.
Regulations and the Government’s Goals
The security concerns with foreign-made robotic devices are very real, just as with routers, drones, and other recent targets of FCC product regulation. However, tech reporter Sean Hollister identifies a second possible motive: requiring foreign companies to manufacture in the U.S. As he points out, the government’s application for conditional approval of a robotic device has no questions about security measures in the product. Instead, it focuses on company ownership and the origin of the product, requesting a “detailed, time-bound plan to establish or expand manufacturing in the United States.”
Buyers of new and used robotic products should check on any security reports and news stories about possible exploits. DJI has since patched the security flaw Azdoufal found in its vacuums (and, incidentally, iRobot has addressed the poop issue). Nonetheless, bad actors are always watching for possible exploits, and as products age, they become more vulnerable. Whether they vacuum, mop, watch your children, or handle your email, any networked devices should be handled with care.
