  As many types of IoT devices worm their way into numerous settings and many
aspects of our daily lives, awareness of their presence and functionality
becomes a source of major concern. Hidden IoT devices can snoop (via sensing)
on nearby unsuspecting users, and impact the environment where unaware users
are present, via actuation. This prompts, respectively, privacy and
security/safety issues. The dangers of hidden IoT devices have been recognized
and prior research suggested some means of mitigation, mostly based on traffic
analysis or using specialized hardware to uncover devices. While such
approaches are partially effective, there is currently no comprehensive
approach to IoT device transparency. Prompted in part by recent privacy
regulations (GDPR and CCPA), this paper motivates and constructs a
privacy-agile Root-of-Trust architecture for IoT devices, called PAISA:
Privacy-Agile IoT Sensing and Actuation. It guarantees timely and secure
announcements about IoT devices' presence and their capabilities. PAISA has two
components: one on the IoT device that guarantees periodic announcements of its
presence even if all device software is compromised, and the other that runs on
the user device, which captures and processes announcements. Notably, PAISA
requires no hardware modifications; it uses a popular off-the-shelf Trusted
Execution Environment (TEE) -- ARM TrustZone. This work also comprises a fully
functional (open-sourced) prototype implementation of PAISA, which includes: an
IoT device that makes announcements via IEEE 802.11 WiFi beacons and an Android
smartphone-based app that captures and processes announcements. Both security
and performance of PAISA design and prototype are discussed.
