Illustration. The glasses shown in the image are not smart glasses.
Banning photography in production facilities or requiring employees to leave their phones outside a meeting room during an important meeting are familiar security practices in many companies. Smart glasses introduce a new challenge, as a recording device can be difficult to distinguish from ordinary eyewear. This also makes detecting and preventing photography and other forms of information gathering more difficult than before.
Modern smart glasses can incorporate a wide range of technology. Cameras, microphones, speakers and AI features can be integrated into the frames so discreetly that, at a glance, the device may look no different from ordinary prescription glasses or sunglasses. The technology has many useful applications, but it also introduces information security and privacy risks. A malicious visitor could use smart glasses to discreetly record computer screens, conversations, access control systems and workspaces. The risk is not limited to deliberate corporate espionage, however, as information can also leave an organisation unintentionally.
Petteri Ruohomäki, Director responsible for information and corporate security at LähiTapiola, considers the difficulty of detecting smart glasses one of the key risks. AI features also make it possible to process collected information quickly.
“With smart glasses, images, video and audio can be recorded far more discreetly than before, and the devices now also include AI capabilities. This enables criminals to analyse and transmit information and even prepare cyberattacks much faster than previously. Because we are so accustomed to seeing people wearing glasses in the workplace, we are not yet used to thinking that someone might use them maliciously – and that is precisely where the risk lies,” Ruohomäki says in the company’s press release.
A single visit can yield a great deal of information
In corporate espionage, valuable information does not necessarily come from a single document. It can consist of small observations that may not seem particularly significant on their own. During a visit, smart glasses could capture computer screens, employees’ names and access cards, unfinished plans, meeting-room whiteboards or information about how people move around the premises. Systematically recording the same material with a conventional camera would easily attract attention, whereas a person wearing smart glasses may need to do little more than look around.
Eero Järvenpää, Development Manager for cyber insurance at LähiTapiola, estimates that smart glasses make targeted information gathering easier. Instead of having to obtain information over several visits and from numerous sources, a substantial amount of information could be collected during a single visit.
AI adds another dimension to the issue. Rather than manually reviewing large quantities of images or video, collected material can be analysed with AI to quickly identify relevant details. An observation that appears insignificant from a company’s perspective may become valuable when combined with other pieces of information. Material gathered on physical premises could therefore later be used to support fraud, phishing or the preparation of a cyberattack.
Information can also be gathered from conversations
When protecting a business, attention can easily focus on computer screens, documents and other visible information, but smart glasses can also record audio. In a face-to-face conversation, people may disclose things they would not put in an email or say at all if they knew the conversation was being recorded.
This can be exploited in social engineering by gradually steering a conversation in a desired direction. Individual questions may seem harmless, but the answers can form a broader picture of a company’s practices, employees or systems. Reactions to questions captured by the camera may also reveal information. According to Ruohomäki, obtaining such fragments of information through channels such as messaging has previously been difficult, but they may soon be usable for scams even in real time.
From a corporate security perspective, smart glasses therefore bring together two areas that have previously been relatively separate. Information gathered on physical premises can be combined with digital tools that allow the material to be processed and exploited quickly. For this reason, the risks associated with smart glasses should not be viewed solely as a matter of photography or recording, but as part of the broader challenge of protecting corporate information.
Information can also leak entirely by accident
For a company, a likely problem involving smart glasses may have nothing to do with corporate espionage. The devices may be worn for perfectly legitimate reasons by employees, customers, business partners, maintenance personnel and other visitors. Information that the wearer never intended to record may nevertheless enter the camera’s field of view. With smart glasses, such accidental recording can be particularly difficult to notice because people nearby may not even realise that they are within a camera’s field of view.
Companies should also understand what happens to information collected by smart glasses while the device is being used. Practices vary between devices and services, but using AI features may, for example, require data to be processed in cloud services. According to Järvenpää, the data may then also be available for use by the AI models of major technology companies. It may not necessarily be possible to delete the data afterwards or control how it is used.
Smart glasses take businesses into unfamiliar territory
Many companies have restricted photography for years, but smart glasses raise questions about whether existing policies are clear enough. If photography is prohibited at the entrance to a production facility, do employees and visitors automatically understand that the restriction also applies to smart glasses? And what should be done when the glasses are being used for an authorised purpose but inadvertently record information that must not leave the company?
Particular attention should be paid to areas accessible to visitors. Companies should define what kinds of recording devices may be used on their premises and where their use is restricted. Employees should also know how to respond if a visitor is found to be wearing smart glasses in an area where photography or recording is prohibited.
Detecting the devices can nevertheless be difficult, as smart glasses increasingly resemble ordinary eyewear. At present, their frames may still be heavier and their temples thicker than those of conventional glasses because they contain batteries and other technology. A camera integrated into the frame is generally visible from the outside, and an indicator light should illuminate when recording is taking place. A user may, however, attempt to conceal the light or disable it. Even today’s smart glasses can therefore be difficult to identify.
According to Ruohomäki, companies should now consider both the risks and opportunities that smart glasses are likely to bring in the near future.
“They will not only be used by corporate spies or other malicious actors, but potentially also by welcome visitors, maintenance company representatives and companies’ own employees. There are still many questions without answers, but as with AI, it is worth considering the risks and opportunities early on,” Ruohomäki says.
Smart glasses have many practical and beneficial uses, but like other technologies, they can also be used for criminal purposes. They make recording the surrounding environment and processing the information collected easier and more difficult to detect than before. Companies should therefore review their security practices and recognise that, in the future, cameras and AI may not necessarily be carried in an employee’s or visitor’s pocket, but instead be built into a pair of glasses that looks entirely ordinary.