text:
\section{Introduction}\label{sec:introduction}}

\IEEEPARstart{W}{ith} smart toys set to grow to an \$18 billion market by 2023 (as estimated by Juniper Research), we set out to classify the security and privacy threats they pose. Smart toys, which have sensors and/or actuators and internet connectivity, are in effect a subset of IoT. While threats posed by IoT have been extensively studied, we argue that smart toys present a distinctive attack surface because of their unique target user group (children and teenagers). A growing body of research shows that children harbor trust and attachment for smart toys~\cite{breazeal2018intelligence,breazeal2018relationships,breazeal2018conformity,vollmer2018conformity}, and the effects of bugs and exploits in these toys are significantly amplified due to such a vulnerable user base.

A child's trust for her/his toy can be exploited in several ways. A beloved toy may accompany a child wherever she goes, allowing comprehensive location tracking, e.g., via GPS or IP geolocation~\cite{mcreynolds2017toys}. Bluetooth or WiFi enabled toys may broadcast a static MAC address, further facilitating location tracking. Children are inclined to trust their toys and follow their lead~\cite{turkle2006encounters, vlahos2015barbie}. Our tests on the Sphero BB-8\ showed that an unauthorized person could control the movement of the toy, potentially leading a child to follow the toy into danger. Using Wiggy Piggy Bank, an unauthorized person could issue rogue instructions to the child, for instance directing her outside the home. In both scenarios, the adversary could be within the Bluetooth range, about 40 meters. Finally, children, who tend to have wider trust boundaries than adults, are more inclined to share confidential and identifying information with a toy, and less likely to understand how that information will be shared and the consequences of sharing~\cite{mcreynolds2017toys,leite2016robot}. Some toys (e.g., Hello Barbie) actively solicit personal information, but many toys (including all the toys we examined) passively gather information, e.g., to infer usage patterns or improve personalization. Toys that require creation of an account online may collect additional information, e.g., email address. Some toys are equipped with microphone or cameras to capture audio, photo, and video---troubling enough if leaked, but in the worst case scenario pose the risk of being turned into an espionage device if an adversary can turn them on at will~\cite{cloherty2017hackable}.

As a vulnerable population, children are at risk of being harmed by smart toy exploits. A child may be psychologically scarred if a trusted toy suddenly starts presenting disturbing, violent, or pornographic content. For instance, some of the toys we examined present content fetched over an unencrypted channel, making them subject to being maliciously replaced by a network attacker. A compromised toy with a speaker can be made to voice distressing audio~\cite{valente2017security}. Finally, a child can be harmed by any leak of information captured by a smart toy. The harm may be psychological; for instance, a child may experience a trusted toy revealing information thought to be confidential as a personal betrayal~\cite{jones2016can}. More saliently, it can result in immediate personal danger, e.g., if it reveals the child's location to an attacker, whether directly or indirectly, while others, like the disclosure of a child's birthday (requested by some of the toys we examined), can facilitate identity theft, which may become apparent only much later when the child reaches adulthood and the consequences are more difficult to undo~\cite{newman2005identity, morris2015vtech}.

Smart toys also share the vulnerabilities inherent to other IoT devices. Among these are the use of companion apps and third party libraries, increasing a toy's attack surface. An insecure or over-privileged companion app may be exploited to access the smartphone's microphone, camera, or GPS~\cite{mylonas2011smartphone}, or directly control the toy; any communication between the toy and the app, if unencrypted, can also be intercepted or modified. Toy makers may store personal data insecurely or for an indefinite duration, increasing the likelihood of a breach, as does the use of third-party ads and analytics libraries~\cite{grace2012unsafe}. Smart toy makers are also often simply the makers of other general purpose toys, with no particular expertise in information technology, particularly information security. They may thus not fully understand potential security risks to address them throughout the product life cycle~\cite{peppet2014regulating}. This includes development, design, and testing phases, as well as after-market care, e.g., secure firmware updates should a vulnerability be discovered~\cite{ftc2015iotreport}.

Several classification schemes have been proposed for general IoT security~\cite{zhao2013survey,roman2013features,abomhara2015cyber,denning2013computer,hunt2017seven}, however nothing specific to smart toys. Some systematic analyses have been conducted into compliance of children's apps with children's privacy laws~\cite{liu2016identifying,reyes2018examining}, and experimental work on selected smart toys specifically~\cite{chu2018security}. Some inroads have been made into developing privacy paradigms for children's online activity and even into smart toys~\cite{Rafferty2017privacy,toys2017stast,yankson2017privacy}. However, no taxonomy has been proposed that systematically addresses both the security and privacy of smart toys, specifically, for experimental evaluation. In this work, we examine eleven Internet-connected toys on the market and determine what Personally Identifiable Information (PII) they collect, what PII is shared with third parties like ads and analytics servers, what steps toy makers take to secure this data, and if the toy can be compromised in a way that poses a threat to the physical or psychological safety of the child using it. We also define a list of attacks categorized by attacker proximity and assess the smart toys against them.

