“Smart locks don’t know you’re divorced”: When shared domestic tech becomes an insider threat
When marriages end, one person may retain control of tech that allows them to monitor, harass and intimidate their ex-partner.
A divorce can divide a home and a car. But it cannot automatically update permissions in a smart lock, doorbell camera or vehicle app.
That leaves people exposed to potential surveillance, harassment and even remote interference with their property long after a relationship has ended, a US divorce lawyer and cybersecurity consultant has warned.
Jonathan D. Steele, a family-law partner at Beermann LLP in Chicago and founder of cybersecurity consultancy Steele Fortress, said the problem resembles an insider threat, in which someone abuses legitimate access to a computer system.
Businesses routinely revoke employees' digital permissions when they leave, but divorcing couples rarely receive the same systematic protection.
"An accepted login is not proof of consent," Steele warned.
He argued that ending access to domestic technology should be treated as seriously as granting it in the first place.
Exes at the wheel
The dangers are already emerging in real life.
In October 2026, Forbes reported on a woman who said her former husband had continued using a connected car application to monitor her movements and interfere with her vehicle.
She reported windows opening during heavy rain, the ignition activating unexpectedly and her ex-husband retaining the ability to track her location.
Despite presenting police reports, a protective order, divorce documents and evidence that she owned the vehicle, she said dealership staff told her the only solution was to buy another car.
Which, eventually, she was forced to do.
Steele highlighted the danger of protections that exist in theory but cannot be accessed in practice.
"A support process that people cannot find or use offers little protection," he said.
The problem is not confined to vehicles. Connected door locks, home security cameras and domestic appliances can all remain accessible through accounts established when a couple lived together.
Research published by Cornell University in 2018 described a class of threat known as the "UI-bound adversary": someone who uses legitimate interfaces and account permissions to cause harm.
Unlike a conventional hacker, such a person may not need to break into anything. They already have the credentials.
And removing access can be surprisingly complicated.
Permissions granted through one application may remain active through another, while changing a password does not necessarily disconnect every linked device.
"Changing a credential and withdrawing every permission are different tasks," Steele explained.
The cybersecurity risks of divorce
Steele warned that legal ownership and digital control are not necessarily the same thing.
"A court order can establish exclusive possession without automatically changing an app's permissions," he said.
"The hardware, the account and the right to use the property may be controlled by different people."
That can leave someone legally entitled to occupy a home or drive a vehicle while their former partner still possesses the technological means to monitor or interfere with it.
California has begun addressing the problem through legislation covering connected devices.
Under SB 50, survivors of qualifying abuse can request that access be terminated when they provide the required documentation.
Covered account managers must generally respond to a completed qualifying request within two business days, either terminating the identified person's access or providing an applicable reset procedure.
The law prohibits requiring the alleged perpetrator's approval.
California also has separate protections governing access to connected vehicles.
But Steele argued that digital permissions should also become a routine consideration in ordinary divorce proceedings, even where no abuse has been alleged.
"For separations without abuse, digital access belongs in the settlement paperwork," he said.
Divorcing couples should identify connected devices, determine who retains control, arrange account transfers and establish deadlines for removing permissions, Steele advised.
Recovery email addresses, telephone numbers and third-party integrations may also need attention.
The dangers of removing access
However, disconnecting an abusive former partner is not necessarily straightforward or safe.
The National Network to End Domestic Violence's Safety Net Project warns that abruptly removing monitoring access can provoke retaliation.
Steele emphasized that survivors may need professional help deciding when and how to make changes.
"Immediate safety takes priority over collecting evidence," he said.
He also warned that the same mechanisms designed to protect victims could themselves be abused by someone seeking to take control of a device.
"Any tool that can remove an abuser can also be tried by one."
Steele called for stronger safeguards, including identity and legal-rights verification, specially trained support staff and protections for survivors' contact information.
Technology manufacturers should also make it easier for users to identify everyone with access to their devices, distinguish between different levels of permission and understand the consequences of revoking them.
"Revocation should explain what stops, what remains, whether anyone will be notified, and what records may disappear," he said.
For Steele, the issue illustrates a growing disconnect between the legal system and the connected technology now embedded in everyday domestic life.
"Smart locks don't know you're divorced. A smart home needs a safe way to stop being shared."
