Sensorfact

sensorfact

Amazon has reaped billions of dollars through the expansion of third-party sales in the past several years, boasting about it in But at the same time that it has dominated e-commerce, media reports have highlighted Amazon’s struggles to suss out bad sellers, pointing out its failures to catch or products on the platform. a recent letter to shareholders. counterfeit dangerous The company bans nearly 2,000 items for sale in the United States, an ever-expanding organized into 38 categories of rules that cover products from skincare and supplements to assault weapons and human organs. list of restrictions For this investigation, we sought to answer two key questions: How well is Amazon policing banned products in its U.S. marketplace—and could we find any for sale? We focused on five categories of Amazon’s prohibitions related to weapons, criminal activity, and spying, and crafted a list of 279 prohibited items that were searchable. Many of these items appear to be legal to sell but are barred by Amazon’s rules. We found nearly 100 listings of banned items for sale, including some multiples from different sellers for the same type of product. (When there were many listings of one type of product, we did not document every last one, but rather chose a few.) Five of the banned products were sold by Amazon itself, not a third-party. Among the prohibited items we found: AR-15 parts, compounds that reviews showed were used as injectable drugs, and equipment used to make potentially deadly counterfeit pills and for the dangerous process of butane hash oil extraction. After we contacted Amazon, all but 16 of the banned listings were removed. Company officials declined to comment on how the banned items evaded detection or to provide information on how many had sold before the listings were deactivated. They did not provide any comments on the banned products we found that they sold directly to consumers. And they declined to explain why the company chose to leave up some items: products named in their prohibitions, products primarily used for ingesting drugs, which meet the definition under federal law for , and gun parts and gunsmithing tools that we confirmed with a weapons expert. drug paraphernalia Amazon spokesperson Patrick Graham said in a written statement that sellers are responsible for following laws and Amazon policy, and that the company has “proactive measures in place to prevent suspicious or prohibited products from being listed and we continuously monitor the products sold in our stores.” (Read more in the Amazon’s Response section.) Some third-party sellers of banned goods avoided certain words and misclassified items, presumably to skirt enforcement. In some cases, we typed the exact language of Amazon’s restriction into its search engine and found prohibited items, suggesting some of its automated tools are not working in concert with its prohibited items enforcement. As a test of Amazon’s safeguards, The Markup attempted to list banned items for sale from a personal Amazon.com account in New York. We successfully listed two items that were prohibited on Amazon.com yet legal to sell under New York State and federal law: an armorer’s wrench for use on an AR-15 and a 10-round AR-15 magazine. We used the manufacturers’ photos, and bypassed filters by using a universal product code (UPC) that we bought online for one item and by avoiding certain keywords for both. Background Amazon’s shortcomings in policing its marketplace have been documented by numerous media exposés. A last year found more than 4,000 problematic items for sale on Amazon.com, including products that were “declared unsafe by federal agencies, are deceptively labeled or are banned by federal regulators.” The newspaper compared Amazon to a flea market: “It exercises limited oversight over items listed by millions of third-party sellers, many of them anonymous, many in China, some offering scant information.” Wall Street Journal investigation Additionally, The Wall Street Journal has detailed what happens when customers get hurt by products they bought through Amazon, finding the company by arguing in court that it’s not responsible for what people say on their site under the 1996 Communications Decency Act. dodges responsibility Also last year, CNBC found expired on the site, and The Washington Post discovered forbidden . In 2014, reported that when customers searched for digital scales, Amazon.com’s purchase recommendations offered them baggies, rolling papers, and grinders—“a field-tested kit for starting an illicit business.” food and baby formula CBD products The Atlantic The Markup sought to advance the coverage by looking specifically at products tied to potentially illicit or criminal behavior and weapons, seeking to understand more about how well Amazon polices its own restrictions—and protects the public. Product Categories We focused on five of Amazon.com’s restricted product categories related to weapons, criminal activity, and spying, as they appeared on Jan. 16, 2020. Some of these pages have since been updated: Drugs & Drug Paraphernalia Explosives, Weapons, and Related Items Hazardous and Dangerous Items Lock Picking & Theft Devices Surveillance Equipment Some of Amazon’s restrictions are very specific, but others are vague, making them more difficult to detect with certainty. To avoid ambiguity, we focused our search on items that met the following criteria: Clear restriction The restriction was clearly defined and without vague caveats (e.g., we did not look for items where some were allowed but rather for those where all were “prohibited”). Specific item The product was identifiable and not overly broad (e.g., we looked for Kung Fu stars but not “other dangerous weapons”). Distinguishable The banned item can clearly be distinguished from permitted listings (e.g., prohibited bolt pins for guns were too similar to other pins, so we excluded them). Amazon’s restrictions around drug paraphernalia mandate that items cannot be “primarily intended or designed for use in: manufacturing, compounding, converting, concealing, producing, processing, preparing, injecting, ingesting, inhaling, or