Traditional threat taxonomies devised for general IoT devices do not, in our opinion, adequately address the threats they pose to children specifically. Some threats we present are specific to smart toys (e.g. parental PII protection), while others are given more emphasis (e.g. exposure to third party ads and analytics services) compared to existing taxonomies. Regulatory frameworks, like COPPA in the US, that address children's digital privacy specifically recognize that children face unique harms from such devices, and are designed to protect children against these threats.

We consider two broad categories of risk: breach of PII, and unauthorized control of the toy. While there is no universal definition of PII~\cite{schwartz2011pii}, we have closely adhered to that specified in COPPA, as the most widely applicable regulation to specifically address children's privacy~\cite{ftcfaq}. We have categorized PII into the following: personal information including name, gender, physical address, email address, telephone number, voice recordings, and photos; device information, including mobile device unique identifiers including IMEI, serial number, MAC address, IP address, and smart toy ID; and service usage information, including session start and end time, session duration, and app features.
Our findings show that popular smart toys are vulnerable to several attacks in our taxonomy, some of them severely. For example, in Toymail, we found that blocked contacts still receive children's personal information. Wiggy Piggy Bank\ allows nearby adversaries to issue arbitrary tasks to a child, in the familiar voice of the toy. Smart Toy Monkey\ sends personal information unencrypted over HTTP to a server located in China. VTech InnoTab MAX\ does not require any authentication to access a child's personal information.

\subhead{Contributions}
\begin{enumerate}
	\item We develop an experimental framework for evaluating security and privacy of smart toys. The framework encompasses PII collected and transmitted by smart toys, and security measures that have been taken to protect them; and PII collected and transmitted to third parties such as ads and analytics services, and the third parties' TLS practices. Our framework relies on analysis  of network traffic (WiFi and Bluetooth), and reverse engineering and code analysis of companion apps.
	\item  We investigate a representative, diverse set of eleven smart toys using our experimental setup to expose potential PII leakage, weak security measures, and other vulnerabilities. Our methodology and tests can be directly used for other toys on the market, and extended/adapted for evaluating future toys.
	\item We uncover, through experimentation, an excessive collection of unique IDs that facilitate tracking children across  different services or platforms, and sending children's PII to unauthorized entities. Our results also show that several toys expose children to threats that may be exploited by physical, nearby, or remote attackers.
\end{enumerate}

As part of responsible disclosure, we have contacted the manufacturers of all toys mentioned in this paper and shared our findings with them. Wiggy Piggy Bank\ responded quickly and mentioned that they are looking into the vulnerabilities and possible fixes. Hello Barbie\ responded that their technical team may get back to us ``if they have any concerns.'' Anki Cozmo\ discarded our findings, describing them as ``unsolicited ideas.'' We have also received automatic replies from Osmo, Cloudpets, Sphero BB-8, and Toymail; the rest have not responded even after 6 months. Overall, most responses (and lack thereof) indicate that these companies take privacy matters much more frivolously than expected.

\vspace{-10pt}
\section{Related work}\label{sec:related}

Smart electronics for children have made the news for security breaches numerous times in the past; e.g., see  Rapid7~\cite{rapid72015iot} (strangers could hack baby monitors to view children sleeping and even talk to them directly), Norwegian Consumer Council~\cite{bouvet2016toys} (highlight dangerous security vulnerabilities in 3 toys: i-Que, My Friend Cayla, and Hello Barbie), Motherboard~\cite{motherboard2016gps} (strangers could track children's location and message them through the HereO smart watch), and BBC~\cite{bbcgermany2017cayla} (German ban on Cayla in February 2017, branding it as an ``illegal espionage apparatus'').  Like wearables for adults, many smart toys are Bluetooth-enabled and accompany children outside the home, and previous research on fitness trackers has uncovered numerous vulnerabilities such as location tracking~\cite{Hilts2016fitness}.

