[비즈한국] As AI enters the home appliance sector, security has emerged as a new challenge for the industry. While recent major security incidents have primarily involved Chinese-made products, domestic companies are finding it difficult to lower their guard. From TVs to refrigerators, devices are increasingly connected to networks, leading to a massive accumulation of personal information in cloud storage. As the smart appliance market grows, the demand for security is also expected to rise. Meanwhile, the government is struggling to devise countermeasures, such as expanding the use of the Privacy by Design (PbD) pilot certification system, albeit a step behind.
Recently, concerns over privacy leaks via home appliances have spread due to the intersection of potential hacking risks in Chinese robot vacuums and the circulation of hacked IP camera footage. Late last month, foreign media, including the New York Post, reported user accounts alleging that Ecovacs Deebot X2s models spewed sexual and racial slurs. There have also been reports of robot vacuums following family members and pets around the house. Ecovacs is a Chinese brand that, along with Roborock and Dreame, has dominated the domestic and international markets. They have marketed themselves based on performance rather than price, and the market share of major Chinese brands in Korea is nearing 80%. Earlier at Def Con, the world's largest security conference held in August, it was pointed out that the microphones and cameras of Chinese robot vacuums and lawn mowers are vulnerable to hacking. As a result, anxiety among domestic users regarding the risk of personal information leakage is growing.
'Spy Cam' Appliances: Limitations of Domestic 'Voluntary Certification'
The hacking issue is most pronounced in products equipped with video recording capabilities, as home appliances placed in bedrooms, living rooms, and kitchens have the potential to instantly turn into "spy cameras." While this has been a relatively long-standing issue in the fields of home CCTV and wall pads (home network devices mounted indoors), the necessity for relevant regulations has grown as domestic appliance companies create environments where devices can be controlled via mobile, and video functions are integrated into various household appliances.
Certification mechanisms to prepare for such incidents are in place. Currently, the government operates the "IoT Security Certification" and the "Privacy by Design (PbD) Certification" in parallel. Operation and management are overseen by the Personal Information Protection Commission (PIPC) and the Korea Internet & Security Agency (KISA). Based on Article 48-6 of the Information and Communications Network Act, the IoT security certification is widely applied across eight sectors, including appliances, transportation, finance, smart cities, healthcare, manufacturing, housing, and communications. It verifies 50 items such as identification, authentication, data protection, encryption, software and network security, and hardware security.
However, it appears that there are no certification cases for foreign companies, and the performance for domestic companies is also poor. Looking at the status of IoT security certification, it started with 4 cases in 2018 when the system was first introduced, followed by 24 in 2019, 21 in 2020, and 73 in 2021. With 83 cases in 2022 and 82 in 2023, the number of products that actually received certification has not exceeded 100 per year.
Most of these are digital door locks or wall pads, and the majority hold "Lite" or "Basic" ratings—which cover general security systems or small IoT devices—rather than the "Standard" rating, which requires higher security thresholds. The number of applying companies dropped by half from 49 in 2022 to 27 last year, and as of August this year, 52 companies have applied for certification, with 51 cases granted.
Samsung and LG Lack Domestic IoT Certification, Focusing on Strengthening In-House Security
According to the office of Representative Lee Jung-hun of the National Assembly's Science, ICT, Broadcasting, and Communications Committee, there are zero products from Samsung Electronics005930 and LG Electronics066570 that have received domestic IoT security certification. Samsung Electronics is recently undergoing certification evaluation for one product. One of the reasons the security certification system is being ignored in the field is its voluntary nature. Critics point out that companies have no choice but to look toward overseas private certifications that are recognized in global markets.
A security industry official explained, "Security issues are directly linked to reputation, so major companies are actively pursuing certifications to provide peace of mind to consumers. While there is no major difference in the level of domestic and international certifications, domestic certification needs to become more universal to manage security risks, especially for low-cost products sold in the local market."
The PbD certification is planned for future expansion. At a regular briefing held on the 30th following the parliamentary audit, Choi Jang-hyuk, Vice Chairperson of the Personal Information Protection Commission, stated, "We plan to establish a legal framework that comprehensively regulates video information devices, such as CCTV and mobile video equipment, through the expansion of the PbD pilot certification system and the enactment/revision of the Video Information Act."
Recently, it was revealed that domestic footage captured by IP cameras in living rooms, maternity wards, swimming pools, offices, and karaoke rooms is being shared on illegal websites, causing a shock. These are being broadcast via live streams, with the operators even earning advertising revenue.
Whether to resolve this through institutional regulations or leave it to companies in the field is a dilemma. However, there are voices calling for mandatory security reviews. Hwang Seok-jin, a professor at Dongguk University's Graduate School of Information Security, noted, "It is not so much a matter of nationality as it is related to issues like component costs. Reviews of security, much like safety inspections, are required." He added, "The risk of being a target for hacking is always present when connected to the internet. Users also need to be aware of the need for physical measures, such as covering lenses."
Samsung Electronics and LG Electronics are attempting to differentiate themselves by highlighting security, which is often considered a weakness of Chinese brands. According to the industry, both companies have obtained IoT security certifications from UL Solutions and are in the process of obtaining additional certifications. Recently, Samsung Electronics' self-developed encryption module, 'CryptoCore,' received international certification from the U.S. National Institute of Standards and Technology (NIST). Samsung plans to integrate the certified CryptoCore into home appliances such as TVs and monitors, as well as digital signage and its own operating system. Its proprietary security platform, 'Knox,' will be expanded to the Bespoke AI Family Hub product scheduled for release next year. LG Electronics is applying its 'LG Shield' security system, focusing on AI home appliances.
The general industry consensus is that consumers are not yet reacting sensitively to security issues involving Chinese products. However, the outlook is that the importance of home appliance security will continue to grow. An industry official explained, "Domestic companies have a high interest in security. With the advancement of technologies like AI, security capability will become a key point of product differentiation."