otherwise introducing into the human body a controlled substance,” which we took to include marijuana, given federal law and that the company specifies some marijuana paraphernalia among its prohibitions. Along with the specific items named by Amazon, The Markup also included other common drug paraphernalia as defined in , including crack pipes and straws marketed for use to inhale substances and sniffing spoons, both of which can be used to ingest cocaine. federal drug paraphernalia law Pipes were tricky because the company allows pipes for tobacco use. It’s impossible to prove that the on Amazon.com at any given time are for marijuana use, so we eliminated marijuana pipes from our test. Crack pipes, which are distinguished by the Drug Enforcement Agency as those with a in the cylinder, were clear enough to include. pipes for sale synthetic rose In regard to pill presses, Amazon expressly prohibits those used to “imprint a pharmaceutical drug name or identification number onto a tablet or pill.” We considered all pill presses and molds that can take a pharmaceutical imprint die to be in violation. We also grouped synonyms and redundant items on the restricted products list as a single item. We did not check for prohibited items that would require outside information from government agencies, laboratory testing, or detailed inspection to determine if the listing violated Amazon’s rules. Our final list contained 279 banned items to search. The Search We searched for these products primarily during two sessions: one week in February 2020 and two weeks in April 2020. We conducted our searches using both Amazon.com’s search engine and Google’s search engine (specifying that results must appear on Amazon.com). We searched for each banned item multiple times, using slang, synonyms, brand names, and other search terms. Often, Amazon.com’s search engine returned results using the exact wording from its restrictions. Since many sellers sought to disguise the items, we confirmed how the items are typically used by reviewing customer feedback, photos, and outside sources, such as YouTube videos of hash oil extraction and gun assembly. We frequently visited outside websites that sold gun parts to compare what we were seeing on Amazon.com to what we knew was the real thing. We also sought outside confirmation on the two compounds we found that reviewers said they had injected. The World Anti-Doping Agency designates one (TB-500) as a “ ,” and the U.S. Anti-Doping Agency that the second one (BPC-157) is not approved for human use. prohibited substance warned athletes In some cases, we noticed several different listings for a single type of item. Rather than include each one, we selected a small sample from the top search results to include in our findings. Listings Found Each suspected prohibited listing was independently verified by both journalists working on the story. And, in the case of gun parts, we confirmed that each of the items were not expressly permitted for sale on Amazon (many are ), and the final list of items we found was double-checked by two weapons experts. All told, we documented 97 listings for products on Amazon.com that we determined meet the criteria of the company’s prohibitions. In some cases, we documented multiple listings for the same type of item and counted each of those individually. explicitly allowed on Amazon’s restricted products list The found products, listed under the company’s categories, are: Hazardous and Dangerous Materials Caps for toy guns Projectile flares Military-style gas masks Nitric acid Liquid mercury Mercury switches Toy crossbows Drug and Drug Paraphernalia “Legal steroids” Homeopathic teething products Compounds reviewers were using as injectable drugs Butane hash oil extractors Crack pipes Bongs Dab kits Wired cigarette papers Nitrous oxide crackers Bullets with attached mini spoons to ingest substances, which can include cocaine Straws to ingest substances, which can be used for cocaine Smell-proof dime bag Products to defeat drug tests Pill presses and molds Iodine (more than 2.2%) Coca Leaves Damiana Kanna Marshmallow leaf Explosives, Weapons, and Related Items AR-15 vise blocks AR-15 armorer’s wrenches Heat shields and handguards Charging handles AR-15 grips Door breachers Magazine extensions Magazine couplers Muzzle brakes Pistol stabilizing braces Receiver wedges or buffers Sling plates Collapsible stock Firing springs Shobi-zue Knives disguised to look like harmless items Caltrops Saps Sap hats Clubs Billy clubs Lock Picking and Theft Devices Jigglers Concealed handcuff keys Lock picking guns Lock picking sets Slim-jims Training locks Tubular lock picks Master keys Sensormatic detachers Surveillance Equipment Bugging devices Hidden AV cameras Hidden audio recorders df *Includes multiple listings of the same type of item After conducting hundreds of searches, we had a better understanding of how sellers of banned items avoid detection. Most simply left out certain words or intentionally misspelled or misclassified items. For example, we found a pill press labeled as a candy maker and bongs sold as vases. Even when mislabeling a listing, many sellers used accurate photos of the banned product. Several products had been for sale for months—even years. At least eight were designated “Amazon’s Choice,” and at least 39 were shipped from Amazon’s own warehouses. Five of the items were marked “ships from and sold by .” Amazon.com Offensive and Other Controversial Materials Early on in the reporting, we examined Amazon.com’s restrictions around offensive and controversial materials, which prohibit the sale of products that glorify violence or child abuse or are associated with hate groups. We were easily able to find items that broke Amazon’s rules: a child’s bed set with the alt-right meme Pepe the Frog with a swastika on its stomach and swag tied to the white supremacist groups Volksfront and Identity Evropa. It wasn’t clear if any of these products actually sold. The listings were live for months until we provided Amazon with links, and they were removed. We ultimately decided not to include those items