Categories
Cybersecurity

When Everyone Is Wearing a Camera: What Smart Glasses Teach Us About the Next Generation of AI Risk

When Everyone Is Wearing a Camera: What Smart Glasses Teach Us About the Next Generation of AI Risk

New technology has always created some interesting challenges for schools. We have seen it with pagers, cell phones, smartphones, tablets, and smartwatches. Every time something new shows up, administrators eventually have to figure out how it fits into the classroom and what problems it might create.

Smart glasses are quickly becoming the next item on that list.

Several school districts here in Florida have recently moved to restrict or ban smart glasses such as the Ray-Ban Meta line. Polk County Public Schools, for example, issued guidance prohibiting students from possessing or wearing smart glasses during the school day, citing concerns around privacy, unauthorized recording, safety, and classroom disruption.

At first glance, this may seem like just another round in the battle over personal technology in schools. The problem is that smart glasses are different because while a smartphone gives a person access to technology, smart glasses give the technology access to almost everything the person sees and hears, and that is a very important distinction.

From a Device to an Observer

Smartphones are generally pretty obvious when they are being used. If someone wants to take a picture, record a video, search for an answer, or interact with an AI tool, there is usually some visible activity involved. They pull out the phone, look at the screen, point the camera, or start typing, but smart glasses remove a lot of those clues.

Someone wearing AI-enabled glasses may be able to take pictures, record audio, communicate with an AI service, or receive information while appearing to simply look around the room, and that changes the situation quite a bit. Instead of carrying a device that occasionally interacts with the environment, the person becomes something much closer to a walking sensor platform. For schools and other sensitive areas, that brings up some immediate concerns.

The Obvious Problem: Cheating

Academic integrity is probably the easiest issue to understand. If a student can look at a test question, send what they are seeing to an AI system, and receive help without ever pulling out a phone or opening a laptop, many traditional anti-cheating controls suddenly become far less effective, and this is not completely theoretical either.

Students have already been caught attempting to use smart glasses during examinations, and testing organizations have started reacting. The College Board has prohibited smart glasses during SAT testing, and examination authorities elsewhere have raised concerns about smart eyewear and miniature earpieces making technology-assisted cheating much harder to detect. This will become even more interesting as the technology improves.

A camera-equipped pair of glasses can capture information. Add AI and that information can be interpreted. Add discreet audio feedback or a heads-up display, and an answer could potentially be returned without the wearer ever looking at a traditional screen. At that point, telling students to put their phones away does not solve much.

Privacy May Be the Bigger Problem

Cheating gets attention because it affects grades, but privacy may be the much bigger issue. Most people understand what it means when someone points a phone at them. There is an obvious social cue that says, “I might be taking your picture or recording you”, but smart glasses can remove much of that warning, leaving people unaware.

A student could potentially record another student, a teacher, a conversation in the hallway, a disciplinary interaction, or an embarrassing moment without the people involved realizing it is happening. That creates some serious concerns around bullying, harassment, locker rooms, sensitive conversations, and recordings ending up on social media. Cyberbullying is not new, but this could create a whole new level of it, and it also raises a much bigger question that goes well beyond schools.

So, what happens when we can no longer easily tell who around us is recording? Schools may simply be among the first organizations forced to deal with that problem on a large scale, but it will not stop there.

Smart Glasses Change the Human-Risk Model

There is also an important cybersecurity issue here. For years, security professionals have thought about endpoints as laptops, smartphones, servers, tablets, and other traditional computing devices. Now smart glasses start to blur that definition.

Imagine sitting in a sensitive meeting with someone wearing AI-enabled glasses. Those glasses could potentially contain a camera, microphone, wireless connection, cloud services, and an AI assistant capable of interpreting and transcribing what the wearer sees and hears.

From a security standpoint, that person is no longer simply attending the meeting, but rather they may also be carrying a network-connected collection device on their face. Whiteboards with a network diagram could be captured, an employee badge could be photographed, a sensitive conversation could be recorded, a document sitting on the conference table could potentially be read, an AI system could even summarize or analyze some of that information, or a mix of any of these.

