SoK: Your Mind Tells a Lot About You: On the Privacy Leakage via Brainwave Devices

Abstract

Head-worn wearables, such as consumer-grade EEG headsets deployed in Brain Computer Interfaces (BCI), are getting popularity in the gaming and entertainment industry, and for people with certain disabilities. However, the increasing popularity of these wearables creates a significant privacy risk. For instance, tech companies are intending to use brainwave devices to detect workers' emotional state and mental condition. There are AI techniques that can learn what people are looking at in real-time. Silently conversing with the computing system is now possible using neuromuscular signals, for instance, untold digit recognition with higher accuracy is possible, which can retrieve untold PIN or password. These applications can reveal more private information than designated benign purpose, such as, while detecting performance of worker, sensitive information like Parkinson's disease, substance abuse disorder, heart disease, can be revealed from brainwave. The consequences of these privacy leakages may be potentially devastating, such as tracking users for targeted advertisements and launching targeted attacks against users. In this paper, we analyze current devices, explore previously studied attacks, research efforts to extract information from brainwave and analyze and synthesize potential future attacks from the current deployment. This systematization will provide right direction towards ensuring privacy risk of BCI devices, which is a pre-requisite to building future defense mechanisms against the attacks.