in our data findings, in part because they do not fit our criteria for specific products, and because they presented a different kind of harm. Guardrails To find out what safeguards Amazon has in place to stop prohibited items from posting in the first place, we explored the seller portal. We registered as a seller, choosing the $39.99 per month “professional” account. This was a new account that had no history of selling on the site. When we started creating a product listing for a bong, Amazon.com’s interface suggested categorizing it with vases in home decor, where other third-party sellers had listed bongs. Not only was Amazon failing to catch these listings, but it was also recommending miscategorizations in violation of its own rules. We did not complete the process of publishing the bong listing. We later created listings for two prohibited items: an AR-15 armorer’s wrench and a 10-round AR-15 magazine. Both items are legal to sell in the U.S. and New York State but explicitly prohibited on Amazon.com. Amazon requires universal product codes, UPCs, or other global identifiers when uploading items for sale. When we used the correct product names and correct codes from the manufacturer’s website, Amazon’s guardrails correctly identified the product as banned and blocked the listing from going live. Next, we changed the title and description of both items to omit the keyword “AR-15” and miscategorized them so they would appear in an unrelated part of the product catalog. We continued to use the real manufacturer names, product photos, and descriptions. The wrench was approved by Amazon’s system and published; the magazine was not approved. We then purchased a new UPC code for the magazine, and when we used it, Amazon allowed us to list the magazine for sale. We were able to place both items in a different, personal shopping cart. We then took down the listings before anyone could make a purchase. It’s important to note that Amazon knew little about us as sellers other than our failed attempts to list banned items, yet still allowed us to list the items with these workarounds. Amazon’s Response The company declined to comment on most of the items we found, nor would it provide information on how many of the banned items were sold. Dozens of the prohibited listings were taken down in a matter of days after we contacted the company. Some of those we later removed from our final numbers because, upon review, they didn’t strictly adhere to our methodology. “If products that are against our policies are found on our site, we immediately remove the listing, take action on the bad actor, and further improve our systems,” Graham, the Amazon spokesperson said. He said that the company was taking “appropriate action on the bad actors that evasively listed them.” However, after Amazon provided this statement, The Markup found many of the sellers that were in violation continued to sell banned products, including Lead and Steel, which sold banned gun accessories, and another company that sold compounds that reviewers were injecting. When we asked Amazon about this in follow-up questions, those storefronts disappeared from Amazon.com. The dataset sent to Amazon included 16 listings that the company never removed. Of those, we decided to remove 10 from our final dataset: two weed grinders, a silicone pipe and a weed grinder set, a “same day detox” product, nitrous oxide canisters, and gun parts and tools that are potentially permissible under Amazon’s rules. The company declined to comment on why some prohibited products were being shipped from Amazon’s warehouses, nor would it speak to how banned items became listed as “Amazon’s Choice.” Graham denied that injectable drugs were for sale and said the listings we found were for “chemicals that were clearly marketed as being for research use only and not for human consumption.” He added that the company would nevertheless be “restricting them going forward.”  Amazon removed the specific listings we sent the company, but at the time of publication, other listings for these compounds could still be found on Amazon.com. Graham declined to comment on why the company’s search engine returned results when we entered the exact wording of the prohibition, nor would he comment on why the sellers’ tool suggested erroneous categories. He said it’s the responsibility of sellers to correctly list their products and follow the rules. Earlier this year, a company executive told Congress that the company is shoring up the slippage of of “counterfeits, unsafe products, and other types of abuse” by requiring sellers of certain items to be preapproved, partnering with brands to pull counterfeits, and performing “proactive scans to identify safety risks.” “As a result of our proactive efforts, in 2019, we blocked over 2.5 million suspected bad actor accounts from entering our store and more than 6 billion suspected bad listings from being published in our stores,” Graham told The Markup in an emailed statement that had . previously been given to Congress Conclusion Amazon is failing to stop banned items from being sold by third parties on its site—and even selling some banned items itself direct to U.S. customers. We documented nearly 100 instances of Amazon’s failure to detect problematic listings before they post, allowing a back alley to its marketplace where items related to criminal activities, weapons, and drug use are openly sold. We found sellers can easily shroud listings enough to evade automated detection by Amazon’s filters while still making the banned items findable for customers—often through Amazon’s own product search engine. We were able to list two banned items ourselves using this method. In some cases, Amazon’s sellers’ tools suggest miscategorizations. In five cases, the listing was marked as “ships from and sold by .” Some banned items from third parties shipped from Amazon’s own warehouses, and the company promoted a handful of the banned items we found as “Amazon’s Choice.” Amazon.com Originally published as " How We Investigated Banned Items on Amazon.com " with the Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0) license.

