The Accidental Hacker and the Frontier of Robotic Privacy: A Technical and Ethical Case Study of the DJI Romo Vulnerability

This paper presents a comprehensive technical and ethical analysis of a critical security vulnerability discovered in the DJI Romo robotic vacuum cleaner, reported in 2025 by French-Spanish software engineer Sami Asdu Duffal. What began as an amateur AI-assisted reverse engineering project to integrate a consumer robot with a PlayStation 5 controller unexpectedly exposed a systemic Broken Access Control (BAC) flaw, granting unauthorized access to operational data—including real-time camera feeds, microphone streams, detailed floor maps, and hardware identifiers—of approximately 7,000 devices across 24 countries. Classified as an Insecure Direct Object Reference (IDOR) vulnerability, the flaw represented a severe deviation from modern security standards, including the General Data Protection Regulation (GDPR) and the Privacy by Design framework. We examine the technical anatomy of the vulnerability, comparative incidents across the domestic robotics market (Ecovacs 2024; Dreame Technology/Narwal Robotics 2025), the ethical framework of responsible disclosure exhibited by the discoverer, the inadequacy of DJI’s crisis response, and the geopolitical implications that led the Federal Communications Commission (FCC) to restrict DJI products. Furthermore, we address the role of AI-powered tools in democratizing access to reverse engineering—a paradigm shift with profound consequences for corporate security postures and regulatory policy worldwide. We conclude with actionable principles for Security by Design in an era of ubiquitous domestic robotics.