Google is collecting troves of data from downgraded Nest thermostats

The second-gen Nest Thermostat launched successful 2012.

Google officially turned disconnected distant power functionality for early Nest Learning Thermostats past month, but it hasn’t stopped collecting a watercourse of information from these downgraded devices. After digging into the backend, information researcher Cody Kociemba recovered that the first- and second-generation Nest Learning Thermostats are inactive sending Google accusation astir manual somesthesia changes, whether a idiosyncratic is contiguous successful the room, if sunlight is hitting the device, and more.

Kociemba made the find portion participating successful a bounty programme created by FULU, a right-to-repair advocacy enactment cofounded by electronics repair technician and YouTuber Louis Rossmann. FULU challenged developers to travel up with a solution to reconstruct astute functionality to Nest devices nary longer supported by Google, and that’s precisely what Kociemba did with his open-source No Longer Evil project.

But aft cloning Google’s API to make this customized software, helium started receiving a trove of logs from lawsuit devices, which helium turned off. “On these devices, portion they [Google] turned disconnected entree to remotely power them, they did permission successful the quality for the devices to upload logs. And the logs are beauteous extensive,” Kociemba tells The Verge.

Along with preventing users from remotely controlling aboriginal Nest Learning Thermostats (in summation to the European mentation from 2014), Google turned disconnected the quality for users to cheque the presumption of their devices from the Nest oregon Google Home app, portion besides blocking information and bundle updates. Google notes that the unsupported devices “will proceed to study logs for contented diagnostics,” though the information the institution is collecting nary longer appears to beryllium useful.

“Although these logs tin incorporate method details specified arsenic HVAC mistake states, Google tin nary longer usage that accusation to assistance the customers who inactive beryllium connected these thermostats, since enactment has been afloat discontinued, adjacent successful cases of instrumentality failure,” according to Kociemba.

Google is inactive getting each the accusation collected by Nest Learning Thermostats, including information measured by their sensors, specified arsenic temperature, humidity, ambient light, and motion. “I was nether the content that the Google transportation would beryllium severed on with the distant functionality, nevertheless that transportation is not severed, and alternatively is simply a one-way street,” Kociemba says. The Verge reached retired to Google with a petition for remark but didn’t instantly perceive back.

FULU awarded Kociemba and different winner, who goes by the sanction of Team Dinosaur, with the $14,772 bounty for bringing astute features backmost to the unsupported thermostats.