How Banned Items Were Sold on Amazon via 3rd Parties 

Learn how Mikko and the SensorFu team built a product that detects network and system leaks for mission-critical production networks. Davis Baer : What’s your background, and what are you working on? My name is Mikko Kenttälä and I am CEO and one of the SensorFu’s founders. builds a cybersecurity product that continuously seeks new network and system leak paths and alerts IT-ops when they are found. These leaks can be a result of human error or malice and they may violate security policies or contractual obligations. Making sure that planned network segmentation or containment holds is crucial for keeping things safe and private. SensorFu I have always loved to hack devices and software to find out how they , learn new tricks and build something new. I have been curious about what makes people tick, how organizations work or don’t work, where our society is going to and what’s the impact of technology on all this. It is not a surprise that I ended up as an information security professional and a digital privacy advocate. Before founding SensorFu I worked on building citywide, free, , doing a lot of security audits and leading a team building threat intelligence products. I still do occasional audits to keep my mind open and I always volunteer for to hone my team and security skills and understanding. I am also a board member of Electronic Frontier Finland ( ). work open and public wireless networks cyber defense exercises EFFi What motivated you to get started with your company? Our team has a long working in information security, and hacking almost every imaginable gadget or software out there. We’ve seen first hand how companies invest increasing amounts of money and effort in improving their cyber security posture. However sometimes they go for the fancy and complicated solutions and neglect the obvious. They may not spend enough effort to make sure that cornerstones of security such as network segmentation and crypto are properly used. I suspect that this is due to our industry’s own marketing message where new threats and latest fads get most attention and working on no-brainer foundation work is often not considered sexy or advanced enough. Seeing these things being broken time after time drove us to start SensorFu. In a sense, we wanted to go back to basics with IT security. We feel that security requirements pile up, while systems and security solutions get more complex by the day. We wanted to turn this almost upside down: offer easy and cost efficient way for companies to validate that core tenets of their IT security are working as intended. In the way of Unix philosophy — offer things that do one thing and do it well. history Having a team of like minded people around me made it easier. Years of shared experiences with and Sebastian Turpeinen gave us a running start as a founder team of SensorFu in early 2017. Ossi Herrala What went into building the initial product? We had this ideal about helping people get core tenets of their IT security right — on an ongoing basis. Based on our security audit experience we had both insights and contacts to potential customers. We must have talked to at least two dozen people to bounce off ideas, and really, listen in about what was not working well for them. Soon after we founded SensorFu, we had shortlisted our ideas to just one spearhead: network leak detection. Our product gets deployed in mission-critical production networks, industrial control system (ICS) process control networks, and other live environments that are to remain secure and isolated. In a very real way, our product sits nexts to customers’ critical ‘crown jewels’ that we’re helping to protect. Therefore security and robustness of our own product must not be an afterthought. Right from the beginning, we’ve spent a lot of time designing our product for critical network environments, making it default and enabling updates with minimum fuzz. Some of the early choices we made were to use Alpine Linux as our default platform, and use Rust as our programming language of choice. We have taken on a habit of and 3rd party components we’re using internally — with good results and for common, open source, good. We take great pride knowing that a product that we ship meets and goes well beyond of what are the industry practices of building secure products. secure by fuzzing our APIs upstream contributions SensorFu Beacon Home user interface If you’re interested more about our thinking process of getting from an idea to a product, we have published a few blog posts of what we went through to get first versions of our product built: [ ][ ][ ][ ][ ]. teaserI teaserII teaserIII teaserIV teaserV You look for network leaks? Isn’t this problem solved by firewalls, air gaps or some other solution already? But who watches the watchmen ( ? Yes there are Firewalls, Router ACLs, SDNs and Air Gaps but do you know those are working as expected, not just at any given point in time, but on an ongoing basis? Vendors and people make mistakes with access control lists and firewall rules. People misconnect cables in patch panels or plug those cables to wrong network sockets or click wrong button on the virtual switches and make other mistakes. Devices are or may become multi-homed — e.g. with a flip of the Wi-Fi switch on a service technician’s laptop an escape route may have been created from an isolated environment to where that laptop is connected using another network interface. Security devices may act in pass-through or fail-open mode during reboot or firmware update, or that update may have caused the active configuration to behave differently than before. Employees or subcontractors may need to engage into shadow IT to get their job done and they may get more than they ask for. Of course there may also be an occasional malicious actor or malware that messes up your infrastructure. Quis custodiet ipsos custodes) At the end of the day, our audit experiences keep on showing that this problem is far from solved and something new had to be done to improve the situation. By helping to detect network leakage early, our customers are able to avoid a variety of problems in the tail end of things. How have you attracted users and grown your company? Our founding team is on their late 30s’ and early 40s’ and we’ve been lucky to work in a variety of roles within information security industry for the past 20 or so years. To get going we were able to leverage our existing direct contacts in Nordic and abroad. We also actively contribute to grassroots events and specific industry forums and events. For example, Ossi and I had great fun presenting security conference in Finland in front of a very demanding crowd. Evangelism like conference presentations builds awareness, but we