Several security breaches involving the VTech InnoTab MAX\ have been reported.
In 2015, VTech's Learning Lodge database, used by the VTech suite of children's tablets, suffered a severe breach, exposing the PII of 6.3 million children's profiles~\cite{vtech2017breach}. The breach was due to a combination of insecure practices, e.g., PII was sent in plaintext (no HTTPS), the database was vulnerable to a simple SQL injection attack, and account passwords were stored using an MD5 hash (no salting). The breach ultimately led to a \$650,000 settlement with the U.S. Federal Trade Commission for unauthorized collection of children's personal information and for failing to secure that information~\cite{ftc2018vtechsettlement}, and a related finding from Canada's Privacy Commissioner that VTech was in breach of its privacy laws (but no corresponding settlement)~\cite{pipeda2018vtech}. Also in 2016, the UK-based security firm Pen Test Partners found that the VTech InnoTab MAX\ is vulnerable to trivial data extraction~\cite{ptpvtech2015extraction}. (We found that this flaw has not been fixed.) Later in 2016, it was found that pornography could be easily accessed through the built-in browser by using Google Translate, formerly white-listed but since removed by VTech~\cite{yahoo2016vtech}. Rapid7 also found severe vulnerabilities in the Fisher Price Smart Monkey, since fixed~\cite{rapid72016hereo}.

Hello Barbie\ has been extensively scrutinized for its privacy and security practices~\cite{hung2016glance, fantinato2017survey, nbc2015barbie}. It encourages children to divulge intimate details, which are then shared with Mattel's partner, ToyTalk, and with parents through the web portal~\cite{taylor2016smart, jones2016can}, presenting legal implications if a child discloses any physical or sexual abuse to the toy~\cite{moini2016protecting}. In January 2016, Somerset Recon Inc.~\cite{Somerset2016barbie} reported several vulnerabilities in Hello Barbie, some of which are still valid as we found (e.g., broadcasting an open hotspot and allowing unauthorized configuration during pairing).
Popular brands of children's smart watches have been analyzed by the Norwegian Consumer Council, highlighting vulnerabilities in all watches they examined~\cite{watchout}. In November 2017, ``Which? UK'' issued a report examining common Bluetooth vulnerabilities in children's toys that allowed them to be taken over by nearby attackers~\cite{which2017toyalert}.
Given the stakes at risk, the US Senate tabled a report on smart toy security in December 2016~\cite{senate2016toys}. The following July, the FBI issued an alert warning parents against privacy and security concerns regarding smart toys~\cite{fbi2017warning}.

Rafferty et al.~\cite{Rafferty2017privacy} argue that the traditional access control model is insufficient to protect the privacy of children using smart toys. They introduce a conceptual model for smart toys, allowing parents to configure privacy rules and receive notifications about sensitive data disclosure. The model assumes that children are oblivious to privacy concerns, and as a result, cannot adequately protect themselves online or anticipate the consequences of leaking private information to smart toy makers and other third parties.

Mahmoud et al.~\cite{toys2017stast} propose an analytical framework with 17 privacy-sensitive criteria to evaluate smart toy privacy practices. They analyzed the available privacy policies and terms-of-use documents for 11 smart toys, and reported potentially excessive collection of children's private information and lack of information on data storage location and legal compliance. They also performed static analysis of companion apps of these toys, and found most apps to be over-privileged with the potential to leak children's private information. Our taxonomy, in contrast, offers a classification of smart toy-specific vulnerabilities. We further investigate the \emph{actual} (as opposed to the \emph{potential}) security and privacy practices of a similar set of smart toys through dynamic analysis by using the toys and apps in a realistic scenario; our experiments measure PII collected by the toy manufacturers and third-party servers, and uncover concrete security practices and vulnerabilities.

In summary, past work mostly involved isolated case studies exposing vulnerabilities in an individual smart toy, or analytical frameworks for smart toy privacy practices. In this work we propose a taxonomy of vulnerabilities pertinent to smart toys, categorize them by attacker proximity, and comprehensively assess a set of toys against it.

\vspace{-10pt}
\section{Existing regulatory frameworks}\label{sec:regulatory}
Internet-connected toys must comply with traditional toy safety regulations, and as online services, they must adhere to applicable digital privacy laws. Where there are such laws, they tend to be more restrictive with respect to children, in keeping with the common understanding of children requiring greater legal protection. In what follows, we briefly discuss EU and US laws and regulations, as we also evaluate the toys in terms of following relevant regulatory restrictions.

In the EU, the General Data Protection Regulation (GDPR) governs how consent should be obtained when collecting children's personal information. Specifically, a consent must be obtained by a parent or guardian for children under the age of consent (13--16 years, varies among the member states), and privacy notices should be written in clear, age appropriate language~\cite{gdpr-article8children}. Data collected from children is otherwise subject to the same rules that apply to any other EU citizen, including data transparency (the ability of an individual to determine what data has been collected about them), data erasure (the right to erase that data, otherwise known as the right to be forgotten), and data portability (the ability to obtain the data for reuse across online services). The GDPR also mandates how companies must respond in the event of a breach, and penalties may be imposed for failing to report the breach to the applicable authority and notifying the affected individuals in a timely fashion. EU citizens do not have to reside in the EU to be protected by the GDPR, even if they use services from a company without any legal presence in the EU market~\cite{gdpr}.

