IoT Privacy White Paper - Xiaomi

3.5 Mi Camera and Privacy

Introduction

The Mi Home Security Camera is a device which provides monitoring functions and solutions for homes with detection needs. It supports remote viewing on multiple devices, two-way real-time voice calling, and human detection to help users live with peace of mind. It offers functions such as three storage methods for backup, quick playback and easy browsing, and standard/inverted mounting with 180° screen rotation.

We fully understand your concerns about the security and privacy of information such as the video captured by the camera. To address these concerns, we have ensured that the Mi Camera adopts a combined secure encryption method for encrypted videos in transit and rest. For example, we provide the end-to-end encrypted transmission for the streamed images to protect against unauthorized access.

Data Collection and Usage

1) Pairing with Device and Synchronizing Data

We will collect below information to pair your device with your account.

  • Account Information: Includes your Mi account ID and Mi accounts you share the device with.

  • Device Information: Includes the device name, device ID, firmware version, installed location (such as in the living room), time zone, security code (if you have already set it up) for viewing the device, screen information (such as sharpness, scaling), recording mode (continuous recording mode, human detection detect recording mode) as well as memory card information (errors relating to record storage, used/remaining storage of memory card).

  • Device Settings: Includes the status indicator on/off, data usage prevention on/off, smart frame on/off, flow protection switches, physical obstruction settings, image settings, night vision settings.

  • Network Information: When your device is connected to a network, this information includes current Wi-Fi connection mode (LAN or remote), assigned IP address, Wi-Fi signal intensity, RSSI, MAC address, and the Wi-Fi network name (SSID) and password.

2) Viewing Real-time Image

We will collect information on the current image time, playback speed, image quality option and volume to provide you with real-time image viewing functionality. In addition, you can take a screenshot or record the current live image. Real-time image screenshot/video recordings will be saved on your phone instead of being uploaded to any server.

3) Human Detection

You can enable or disable the Home Surveillance Assistant function (this function is disabled by default). If this function is enabled, we will collect the following information:

  • Mobile-human detection switch,

  • Sensitivity (the ability to sense human movement in high or low sensitivity),

  • Home surveillance periods (users can set surveillance periods, like all day tracking, or 8:00-18:00 scheduled time tracking),

  • Shooting interval (to reduce pushing notification, shooting interval can be raised),

  • Image change push notification on/off (receive push notifications when an image changes).

In addition, video recording will only be triggered when the image changes within the detection range of the camera. You can set the distance (in meters) away from the door to trigger video recording, the start and end time of home surveillance, and to shoot in interval for more seamless viewing.

4) Baby Crying Detection

When baby crying sound detection1 is enabled (this function is disabled by default), you will receive a push notification if a baby crying sound is detected. We will collect the status of notification settings of this function (on/off) to provide this service. This information is processed locally and only the videos of triggering events instead of whole videos are uploaded to the server.

5) Video Playback

You can view various types of videos in the Xiaomi/Mi Home app plug-in. We will collect and encrypt the videos triggered by Home Surveillance Assistant and baby crying, as well as the triggering events, and save this encrypted data on a secure server for 7 days. We will also collect information related to the recording and network, which includes recording date, recording time, trigger event, recorded video duration, sound settings, and playback speed to provide this service.

6) Two-way Talkback

You can view information on the live image in the application plug-in and talk with others using the two-way talkback function. We will not collect information on your conversation, unless you select to record current real-time image before using the two-way talkback. However, under no circumstances will we try to read or identify your conversation.

7) Notification

The device will send you corresponding notifications according to triggering events. For example, you can set the device to send a notification to your phone when the monitored image changes. We will collect information on your notification settings to provide this service.

8) User Feedback

You may use feedback feature when encountering problems during daily use. We may collect your We may collect your contact information (phone number or email address you provided), uploaded logs (includes error information). This information will only be used for solving the given problems. Once it's not be used anymore, we will delete this information from server.