If someone walked into a confidential meeting carrying an obvious camera and microphone connected to the internet, people would probably notice, but put those same capabilities into something that looks like sunglasses and the reaction may be completely different, and that is where the problem starts.

Social Engineering Gets an Upgrade

Smart glasses could also change the way social engineering attacks are carried out. Researchers have already demonstrated experimental systems that combine smart glasses, facial recognition, and publicly available information to identify people and retrieve details about them. Just think about what that could mean for a scammer or cyber attacker.

Someone could potentially approach a target at a conference or other gathering and receive information about that person’s employer, job title, social media presence, or other publicly available details while the conversation is taking place. A bad actor performing physical reconnaissance could discreetly capture badge designs, access control systems, computer screens, or employee behavior. All of that is information that can greatly empower an attacker, as the person attempting an impersonation attack could potentially receive AI-generated suggestions or prompts while they are talking to the victim.

Traditional social engineering has always required preparation. It means the attacker researches the target, learns the story they want to tell, and then tries to remember enough of that information to make the interaction believable. AI-enabled wearables will change that because instead of doing all of the preparation ahead of time, some of it could happen dynamically while the attack is taking place, making it a real-time social engineering copilot.

That should get the attention of anyone responsible for security awareness, dealing with classified information such as PII, PHI, or intellectual property. The physical security challenges will be increased as well.

Why Schools Are Choosing Simple Rules

One thing becomes obvious when looking at the policies schools are creating,  administrators do not want teachers trying to determine whether a particular pair of glasses is recording. That would be nearly impossible to enforce consistently, instead, many policies take the simpler approach. The glasses have to be removed, powered off, or stored during the school day. There is some value in simplicity, however as technology advances, it will be tougher to tell the difference between smart glasses and traditional prescription eyewear.

A complicated policy that requires someone to determine exactly what a device is capable of doing, whether it is currently recording, or which AI features are enabled will probably be very difficult to enforce, and businesses may eventually face the same problem, especially in the hyper-competitive world we live in today.

Organizations will need to decide whether smart eyewear is appropriate in conference rooms, research facilities, manufacturing environments, data centers, hospitals, government facilities, or other places where sensitive information is present. Simply telling employees not to record confidential information may not be enough when recording can happen without anyone else noticing. Eventually, organizations may have to define if they allow wearable cameras and AI assistants at all. This will not be easy.

The Prescription Glasses Problem

Of course, as already mentioned, there is another complication. Smart glasses increasingly support prescription lenses and that means schools and employers cannot necessarily treat them like headphones or smartphones and simply tell everyone to take them off. Some people may legitimately need those glasses in order to see and there are also accessibility cases where AI-assisted eyewear could provide meaningful help to people with disabilities. That means policies will need to separate reasonable accommodation from unrestricted use of recording, communication, or AI features and this is another place where things get messy.

Technology has a habit of moving much faster than policies, and wearable AI is no exception, so organizations need to start thinking through these situations now, before they are dealing with them in the middle of an incident.

The Bigger Lesson

The bigger issue here is not really smart glasses, it is ambient AI. Today, most of us still think about AI as something we intentionally use. We open ChatGPT, we type a prompt, we upload a file, we ask a question, etc. Wearable AI changes that relationship because AI can begin seeing some of the same things we see. It can hear conversations, recognize text, interpret objects, potentially remember interactions, and provide assistance in real time. However, with smart glasses and other small devices like them, the interface begins to disappear into everyday life.

There are some incredible uses for this technology in accessibility, education, translation, navigation, and productivity. Unfortunately, like most useful technologies, there will also be people who figure out how to misuse it. This is not new and we have seen this pattern many times before as technology develops.

The goal should not be to panic about smart glasses or assume that everyone wearing them is doing something malicious, but rather to understand that the risk model has changed. While schools banning smart glasses may seem like a relatively small technology policy story today, it may actually be an early look at a much larger problem organizations of all sizes and across industries are going to face as cameras, microphones, network connections, and AI assistants become smaller, harder to spot, and increasingly difficult to separate from the people using them.

Cybersecurity professionals should be paying attention. For years, organizations have been asking, “Are employees allowed to use AI?” but the next question may be much harder to answer as we have to tackle the question. “What happens when the AI is always watching?”

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.