In the US, the Children's Online Privacy Protection Act (COPPA) governs data collection and online tracking of children under the age of 13. Online services should take reasonable measures to obtain parental consent to collect and disclose information, clearly outline data retention policies, and provide a means for data review and deletion. Under COPPA, private information is defined to include persistent identifiers like an IP address, which by default is included in all TCP/IP traffic; thus, by definition, all internet-connected toys collect private information. MAC addresses, like those of a toy's Bluetooth or WiFi interface, are also considered to be persistent identifiers; in our tests, we have observed MAC addresses transmitted to first party toy servers as well as third-party analytics servers.  However, merely collecting persistent identifiers (absent parental consent) is not in and of itself a violation of COPPA, if it is not used in conjunction with any other identifying information, or  if it is not stored or made public, or if it not used for any other purpose than to ensure proper operation of the service (in this case, the toy). If the toy or companion app contacts a third-party analytics company, which then uses persistent identifiers to build a profile of the child, or passively track the child online, it is a COPPA violation, absent explicit parental consent.
Further, the toy's privacy policy must explicitly list all such third party companies~\cite{ftccoppafullact}.

Prior work has analyzed toys' privacy policies for compliance with these laws, and compared, through static analysis, the toys' stated policies with the privileges requested by their companion apps. Through dynamic analysis, we have found excessive collection of persistent identifiers by toy makers and ads and analytics services, and in some cases, we also have found a clear violation of COPPA's injunction against persistent tracking for the purpose of advertising. In addition, while both COPPA and GDPR do not explicitly address issues of security, we have found security vulnerabilities that expose PII to unauthorized parties (e.g. unauthorized configuration and use), which violates the spirit of such regulations if not their actual content.

\section{Analysis framework}\label{sec:framework}
Most of the smart toys we analyze are intended to be used with companion apps running on smartphones or tablets. All the mobile apps we examine, and all toys with direct connectivity,  communicate with remote hosts. This presents a wide attack surface covering toys, apps, remote hosts, and the communication between each pair of these; see Fig.~\ref{fig:toys_attack_surface}.

\begin{figure}[h]
	\centering
	\includegraphics[scale=0.3]{main_diagram.png}

	\caption{Smart toy attack surface}
	\label{fig:toys_attack_surface}

\end{figure}

\subsection{Security of PII collection and transmission}

Toys that require the user to create an account typically collect and store more PII than toys that do not. We audit the network traffic of smart toys and their companion apps to determine the PII they collect, transmit, and share with toy servers and third parties, and whether those third parties are ads or analytics servers.

We evaluate the security measures for protecting the collected PII in local storage and when being sent to a remote server. In some cases, we also verify that non-PII or non-confidential content such as toy name and images (in toy/web UI) are protected from malicious tampering.
Data transmission (including PII) can occur between the toy and a companion app, a companion app and a remote server, or, for toys with Internet connectivity, the toy itself and a remote server. Additionally, data may be stored locally on the toy or on the device hosting the companion app. To investigate the confidentiality and integrity of data, we assess the security of communications channels between each pair of endpoints and local data storage mechanisms.

We determine the protocols used to communicate with remote hosts (e.g., HTTP or HTTPS),
and assess the likelihood and severity of active man-in-the-middle attacks, from replacing UI elements in the app with inappropriate content to remotely controlling the toy.

\subsection{Potential vulnerabilities}
We define a list of potential vulnerabilities and assess the smart toys against them. These vulnerabilities are grouped by the proximity required to exploit them.

