You've bought the house, but the seller controls the lights. Now what?

SAN FRANCISCO — Chad Curry recently talked to a home buyer who worried there was something wrong with the furnace in her new house. Every time she set the thermostat to 70º, it reset itself to 80º.

Some sleuthing finally revealed the problem — the former owner’s new house was cold and he kept trying to get the heat to go on by turning up the temperature using the app on his phone. Unfortunately, it was still connected to his old thermostat in his old house.

As the Internet of Things finds itself into houses via connected devices, more and more homes contain hot new tech gadgets that can all too easily become unlocked digital backdoors.

From thermostats to garage door openers to keyless locks, “people can be vulnerable if they don’t reset these,” said Curry, managing director for technology at the National Association of Realtors.

“It could be something as simple as turning lights on and off and make them think their house is haunted. Or it could be something creepier, like watching through their cameras or locking or unlocking doors,” said Charles Henderson, global head of IBM X-Force Red. He spoke on the topic at the RSA computer security conference Friday in San Francisco.

Like many new technologies, companies have focused on getting their connected devices into stores and into customers' homes without thinking through the downstream consequences.

“There wasn’t been much discussion of what happens when they sell that device or the house that contains that device,” Henderson said.

That’s how Curry came to work on a project with the Online Trust Alliance to create a Smart Home Checklist for real estate agents. The list isn't necessarily more user-friendly than the items themselves, however.

For example, one suggestion is that home buyers, “Review the configuration settings for remote access, encryption and update cycles and adjust where needed.”

Smart lightbulb, baffled homeowner

What items within a home might have digital interfaces aren’t always obvious. For example, a house could be equipped with state-of-the-art light bulbs that link to a hub that allows the owner to use an app on their phone to control the lighting.

But there's no way for a new homeowner to automatically know that. They might not realize that the small box tucked away in a corner allowed someone with the right app to control their lights — so they might not know to ask for information about how to disable or take it over.

“As smart as the light switch is, it’s not smart enough to know it’s been sold,” Henderson said.

The issue hasn't really become part of the home-buying process. So far only 15% of clients ask their realtors about smart home technology in a house they’re looking at, a 2016 survey from the National Association of Realtors found.

While today even the most wired home seldom has more than a connected thermostat, lock and perhaps webcam, “at some point soon we’ll have 30 to 40 devices in our homes,” Curry said. “All of which will be vulnerable if people don’t reset them.”

If the new owner doesn’t get the original documentation for each device, they must find the name and version of each device, then look online to find the relevant documentation so they can know what’s necessary to reset the devices.

Seeking simplicity

Realtors want to work with the burgeoning Internet of Things world to streamline and simplify this for customers.

State laws differ on what is considered a part of the home and therefore what must stay in a house when it is sold.

In most jurisdictions, fixtures stay with the home while non-fixtures don’t. A fixture is by definition anything that’s affixed to the house. So a Next thermometer that’s installed in the wall is a fixture and stays put while a webcam or an Amazon Echo that sits on a shelf are not.

To be absolutely certain, ownership of connected devices in the phone should be added to an addendum to the sales contact so “what stays and what goes” is clearly laid out, Curry said.

Another issue is that many connected home devices require WiFi to work, which is often one of the first things the original homeowner removes when a house is readied to be shown and sold. So the new owner can’t actually get access to the devices until they move in and install their own WiFi network.

As smartphones became popular, cell phone manufacturers eventually adopted the idea of an easy-to-do “factory reset” because so many users sold or passed on their phones, making it crucial for phone owners to be able to start afresh and protect their privacy.

The connected home device world hasn’t yet gotten to that point, said Henderson.

Curry says his dream would be for each home device to come with a simple user interface and an easy-to-access method for both resetting the user login ID and password that also completely wipes the device of all previously stored data.

Unfortunately, he said, “we’re not there yet.”