are constantly trying to think who needs us next and why, and go after them to tell them that. We try to make as many pre-qualified contacts as we can, and are also searching for right channel partners to scale our sales in the future. Escapology at Disobey In 2018 we applied for Y-Combinator’s . Startup school has focused us in systematically measuring and tracking our progress in sales via variety of metrics such as how many leads, meetings, pilots, and closed deals we have every week. This seems like an obvious thing to do, but sometimes it’s good to hear someone else tell you that. startup school What’s your business model, and how have you grown your revenue? We license our product as an annual subscription. Each of your protection domains, especially isolated network segments, needs its own Beacon, and bigger organizations are likely to have several. We’re barely 18 months old as a company so we try not to get stuck on this model, and are constantly evaluating if there would be more efficient ways to license our product. In our first year, 2017, we were able to sign-up three paying (pilot) customers. We worked with them to fine-tune our product and launched it to general availability in late 2017. Going to 2018 we’ve brought in our first international deals, and have been steadily adding new customers. What makes me really fired up about all this is good feedback we’ve received from new customers. In particular from one where Beacon has been able to provide immediate value by finding real issues at customers’ networks within a week or two of initial deployment. What are your goals for the future? I think our primary goals as we see them today, in no particular order, could be summarized in the following bullets: Grow internationally — in particular we’re looking at North America and China, India and Japan in APAC region. Expand from utilities and energy to other critical infrastructure domains and to other markets. For example we just signed up a customer in the enterprise sector whose original concern were contractual obligations to have isolated environments for the work they do for their big customers. Find a great channel partner for APAC and possibly North America. Continuously improve and enhance our escape methods and techniques. We believe there is a lot of uncharted territory to be explored and researched within our problem domain of network leak detection. What are the biggest challenges you’ve faced and obstacles you’ve overcome? If you had to start over, what would you do differently? One of the issues we keep bumping is what kind of environments to support. Our pilot customers were in critical infrastructure, energy and utilities domains. They needed our system to run on a hardware platform that they could physically distribute around their networks and e.g. electrical substations. But soon after we started getting request for being able to run within virtual private cloud (VPC) as AWS native AMI, in Azure, in Google Cloud, in Digital Ocean, on local hypervisors such as VMWare and KVM, or if we’re available in Docker Hub — the list goes on. It has certainly been hard to tell people “no, not yet”. I want to also mention an issue with terminology. Since our product is taking a new approach to a known problem, there really isn’t established terminology in common use which would make it easy for people to associate us with something familiar. Instead, there are all kinds of technologies and terminologies we often get confused with— some of the leading ones being data loss prevention (DLP) and data leakage detection and prevention. These are typically more of an intelligent access control lists or monitoring of network traffic, whereas we are actively trying to escape, testing also exactly those types of security controls. Some vendors talk about breach simulations and , where of course our technology is crucial in cutting it early but we have tried to keep our message even simpler. Words and terminology do matter, and if we were able to rewind a year, I think I would work even harder with our terminology and story around it. Currently we are quite happy with network leak detection and think this appropriately describes what our product does. kill chains Another thing that is, of course, easy to say afterwards, but if we were able to start all over — we would move even faster, hire more and earlier and ramp up things faster. Have you found anything particularly helpful or advantageous? By far the big advantage has been versatility of our team and understanding of the problems being faced by our customers. We know the challenges, having dealt with them for 20+ years. I’ve seen many of the existing security solutions, their shortcomings and possible improvements when doing Red teaming or Blue teaming in exercises or regular pen tests. This means that we were solving a pain point we were super familiar with and we instantly got traction. I think this is to say that sometimes a eureka moment just comes at you, but it’s more likely to happen if you’ve worked passionately on something for extended periods of time while keeping an open mind. Another thing I want to mention, one of the things almost everyone asks from us is a variety of reports they want our solution to provide. We were super resource constrained last year and weren’t exactly thrilled to put R&D effort to building a reporting framework. Luckily we found out that some of our early customers were using centralized logging and SIEMs to eventually process our alerts. We have another Mikko in our team — and he happens to be a Splunk and SIEM expert and was able to build us what customer desired completely leveraging their existing security investment, Splunk in this case. This experience has encouraged us to further integrate with and embrace infrastructure customers already have. Moral of the story — if you don’t have to build it from scratch — don’t. SensorFu Splunk add-on for SIEM What’s your advice for entrepreneurs who are just starting out? I mentioned YC startup school already, but I really want to give them a shout-out: many of the lectures and internal goals it made us set were super useful. We had been thinking about many of the topics already but hearing experienced people to share their advice helps when you have hard decisions to make and far too many options to distract you with. Above that, I feel it’s important that right from the beginning you get into the right mindset where you don’t cut any corners, set up payroll, and use certified accountants. Make it full time from the get-go. Build a strong culture with your team and assimilate new comers, don’t blindly trust outside experts to tell you how you should run your company or what sort of values you should have. There’s a lot of people who ‘know’ how you should do things, but