\subhead{Physical access}
The following vulnerabilities can be exploited by an adversary with physical access to the toy or companion smart device.
\subsubhead{No-local-PII-protection} An adversary can retrieve PII stored locally in the toy's internal storage, or within the companion app, leaving it unprotected in the event the toy/device is lost, stolen, or sold unsanitized.
\subsubhead{\configphys} An adversary can configure the toy/device to maliciously forward PII to their account, or issue harmful commands to the child.
\subhead{Nearby access}
These vulnerabilities require an attacker to be near the toy (e.g., within WiFi/Bluetooth range).
\subsubhead{\play} This vulnerability allows an attacker to use the toy, for instance to remotely control it.
\subsubhead{Unauthorized-config-nearby} An attacker can download the companion app in his own device, then connect to the toy, and maliciously configure it.
\subsubhead{Unencrypted-hotspot} Some toys can toggle their WiFi adapter into access point mode to allow a companion app to connect directly to the toy and configure it. A toy's hotspot should authenticate devices that attempt to connect, and use an encrypted channel. Otherwise, an adversary who connects to a toy's open hotspot can launch an MitM attack and sniff PII in plaintext, or maliciously configure the toy.
\subsubhead{Insecure-Bluetooth-practice} The use of static Bluetooth MAC addresses allows a toy, and the child using it, to be tracked persistently (cf.~\cite{Hilts2016fitness}). Also, accepting unauthorized Bluetooth connections by the toy allows adversaries to connect to the toy and change its behavior, or launch an MitM attack to sniff information transmitted between the toy and the app (cf.~\cite{Bluetoothsecurity}). Bluetooth Low Energy (BLE) resolves these two problems by MAC address randomization and whitelisting~\cite{fawaz2016bluetooth}.
\subsubhead{Always-on} Toys that do not have power switches and include sensitive sensors or are connected to the Internet, increase their exposure to potential attack, for instance by continuously broadcasting a static MAC address.

\subhead{Remote access}
The following vulnerabilities expose the toy to remote attacks.
\subsubhead{Online-password-bruteforce} Some toys allow Web login to the parent account. Login pages that allow unlimited number of password trials could allow an adversary to brute force passwords, particularly if they are weak.
\subsubhead{No-remote-PII-protection} This vulnerability allows adversaries to access PII remotely without proper access control (e.g., allowing access to audio/video recordings through a link, without any further authentication).
\subsubhead{Weak-parental-PII-control} Some toys do not allow parents to review or delete PII collected from their children, such as voice recordings or pictures.
\subsubhead{Exposure-to-third-parties} Third parties with whom PII is shared, such as ads and anaytics server, may have inadequate measures to protect collected data.
\subsubhead{Unencrypted-comm-channels} Information exchange between different parties (toy, app, and hosts) may be susceptible to interception through a MitM attack (e.g., if HTTP is used).
\subsubhead{Insecure-session-cookies} Session cookies are used to automatically log users in to their accounts. If they are not adequately secured, for instance if they do not expire or the \emph{secure flag} is not set, an adversary may gain unauthorized access to the parent account and to the child's profile.

\subsubhead{\tls}
TLS vulnerabilities~\cite{xiong2014survey} may result from using weak cipher suites, old TLS versions such as SSL 3.0, and vulnerable extensions. We examine servers contacted by the toy against protocol vulnerabilities such as POODLE,
CRIME, Heartbleed, and Ticketbleed~\cite{ristic2013bulletproof}, and assess server certificates for security issues, including using weak cryptographic keys and certificate mismatch.
\subsubhead{URL-redirect} Web servers that are not hardened against a URL redirect vulnerability could allow an adversary using social engineering techniques to redirect users to phishing websites (e.g., to steal their credentials). An adversary could send links to users that appear legitimate (e.g., containing the correct domain name), but that use special characters to redirect the user to a malicious domain. Servers should prevent URL redirect, or at least whitelist accepted URLs.
It should be noted that an ideal taxonomy of threats would include other common web-based vulnerabilities, such as those in the OWASP top-ten most critical web application security risks. We have not presented these here as they require more intrusive probing of the web sites in question (e.g., cross-site scripting (XSS)), which for legal reasons, require consent from the companies in question.

\section{Methodology and experimental setup}\label{sec:setup}

Using our threat classification model, we perform case studies on eleven well-known smart toys, described in Appendix~\ref{sec:smarttoys}. We systematically assess the toys, their companion apps, and the remote servers they communicate with against our model. To obtain data for our analysis, we systematically run the toys through typical use case scenarios, using real mobile devices to circumvent evasion techniques apps might use to avoid detection of suspicious activity. Existing app analysis tools are used to detect the servers the toys communicate with, the PII they transmit, and the security measures applied by toy makers to protect personal information. We augment these wherever suitable by applying reverse engineering mechanisms, network traffic analysis, retrieval of certificate private keys, and leaking protection passphrases.

