Release: Bounty winner exposes Google’s data collection on “abandoned” Nest thermostats
Company continues uploading user data from devices stripped of smart features
AUSTIN — Digital ownership advocate FULU announced on Thursday two winners of its bounty to restore functionality to older Google Nest Learning Thermostats, while revealing a troubling discovery: Google continues to collect detailed data from the devices even after discontinuing their smart features.
"We put out this bounty to try and fix the Nest thermostats that Google essentially broke when they ended software support last month," said FULU Executive Director Kevin O'Reilly. "It’s shocking that Google is continuing to collect data from the customers they are no longer supporting. Killing the features while keeping the surveillance is like having your cake and eating it too.”
When Google ended support for the Nest Gen 1 and Gen 2 thermostats on October 25, owners lost the ability to control or monitor their devices remotely through the Nest and Google Home apps. But while reverse-engineering the thermostats to restore their functionality, bounty winner Cody Kociemba discovered that Google's abandonment was decidedly one-sided: the devices continue transmitting comprehensive system logs and API interaction data back to Google's servers.
"When I started digging into these thermostats, I expected to find abandoned hardware," Kociemba said. "What I found instead was Google quietly collecting detailed logs from devices they claimed were too old to support. That's exactly the kind of behavior this project is designed to fight."
The second bounty winner, Team Dinosaur, chose to remain anonymous but also developed a working solution to restore smart functionality to the discontinued thermostats.
Both solutions required circumventing digital locks built into the Nest thermostats' software. While a temporary exemption to the Digital Millennium Copyright Act (DMCA) allows consumers to bypass these locks for repair purposes, Section 1201's anti-trafficking provisions prevent the bounty winners from distributing their solutions as commercial products or services, even if offered for free. Kociemba has decided to make his No Longer Evil solution open source and freely available nonetheless.
"These innovators did exactly what tinkerers have always done: they saw a problem and they fixed it," O'Reilly added. "A 27 year old law has no right to make the 250 year old tradition of American ingenuity illegal. It’s time lawmakers updated Sec. 1201 of the DMCA to match our technological moment.”
The Nest bounty is part of FULU's broader effort to restore consumer control over smart devices. The organization has launched additional bounties targeting digital locks in products from Samsung, Xbox, and other manufacturers that prevent owners from maintaining, repairing, or modifying their purchased devices.
###
FULU Foundation is a nonprofit organization that advocates for consumers’ right to repair, own and control their technology.