not so many that have actually done it, or are willing to substantially commit in helping and supporting the course they’re advocating for. This relates a bit to chasing buzzwords — for example we don’t have Machine learning (ML) or artificial intelligence (AI) on our roadmap. We spent time studying and analyzing AI and ML to find out if they would help within the problem domain we’re helping to solve. We currently think we can achieve really good results without them. Pick your co-founders well — it’s kind of like marriage. Trust is everything. In this regard, we don’t really like the advice that many have been giving lately about founder vesting for early-stage companies. Common reasons given for founder vesting is that it allows company to reclaim stock if things go south between founders. But when you’re starting a company, you need to make things work. Period. In bad times, and in good times. We may not be able to avoid founder vesting if we ever raise VC capital, but until then, we will be founder-vesting free. You don’t want someone to nominally hang around just to get their vesting done either, there has to be other means to resolve such an unfortunate situation. Lastly, remember to manage the expectations at home. When you have kids and a spouse, you need to talk a lot so that everyone knows where things are. Think about it this way, in the early days of your start-up you’re spending all of your time and thoughts on your company and product while you are churning through your family savings or your spouse’s income. Family is your most important support and needs know how things stand so that they can support you the best they can. Where can we go to learn more? Our has more information about our product. We have a blog where we have articles primarily about new features and underlying technology we use. website Medium You can also follow us on social media: we’re on and . If you have any questions or feedback, leave them in the comments section below or email — we would love to hear from you. LinkedIn Twitter contact@sensorfu.com If you’re interested about some of the cooler escape methods we’re using to detect network leaks, I did a about some of them in Disobey Security conference in Jan, 2018. presentation For your convenience, here are the links: SensorFu main website: www.sensorfu.com SensorFu blog in Medium: www.medium.com/sensorfu SensorFu Twitter feed: twitter.com/sensorfu SensorFu in LinkedIn: linkedin.com/company/sesorfu

Founder Interviews: Mikko Kenttälä of SensorFu

As our technology becomes increasingly connected through the rise of and cloud computing, we have not only benefited our lives but our planet as well. Smart farming has taken the world by storm as farmers have learned to embrace the world of IoT, not reject it. These farmers have been able to precisely monitor the conditions of their produce as well as control every milliliter of their resources. IoT Agri-Tech companies such as have been able to solve the problem of a rapidly growing population’s need for sustainable food and farming: Illuminum Greenhouses “We construct affordable modern greenhouses and install automated drip irrigation kits for small holder farmers by using locally available materials and solar powered sensors.” -Illuminum Greenhouses Kenya As our world population is soon to reach 10 billion, we need to more greatly adopt technological, conservative methods for feeding the masses and IoT is the way to go. We at PubNub have worked with numerous Agri-tech companies such as smart tractors, climate monitoring and many more. We have even written articles demonstrating how to into smart agriculture. utilize the power of cloud computing As for inspiration for this project, we have created this demo project that demonstrates how our real-time data infrastructure can be used to create self-sustaining botanical systems. What You’ll Need 3–6V Water Pump Silicone Tubing 5V Power Supply (Phone Charging Cable will do) Raspberry Pi 3 Temperature/Humidity Sensor Soil Moisture Sensor Setup Wiring First and foremost, if you don’t have a dedicated 5V power supply, you can easily make one out of an old phone charging cable. Simply, snip the head off of the phone adapter and strip about 5 inches of the rubber casing to expose the wires. The wires will be flimsy, so soldering some female header wires to the exposed phone cable wires will be a good idea. It’d be a good idea to do this for the pump’s exposed wires as well. If you’re worried about the silicon tubing not being an air-tight fit on the pump, you can always hot glue around the nosel to create a perfect seal. Now you’re ready to start wiring up your components! Follow this diagram and make sure you plug in extra male-male wires to the female headers we soldered earlier to connect everything together. Notice that we used a relay in our circuit as the Raspberry Pi can only safely tolerate input voltages under 3.3V. Therefore, we need to isolate our 5V power supply to avoid any damage to the Pi. Hardware Pump The pump is a submersible water pump, meaning that it must be completely submerged in a water reservoir in order to pump water. Therefore, for this project, you will need to leave out a bowl (or any method for a reservoir) next to the plant at all times. NOTE: It’s okay to get the wire tips wet as long as none of the water gets on the RPI! DHT Sensor The DHT11 temp/hum sensory is a standard sensor that does not need to be in any particular location, besides being in the same environment as your plant. Since temperature and humidity do not vary greatly within a 5 ft radius, it’s okay to just leave the sensor plugged into the RPI and not right next to the plant. Soil Moisture Sensor The soil moisture sensor is a standard moisture sensor that outputs a voltage when wet, and none when dry. You can adjust the sensitivity of the sensor with the potentiometer located on the sensor. Let’s Get Coding! Before you do anything, make sure you so we don’t run into any problems down the road. sign up for a free PubNub account Step 1: Enable SSH Secure Shell protocol (SSH) allows users to remotely access their Raspberry Pi terminals from their computers over wifi. If supplemented with GitHub, users can push code from their computers to a remote repository, SSH into the Pi terminal, and pull the code wirelessly. This allows for a quicker and smoother development process. To enable SSH on your RPI, follow the simple and quick instructions. Step 2: Download Device Libraries and Dependencies While we may have 3 devices, we only need to read analog voltages from 2 of them. The pump only needs to operate on a GPIO switch. Therefore, we only need to pull dedicated device libraries for the Temp/Hum sensor and soil moisture sensor. Remember that these libraries must be installed onto the RPI by SSH-ing