\subsection{Experimental setup}
We maintain two experimental setups. Our first environment uses a PC hosting Windows 10 professional 64-bit. The PC is configured to use a MediaTek 802.11G WiFi adapter in access point mode, using the 2.4 GHz frequency band (the band used by the toys we examine), and a second NIC with Internet connectivity. We examine the companion apps using a Samsung N7100 hosting Android 4.4.2. This version of Android is ranked among the top four Android versions used in the wild~\cite{androidwild}. As an older version of Android, it is illustrative of how toys deal with older cipher suites, TLS versions and TLS protocol vulnerabilities. Our second environment uses a MacBook tethered via USB to an iPhone providing Internet connectivity and configured to act as an access point. Companion apps ran on iOS 10, both on an iPad Air and an iPhone 7. We chose iOS 10 as it was the latest iOS version at the time we began experimentation in June 2017, and statistics show that the majority of iOS users run the latest version of the OS~\cite{iOSVsAndroidVersions}. We tested one group of toys on an Android platform (Toymail, Wiggy,  Barbie, CHiP, and Cloudpets) and the other group on iOS (Sphero, Cozmo, Ozobot, Osmo, and Monkey). We hope to expand on this work in the future by performing a systematic comparison of the latest versions of both platforms.

\subsection{Network analysis}
Both experimental setups use Wireshark\footnote{https://www.wireshark.org} to sniff network traffic initiated by the toys and their companion apps.
To decrypt traffic, our first setup uses Burp Suite\footnote{https://portswigger.net/burp} as a MitM proxy and adds the Burp Suite CA certificate to the smartphone CA store. Our second setup uses MitMProxy\footnote{https://mitmproxy.org} in lieu of Burp Suite, and correspondingly installs MitM-generated certificates on the devices running the apps. We address special cases where this approach was insufficient to intercept and decrypt TLS communications. All such interventions were performed on Android-based client apps that were reverse-engineered.
The Qualys SSL Labs\footnote{https://www.ssllabs.com} testing suite was used to perform TLS analysis on the server side, and we examined packet captures in Wireshark to analyze TLS practices on the client app.

\subsection{Ads and analytics analysis}
Wherever possible, we intercept data between the companion app and third party ads and analytics servers (Internet-capable toys we examined do not directly communicate with ads and analytics services). To determine the extent to which this data can be used to uniquely identify the user across multiple apps on the same device or across different platforms on different devices, we created an account on a selected analytics server, Flurry Analytics, used by two of our toys, and wrote and deployed a dummy app to connect to it. Using this method, we were able to determine that Flurry Analytics used the same unique identifier on both a companion app and our dummy app, despite the fact that the vendor ID is different on both. This identifier can be used to distinguish the user across unrelated services on the same device. Other analytics servers we examined correlate unique identifiers with users' personal information such as email address, or use cross-platform cookies such as DSID and IDE~\cite{googlecookies} cookies to distinguish users across different platforms.

\subsection{App analysis} \label{subsec:appanalysis}
All companion apps were analyzed manually (as opposed to using, for example, the Monkey automation tool\footnote{https://developer.android.com/studio/test/monkey.html}). We mimicked common use case scenarios with the goal of triggering app UI events looking for signs of PII leakage, weak security measures, or potential vulnerabilities, and captured data from the interaction with the toy and its companion app.

\subhead{Modify custom CA store}
When the companion app uses a custom CA store to verify server certificates, we apply the following methodology to force the app to accept the MitM certificate: (a) Decompile the app using Apktool\footnote{https://github.com/iBotPeaches/Apktool} to retrieve the CA store from the app's assets directory, (b) Patch parts of the app smali files to force revealing the CA store password, (c) Use the password to access and update the custom CA store, (d) Use the keystore explorer tool to add the MitM certificate, and
(e) Replace the CA store in the assets directory of the app with the new store, rebuild the app using Apktool, re-sign and verify the patched apk file, and use the adb tool to reinstall it. As a result, the app accepts the MitM certificate.

\subhead{Exfiltrate client SSL certificate}
In cases where the companion app authenticates to the server using a client Bouncy Castle file (PKCS\#12), which encompasses the client's public key and the client's private key, we reverse engineer the app to exfiltrate the PKCS\#12 file and the passphrase used to protect it. We then add the PKCS\#12 file (the certificate and the private key) to the interception proxy. This allows the interception proxy to authenticate to the server.

\subhead{Bypass certificate pinning}
In cases where the companion app uses certificate pinning to refuse server certificates signed by any CA other than the one with the pinned certificate in the app, we patch the corresponding parts of the app smali files to disable this feature and intercept the communication.

\subsection{TLS vulnerabilities analysis}
We assess toys, apps and server SSL practice to determine potential TLS protocol vulnerabilities, and use Qualys SSL Labs to determine TLS server parameters, including supported TLS versions, cipher suites and extensions.

