In smart apartments, is tenants’ privacy for rent?

Internet-connected thermostats, locks, and other devices are popular, but also raise concerns about data security.

Jeffrey Kaye, holding a device that was installed in his Woburn apartment without his permission, is fighting eviction.Jonathan Wiggs/The Boston Globe

When Jeffrey Kaye noticed the box full of electronics bolted to the wall of his Woburn apartment, he wasn’t pleased. When he found out what the box was for, Kaye was furious.

The box was an electronic hub from a company called SmartRent, which installs popular “smart home” devices such as Internet-connected digital thermostats, door locks, and water leak detectors in rental apartments.

Kaye claims the box was installed in his apartment without his permission, along with Internet-connected “smart locks.” And he maintains that an ongoing attempt to evict him from his apartment, allegedly due to a late rent payment, is actually revenge for his demand that the technology be disconnected.

“It’s retaliatory in nature,” said Kaye, an attorney, "because I started complaining about SmartRent.”

Colorado-based UDR Inc., which owns Kaye’s apartment building, didn’t respond to multiple requests for comment about its legal dispute with Kaye, now being played out in Northeast Housing Court in Lawrence.

But Kaye isn’t alone in worrying about smart apartments, as real estate developers, technology entrepreneurs, and lawmakers face up to a new kind of privacy challenge. A single-family homeowner can pick and choose which smart devices to purchase or can avoid them altogether. But can apartment dwellers protect their personal data when it’s being collected by smart devices that don’t belong to them? How do you prevent a building’s smart door locks from being hacked? And who’s responsible for keeping device software properly updated and patched to keep hackers out?

Cybersecurity consultant Lesley Carhart takes these issues so seriously she moved out of her Chicago-area apartment when the management began plugging in smart features. She bought a house instead.

“Many people have no choice but to rent and must now live with these systems," Carhart said in an e-mail, "whether they are properly secured and have good privacy policies or not.”

Apartment residents in New York City last year successfully sued a landlord who installed smart locks in 2018. The settlement required that the landlord provide locks with old-fashioned metal keys to all tenants who wanted them.

Partly in response to this case, New York State Assemblywoman Linda Rosenthal has proposed legislation to require owners of smart apartment buildings to offer traditional keys to tenants. But Rosenthal wants to go much further. She’s concerned that smart locks, and the smartphone apps that operate them, would let landlords keep track of tenants’ comings and goings. She said such apps could be programmed to track people’s movements even when they are not at home.

So Rosenthal has proposed legislation to require that any such location data be used solely to provide services to tenants, not to spy on them. The data couldn’t be shared with anyone without the tenant’s consent and landlords would be liable for damages if they failed to protect the information from hackers. Rosenthal told the Globe that to the best of her knowledge, no US state presently regulates the privacy and security of tenant data collected by smart devices.

For now, disgruntled renters like Kaye are in the minority, according to a new survey from the National Multifamily Housing Council. The survey found that 70 percent of renters want smart thermostats in their apartments, and would pay an extra $30 a month in rent to get them; 67 percent would pay more for smart lighting fixtures; and 63 percent would shell out more money for remote-controlled smart locks.

Real estate developers are giving tenants what they want. Companies such as UDR are scrambling to install smart tech in their units. STRATIS IoT Inc. of Philadelphia, a major maker of smart apartment systems, said that its products were installed in 20 percent of all new multifamily housing units built in the United States last year. And that doesn’t count thousands of installations by competitors including SmartRent, Vivent, IOTAS, and Zego.

Developers say smart tech can save building owners a fortune, by making the apartments more secure. “It’s all about the benefits for the owners and managers,” said Robert Cooper, president of Embue,a Boston company that runs a cloud-based service for managing smart apartment buildings.

For example, smart leak detectors can warn of an overflowing toilet before spilled water can cause thousands in damages to the apartments below. And smart door locks can warn that an intruder is trying to break into every apartment on the fifth floor.

"If you’re building a new apartment building and you’re not having this stuff in there, you’re building an obsolete apartment building,” said Shawn Mahoney,chief technology officer of Boston property developer GID.

UDR chose technology from SmartRent, an Arizona company backed in part by Bain Capital Ventures of Boston, which led a $32 million funding round last year. SmartRent’s system has been installed in about 70,000apartment units nationwide.

“This is something the residents really want and demand,” said SmartRent’s chief executive Lucas Haldeman,who estimates that only “one half of one percent” of apartment dwellers have objected.

Count Kaye among the objectors.

He worries that UDR and SmartRent could keep a permanent record of every time Kaye locks or unlocks the door and that the companies could sell that information to online marketing companies without his permission.

But SmartRent’s Haldeman said the company does not sell the data these systems collect, and all tenant information is deleted after 30 days. Haldeman also said companies that use SmartRent are supposed to give tenants the right to opt out of using the system’s smart features.

Not all companies operate by those rules. For instance, IOTAS, a smart apartment tech firm in Portland, Ore., reserves the right to share tenant data with advertising companies, but users can opt out on request.

In another nod to privacy, smart apartment companies generally refrain from installing voice-activated personal assistants like Amazon Alexa or Google Home because so many consumers worry that these devices may record their conversations without permission. “The voice assistants are the things most people have the angst about," said Zego chief executive Dirk Wakeham.

The tech companies also say they’re developing tough security measures to keep hackers out. They’re responsible for protecting the tenants’ stored data and also for updating the software on the smart devices in their apartments.

But for now, renters in Massachusetts must take their word for it. In California, tenants can count on that state’s new privacy law, which lets citizens forbid the sale of their personal data and requires businesses to delete such data at a customer’s request. The law also imposes civil penalties on companies that suffer customer data thefts due to inadequate security procedures.

Smart apartment pioneers say they’re open to the idea of uniform federal security and privacy standards for apartment technology. “We do need legislation," said Felicite Moorman, chief executive of STRATIS IoT. “It’s too complicated for consumers to understand absolutely everything that we do.”

In the meantime, Kaye’s lease expires later this month. He intends to keep fighting UDR over its alleged invasion of privacy, but soon he’ll be doing it from a distance.

“I’m moving to Martha’s Vineyard," Kaye said, "where there’s no eavesdropping.”