9) Data Analysis

We collect product interaction (clicks, failed connections, viewing activities) from the Xiaomi/Mi Home app plug-in for statistical analysis of your usage and status of these functions. Such data is collected only if you have previously agreed to join the User Experience Improvement Program.

Privacy by Design

Mi Camera only collects data which is required to provide its functions, some of which are disabled by default to avoid unnecessary data collection. For example: for users who enable functions such as human detection and baby crying detection, videos triggered by these options, as well as the triggering events, will be stored in rest only for 7 days, while the algorithms for these two functions are processed locally.

Note

Human detection algorithms is very different from normal motion detection because it will be trigger only when a human body is detected. The detection algorithm analyzes the body moves, so it is able to detect even intruders that are wearing a mask.

Baby Crying Detection Algorithms

For human detection, the camera will capture the image at different frame rates to calculate and compare by the CPU in accordance with certain algorithms. When there is a change in the picture, such as someone walking by or an object movement, the calculation and comparison results in the number will exceed the threshold and adjust the camera a certain angle through the motor, so that the moving object can be recorded in the centre of the video.

For baby crying detection, a certain number of statistical samples are used to establish the eigenvalues. The signals are collected locally and compared with the eigenvalues through some data processing such as noise reduction, cleaning, Fourier transform, and then the baby's crying is determined.

To ensure the security of your data, Mi Camera adopts a combined secure encryption method for encrypted transmission and storage of your video. The video uploaded by the camera to the cloud is encrypted for transmission and storage via HTTPS+AES-128. Furthermore, we support end-to-end encrypted transmission to ensure that nobody is able to access your video data in the camera's real-time video stream.

We not only provide the functions for your data rights to be met (i.e., by enabling you to access, delete, and download your data), but also support some specific features when we design the functions. For example, Mi Camera supports human detection and baby crying detection. These functions are disabled by default, and users are free to enable/disable them according to their preference.

figure

Appendix 5: Data Inventory for Mi Camera

TypeType of DataIdentification QualifierPurposeData Transmission Encryption MeasuresData Storage Encryption MeasuresData Retention Policy
IdentifiersMi Account ID
Identified
App Functionality

HTTPS

No Encryption

Per user's request
MAC
Identified
App Functionality

HTTPS

No Encryption

Per user's request
Device ID
Identified
App Functionality
Analytics

HTTPS

No Encryption
Not Applicable
User ContentPlayback Videos
Identified
App Functionality
Device Functionality

HTTPS

AES-128

7 Days
Other Photos or Videos
Identified
App Functionality
Device Functionality

HTTPS

AES-128

Per user's request
Audio Data
Identified
App Functionality
Device Functionality

HTTPS
Not StoredNot Applicable
Usage DataProduct Interaction
Identified
App Functionality
Analytics

HTTPS

AES-128

Per user's request
DiagnosticsCrash Data
Identified
App Functionality
Analytics

HTTPS

AES-128

Per user's request
Performance Data
Identified
App Functionality
Analytics

HTTPS

AES-128

Per user's request
Other DataDevice Information
Identified
App Functionality
Analytics

HTTPS

AES-128

Per user's request
Device Settings
Identified
App Functionality
Analytics

HTTPS

AES-128

Per user's request
Network Information
Identified
App Functionality
Analytics

HTTPS

AES-128

Per user's request
Human Detection Settings
Identified
App Functionality
Device Functionality

HTTPS for
Devices without Mi SPEC

AES-128 for
Devices without Mi SPEC

Per user's request

Mi SPEC for
Devices with Mi SPEC

No Encryption for
Devices with Mi SPEC

Factory Reset
Baby Crying Detection Settings
Identified
App Functionality
Device Functionality

HTTPS for
Devices without Mi SPEC

AES-128 for
Devices without Mi SPEC

Per user's request

Mi SPEC for
Devices with Mi SPEC

No Encryption for
Devices with Mi SPEC

Factory Reset

Note

1 Certain types of devices may not support this function.