\subsection{Bluetooth analysis}

BLEscanner\footnote{\url{https://play.google.com/store/apps/details?id=com.macdom.ble.blescanner}} is used to examine the Bluetooth connection between the toy and the companion app, and determine whether the toy's Bluetooth MAC address is persistent or dynamically changing. We investigate how an adversary could tamper with the communication or gain unauthorized access to Bluetooth parameters to conduct MitM or other attacks~\cite{btmitm}. The BTLEjuice tool\footnote{\url{https://github.com/DigitalSecurity/btlejuice}} is used to conduct MitM attacks on toys that use Bluetooth to exchange data with a companion app, to both sniff and alter the communication, and RamBLE\footnote{\url{https://www.contextis.com/resources/tools/ramble-ble-app}} is used to modify BLE settings.

\section{Summary of Results}\label{sec:results}

We systematically applied our threat classification scheme to a sample of 11 popular smart toys on the market, varying by target age range and functionality. In particular, the toys we selected span multiple target ages, from Hello Barbie\ and Smart Toy Monkey, geared towards younger audiences, to what are generally thought of as STEM (Science, Technology, Engineering, and Math) toys aimed at children 8+, such as Sphero BB-8, Anki Cozmo, and Ozobot Bit. Toy functionality encompasses AI  capability,\footnote{For example, Anki Cozmo\ is marketed as an AI toy: ``Anki Cozmo, is an AI toy robot with a big brain and even bigger personality'' (\url{https://www.anki.com/en-ca/cozmo} (in the page metadata).} such as voice and image recognition; sensors, like microphone and camera; mobility; and wireless communication, like WiFi and Bluetooth. Detailed results and analysis of individual toys are available in~\ref{sec:smarttoys}.

Nine of the eleven toys we examined are vulnerable to some form of attacks, whether through physical or nearby access (within WiFi or Bluetooth coverage), or remotely, such as over HTTP; see Table~\ref{tab:attacks}.

\begin{table*}[!htb]
	\small
	\centering
	\caption{Attacks by proximity}

	\label{tab:attacks}

	\begin{adjustbox}{max width= 14.5cm}

	\begin{tabular}{lccccccccccccccccccc}

		&&&\multicolumn{3}{p{1.5cm}}{\centering Physical}&&\multicolumn{5}{p{2.5cm}}{\centering Nearby }&&\multicolumn{7}{p{3.5cm}}{\centering Remote}\\
		\cline{4-6}  \cline{8-12}  \cline{14-20}
		~  &
		\rot{No-local-PII-protection } &

		\rot{\configphys} & &
		\rot{\play} &
		\rot{Unauthorized-config-nearby} &
		\rot{Unencrypted-hotspot } &
		\rot{Insecure-Bluetooth-practice} &
		\rot{Always-on } & &

		\rot{Online-password-bruteforce} &

		\rot{No-remote-PII-protection} &
		\rot{Weak-parental-PII-control} &
		\rot{Exposure-to-third-parties} &
		\rot{Unencrypted-comm-channels} &
		\rot{Insecure-session-cookies} &

		\rot{\tls} &
		\rot{URL-redirect} \\
		\cline{1-20
		Toymail &\Checkmark&\Checkmark&&&&&&\Checkmark&&&&\Checkmark&\Checkmark&\Checkmark&\Checkmark&\Checkmark&\Checkmark&& \\
		Wiggy Piggy Bank  &&\Checkmark&&\Checkmark&\Checkmark&&\Checkmark&&&\Checkmark&&&&&\Checkmark&&\Checkmark&& \\
		Hello Barbie  &&\Checkmark&&&\Checkmark&\Checkmark&&&&\Checkmark&&&&&&&\Checkmark&& \\
		Sphero BB-8  &&&&\Checkmark&&&\Checkmark&\Checkmark&&&&&&&&&&& \\
		Anki Cozmo    &&&&&&&\Checkmark&&&&&&&&&&&& \\
		Ozobot Bit  &&&&&&&&&&&&&&&&&&& \\
		Osmo  &&&&&&&&&&&&&&&&&&& \\
		Smart Toy Monkey  &&&&&&&\Checkmark&&&&&&&\Checkmark&&&&& \\
		VTech InnoTab MAX  &\Checkmark&&&&&&&&&&&&&\Checkmark&&&&& \\
		Wowwee Chip &\Checkmark&&&\Checkmark&&&\Checkmark&&&&&&&&&&&& \\
		Cloudpets &&\Checkmark&&&&&\Checkmark&&&\Checkmark&&&\Checkmark&\Checkmark&\Checkmark&\Checkmark&\Checkmark&& \\
		\cline{1-20}
	\end{tabular}
	\end{adjustbox}
\end{table*}