into your device and running the commands below. NOTE: DHT Temperature Humidity Sensor In your project’s directory, clone and enter the sensor’s code repository. git clone cd Adafruit_Python_DHT https://github.com/adafruit/Adafruit_Python_DHT.git Install some Python dependencies. sudo apt-get upgradesudo apt-get install build-essential python-dev Now, install the sensor’s library. sudo python setup.py install This should compile the code for the library and install it on your device so any Python program can access the Adafruit_DHT python module. If you want to quickly test the sensor to see if the sensor works enter these commands: cd examples sudo ./AdafruitDHT.py 2302 4 You should see a reading similar to this: Raspberry Pi GPIO Library For our submersible pump, we need to operate an voltage of 1 or 0 from the RPI to turn it on. Conversely, the soil moisture sensor gives the RPI an voltage 1 or 0, depending on whether it is wet or dry. Both of these functions require the use of the RPI’s GPIO pins. output input Since we’ll be coding in Python, it will be useful to install the GPIO Zero library, which will allow us to make simple function calls to activate the pins. sudo apt install python-gpiozero Step 3: Build Your App with PubNub Functions\ The full code for this project is located in this repository for reference: https://github.com/Cakhavan/IoT_Plant First, let’s import our libraries and other dependencies to enable the devices and PubNub Functionality #Device Librariesimport sysimport Adafruit_DHT from gpiozeroimport LED, Button from timeimport sleep #PubNubimport pubnub from pubnub.pnconfigurationimport PNConfiguration from pubnub.pubnubimport PubNub from pubnub.callbacksimport SubscribeCallback from pubnub.enumsimport PNOperationType, PNStatusCategory Next, we’ll need to initialize our sensors and pumps to their corresponding RPI pin numbers #Pump is connected to GPIO4 as an LEDpump = LED(4) #DHT Sensor (model type 22) is connected to GPIO17sensor = 22pin = 17 #Soil Moisture sensor is connected to GPIO14 as a buttonsoil = Button(14) NOTICE: Since the pump will need to be sent an output voltage of on or off (like we would typically do with LEDs) we initialize it as an LED instance. Additionally, we initialized the soil moisture sensor as a button for it will send out a continuous input voltage of a 1 (like when holding down a button) when wet. It will also be a good idea to set some initial conditions for when the program first boots up: a flag variable to toggle the state of the program to Auto mode or Manual mode and turning the pump off when the program boots up. #flag variable to toggle between Auto and Manual modeflag = 1 #always make sure the program starts with the pump turned off#(conventions are backwards for the pump i.e. .on() 'on') 'off' and #.off() pump.on() In order to make sure that our IoT Plant can communicate with a client, we need to enable PubNub’s 2-way pub-sub capability. To make sure we can receive messages we need to add a listener to handle the incoming messages and declare a subscription to listen in on a particular channel. class MySubscribeCallback(SubscribeCallback):def status(self, pubnub, status):pass# The status object returned is always related to subscribe but could contain# information about subscribe, heartbeat, or errors# use the operationType to switch on different optionsif status.operation == PNOperationType.PNSubscribeOperation \or status.operation == PNOperationType.PNUnsubscribeOperation:if status.category == PNStatusCategory.PNConnectedCategory:pass# This is expected for a subscribe, this means there is no error or issue whatsoeverelif status.category == PNStatusCategory.PNReconnectedCategory:pass# This usually occurs if subscribe temporarily fails but reconnects. This means# there was an error but there is no longer any issueelif status.category == PNStatusCategory.PNDisconnectedCategory:pass# This is the expected category for an unsubscribe. This means there# was no error in unsubscribing from everythingelif status.category == PNStatusCategory.PNUnexpectedDisconnectCategory:pass# This is usually an issue with the internet connection, this is an error, handle# appropriately retry will be called automaticallyelif status.category == PNStatusCategory.PNAccessDeniedCategory:pass# This means that PAM does allow this client to subscribe to this# channel and channel group configuration. This is another explicit errorelse:pass# This is usually an issue with the internet connection, this is an error, handle appropriately# retry will be called automaticallyelif status.operation == PNOperationType.PNSubscribeOperation:# Heartbeat operations can in fact have errors, so it is important to check first for an error.# For more information on how to configure heartbeat notifications through the status# PNObjectEventListener callback, consult <link to the PNCONFIGURATION heartbeart config>if status.is_error():pass# There was an error with the heartbeat operation, handle hereelse:pass# Heartbeat operation was successfulelse:pass# Encountered unknown status type def presence(self, pubnub, presence):  
    pass  # handle incoming presence data  

def message(self, pubnub, message):  
    if message.message == 'ON':  
    global flag  
    flag = 1  
    elif message.message == 'OFF':  
  global flag  
  flag = 0  
    elif message.message == 'WATER':  
    pump.off()  
    sleep(5)  
    pump.on() pubnub.add_listener(MySubscribeCallback())pubnub.subscribe().channels('ch1').execute()Then, to enable sending out messages, we declare a publisher callback def publish_callback(result, status): pass Now, we need a method to check whether our sensor is wet or dry. Since we declared our soil sensor as a button, the function call “is_held” just means that we should check to see when the soil sensor is outputting a continuous “1” (is dry). def get_status():#Soil sensor acts as button. is_held == sensor outputting a 1 for drynessif soil.is_held:print("dry")return Trueelse:print("wet")return False Next, let’s implement the meat of our program. We’re going to need the RPI continuously polling to check sensor data, so let’s implement a continuous while loop: while True: We now need to set state conditions that check whether or not the flag variable is a 1 or a 0 (aka in auto mode or manual mode) if flag == 1:#to be implementedelif flag == 0:#to be implemented Just like we did before, let’s grab data from the DHT sensor and also print it to the terminal if flag == 1:# Try to grab a sensor reading.  