# Preliminary Examination of Emergent Threat and Risk Landscapes in Intelligent Harvesting Robots
## 5 Impact of the Security/Safety Issues
### Use Cases  
This section presents three use cases that are carefully selected after analysing several threats in the intelligent harvesting environments. The aim is to give the reader a deeper insight into the type of critical threats that can harm intelligent harvesting robots and even their operators. **Use case 1: adversarial perturbation against the machine vision system**  
The first use case is about introducing physical disturbances to the crop to deceive the sensors of the intelligent harvesting robot into perceiving erroneous information about the \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Asset/Resource** & **CIA Triad** \\ \hline
**Type** & **Description** & **Description** & **Description** \\ \hline Sensors and camera data & Any data produced by the sensors should be accessed and available to the authorised actors. & ✓ & ✓ \\ \hline IHR Data Stores & IHR persistent data (logs, software, etc.) must be accessible to only authorised actors. & ✓ & ✓ \\ \hline Physical safety & IHR system must not harm its users or environment & ✓ & ✓ \\ \hline IHR Behaviour & The robotic system must not allow attackers to disrupt its tasks & ✓ & \\ \hline Compute Capabilities & Robot embedded and distributed (e.g., cloud services) compute resources. The unavailability the compute resources of IHR and the MVS will prevent the robot from operating correctly & ✓ \\ \hline IHR & The IHR must not damage itself and must respond to commands within a reasonable time. & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Critical Assets of IHR from a Security Perspective. Figure 3: Data Flow Diagram of the IHR. environment. The adversarial attacks are crafted after performing several experiments to successfully confuse the MVS. An example of these changes could be:  
* placement of objects;
* deformation of the crop;
* changing external environmental factors (projection of light on the crop). The attack steps are summarized as follows:  
1. The attacker starts by analysing the capabilities of the targeted versions of the cameras and the MVS. 2. The adversary designs an adversarial attack capable of altering the outputs. This is a trial-and-error phase it requires many physical experiments and disturbance models to increase the success rate of the attack. 3. The attacker launches the attack by performing the alteration on the crop to cause misclassification by IHR. 4. When IHR arrives at the targeted location, it will erroneously classify it into the attacker's chosen class (e.g., interpret a ripe asparagus as unready) and react accordingly (e.g., ignores instead of harvesting). **Use case 2: Sensor/communication jamming and GPS spoofing**  
An attacker can disrupt wireless sensor communication by producing radio interference. The aim is to prevent sensors from receiving GPS positioning and correction messages. The attacker can also spoof communications by emitting false signals (e.g., GNSS-like signals, with the intention of producing false location-based information in the victim receiver). Malicious signals can also be exploited to negatively affect the communication channels of wireless sensors. The attack steps are summarized as follows:  
1. Security vulnerabilities in sensors and GPS signals are identified. 2. Taking advantage of the vulnerable sensors, the adversary remotely injects unwanted signals into the communication channel or disables sending/receiving messages. 3. The attacker will use the compromised sensor to block or disrupt the data transmission, which will affect the functionality of the decision algorithms that IHR uses to perform its normal operation. If the GPS is spoofed, the intelligent harvesting robot will receive erroneous data which will confused its Machine Vision System. **Use case 3: Swapping or using malicious hardware components**  
The last use case is when attackers utilize malicious hardware components in the IHR/AMB.