Use the read_retry method which will retry up# to 15 times to get a sensor reading (waiting 2 seconds between each retry).humidity, temperature = Adafruit_DHT.read_retry(sensor, pin)DHT_Read = ('Temp={0:0.1f}*  Humidity=                              {1:0.1f}%'.format(temperature, humidity))print(DHT_Read) Now we can publish that data to PubNub for future IoT use. We’re going to publish on a specific channel so let’s publish to something called “ch2” since “ch1” is reserved for listening for the flag variable. pubnub.publish().channel('ch2').message([DHT_Read]).async(publish_callback) Then check the status of the soil sensor and turn the pump on or off accordingly wet = get_status()if wet == True:print("turning on")pump.off()sleep(5)print("pump turning off")pump.on()sleep(1)else:pump.on()sleep(1) NOTE: Remember the backwards convention of the .on() and .off() method call Lastly, let’s implement the manual mode elif condition, which is just making sure the pump is always off elif flag == 0:pump.on()sleep(3) Step 4: How to Upload Your Code Like we discussed in the previous section on the use of Git, you should always commit your code to your repository and then pull it to your Raspberry Pi. The process always follows this order 1.) Save your code on your computer 2.) Commit it to the cloud using these commands git add .git commit -m "updates"git push 3.) SSH into your RPI and cd into the proper directory ssh pi@<YOUR IP ADDRESS>cd <your directory> 4.) Pull the code from the cloud and run it git pull python Plant.py Step 5: Create a Client We’re now going to create a front-end HTML page to interact with our IoT plant and later visualize its data in step 6. We will build something that looks like this. First, let’s start with the 3 buttons that will put the Plant in either the auto state, manual mode state, or water plant state. This will be done by having each button publish a message of which the plant will change its flag variable accordingly. Let’s first give our page a title <!DOCTYPE html><html><body><h1>IoT Plant</h1></body></html> In the body of your HTML file, insert 3 buttons that publish messages with the PubNub SDK like so <button type="button" onclick="publish('ON')">Auto Mode ON</button><button type="button" onclick="publish('OFF')">Auto Mode OFF</button><button type="button" onclick="publish('WATER')">Water Plant</button> Below those buttons, let’s have our website be continuously updating the screen with the exact temperature humidity data published by the “ch2” channel declared in step 4. In order to do this, we give an id named “sensorData” to a <p> tag so that the program can later inject the content of the <p> tag, using the “getElementByID” and “changeInnerElement” function calls. You’ll see what I’m talking about in a moment. <p id="sensorData">Temperature and Humidity Data</p> Now let’s import the PubNub JavaScript SDK in order to actually use that “publish” method and other methods. <script src="https://cdn.pubnub.com/sdk/javascript/pubnub.4.20.2.js"></script> Then instantiate a PubNub instance with your API keys var pubnub = new PubNub({publishKey : 'YOUR PUB KEY',subscribeKey : 'YOUR SUB KEY',}); Then create a publishing call back to publish the button data to the RPI. Notice how we reserved “ch1” for button data and “ch2” for RPI data. function publish(a){var publishConfig ={channel : "ch1",message : a};pubnub.publish(publishConfig, function(status, response){console.log(status, response);}); } Next, we instantiate a listener and subscriber to get the RPI sensor data. Notice the line that uses the “getElementById” and “innerHTML” function calls introduced earlier. This allows us to take any PubNub message and update any variable on the screen with its respective id tags. This is great for real-time IoT dashboards! pubnub.addListener({message: function(m) {// handle messagevar channelName = m.channel; // The channel for which the message belongsvar channelGroup = m.subscription; // The channel group or wildcard subscription match (if exists)var pubTT = m.timetoken; // Publish timetokenvar msg = m.message; // The Payloadvar publisher = m.publisher; //The Publisher//inject the sensor data msg into the sensorData tag declared earlier for real-time updatesdocument.getElementById("sensorData").innerHTML = msg;console.log(msg)},presence: function(p) {// handle presencevar action = p.action; // Can be join, leave, state-change or timeoutvar channelName = p.channel; // The channel for which the message belongsvar occupancy = p.occupancy; // No. of users connected with the channelvar state = p.state; // User Statevar channelGroup = p.subscription; //  The channel group or wildcard subscription match (if exists)var publishTime = p.timestamp; // Publish timetokenvar timetoken = p.timetoken;  // Current timetokenvar uuid = p.uuid; // UUIDs of users who are connected with the channel},status: function(s) {var affectedChannelGroups = s.affectedChannelGroups;var affectedChannels = s.affectedChannels;var category = s.category;var operation = s.operation;}});pubnub.subscribe({channels: ['ch2'], }); Step 6: Graph Your Incoming Data with PubNub EON Now comes the flashiest and coolest part of our project: ! PubNub EON allows users to easily render in a real-time data graph with the drop of a script tag. EON By incorporating EON into our project, we’re going to get something that looks like this HTML Setup Since at this point you most likely have your HTML page opened up, let’s start implementing EON there first. To add PubNub EON to any HTML page, simply add this div tag in your body, which will inject the actual chart <div id="chart"></div> Then import the script tag SDK <script src=" "></script><link rel="stylesheet" href=" "/> https://pubnub.github.io/eon/v/eon/1.0.0/eon.js https://pubnub.github.io/eon/v/eon/1.0.0/eon.css Then subscribe to the eon-chart channel that you will be posting data to eon.chart({channels: ['eon-chart'],history: true,flow: true,pubnub: pubnub,generate: {bindto: '#chart',data: {labels: false}}}); And that’s it! It’s as simple as that! Now, let’s implement the last step, which is formatting the sensor’s publisher so EON knows how to graph the data. Python Setup This part is even easier. It’s just two lines! Go back to your Plant.py python code. Now, to publish correctly in python to the eon-chart API correctly, you need to create a dictionary of this type dictionary = {"eon": {"DATA NAME": DATA, "DATA 2 NAME": DATA 2 etc...}} So in our case, our dictionary would look like this dictionary = {"eon": {"Temperature": temperature, "Humidity": humidity}} Paste this in right above the line that publishes our sensor data to ch2. Now we need to publish this dictionary to a channel that our graph is going to read from. In our case, the eon-chart channel. pubnub.publish().channel("eon-chart").message(dictionary).async(publish_callback) And there you go! You have successfully created a self-sustaining system for preserving life FOREVER…..until you need to refill the reservoir. Originally published at www.pubnub.com .

Stories, News & Mentions about SENSORFACT

Sensorfact’s Stories on HackerNoon