In terms of PII collection and contacting third-party servers, all toys we examined collected PII, and 9 out of 11 communicated with one to four ads and analytics servers; see Table~\ref{tab:ads}. Alarmingly, the toys for younger children collected PII more aggressively and frequently, including intrusive PII, such as cross-service and cross-platform unique identifiers and user and devices fingerprinting information; these toys also in general protected PII more poorly. One such toy in our samples (Cloudpets) also displays ad in its companion app. In contrast, toys for older children collected less PII, generally did not require account creation, and had more thoughtful security measures in place.

\begin{table*}[!htb]
	\small
	\centering
	\caption{Ads and analytics services contacted by smart toys and companion apps}

	\label{tab:ads}
	\begin{tabular}{lccccccccccccc}

		~  &
		\rot{ tangible-analytics.appspot.com } &
		\rot{ googleads.g.doubleclick.net } &
		\rot{ googlesyndication.com } &
		\rot{ googleadservices.com} &
		\rot{ google-analytics.com} &
		\rot{ data.flurry.com} &
		\rot{ e.crashlytics.com} &
		\rot{ unity3d.com} &
		\rot{ hockeyapp.net } &
		\rot{ api.branch.io} &
		\rot{ api.segment.io } &
		\rot{ wzrkt.com } &
		\rot{ads.mopub.com } \\
		\cline{1-14}\\
		Toymail &&&&&&&\Checkmark&&&\Checkmark&\Checkmark &\Checkmark& \\
		Wiggy Piggy Bank  &&&&&\Checkmark&&&\Checkmark&&&&& \\
        Hello Barbie  &&&&&&&&&& \\
		Sphero BB-8  &&&&&&\Checkmark&&\Checkmark&&&&& \\
		Anki Cozmo    &&&&&&&&&\Checkmark&&&& \\
		Ozobot Bit  &&&&&&&&\Checkmark&&&&& \\
		Osmo  &\Checkmark&&&&&&\Checkmark&&&&&&\\
		Smart Toy Monkey  &&&&&&&\Checkmark&&&&&& \\
		VTech InnoTab MAX  &&&&&&&&&& \\
		Wowwee Chip &&&&&&\Checkmark&\Checkmark&&&&&&\\
		Cloudpets &&\Checkmark&\Checkmark&\Checkmark&&&&&&&&&\Checkmark\\
		\cline{1-14}
	\end{tabular}

\end{table*}

Table~\ref{tab:ids} shows the persistent user IDs collected by the toys and companion apps. Apparently, some IDs captured in the transmissions were obfuscated, or their purpose was unclear. In such cases, we assume that if they appear across multiple sessions, like an app ID, then they are deemed to track the user across multiple sessions of the same app. All the Android apps we tested (Toymail, Wiggy Piggy Bank, Hello Barbie, Wowwee Chip, and Cloudpets) transmit the Google advertising ID, even when ad tracking is disabled in the smartphone. These apps, and those that transmit a hardware ID, are deemed to track users across multiple services on the same device. Finally, apps that use cookies such as DSID and IDE on Android~\cite{googlecookies}, or transmit email addresses or other identifying information about the user to analytics servers, are deemed to track users across multiple platforms. On iOS apps, the smartphone's advertising identifier was not transmitted when the ``Limit ad tracking'' was disabled.

\begin{table}[!htb]
	\small
	\centering
	\caption{Types of persistent user identifiers collected by smart toys}

	\label{tab:ids}

	\begin{tabular}{lcccccccc}

		&&\rot{ \parbox{2.7cm}{Multi-session tracking} } & &\rot{ \parbox{2.7cm}{Multi-service tracking}} &&
		\rot{\parbox{2.7cm}{Multi-platform tracking}} &&\\
		\cline{1-9}
		Toymail  &&\Checkmark&&\Checkmark&&\Checkmark&& \\
		Wiggy Piggy Bank  &&\Checkmark&&\Checkmark&&&& \\
		Hello Barbie  &&\Checkmark&&\Checkmark&&&& \\
		Sphero BB-8  &&\Checkmark&&\Checkmark&&&& \\
		Anki Cozmo  &&\Checkmark&&&&&& \\
		Ozobot Bit &&\Checkmark&&\Checkmark&&&&\\
		Osmo  &&\Checkmark&&&&&&\\
		Smart Toy Monkey  &&\Checkmark&&\Checkmark&&&&\\
		VTech InnoTab MAX  &&&&&&&&\\
		Wowwee Chip  &&\Checkmark&&\Checkmark&&&&\\
		Cloudpets  &&\Checkmark&&\Checkmark&&\Checkmark&&\\
		\cline{1-9}

	\end{tabular}

\end{table}

Table~\ref{tab:pii} shows types of PII collected by first-party toy servers. Note that we exclude any PII stored locally on the toy or smartphone. Multimedia may consist of audio (e.g., voice recordings), photos, or video, which may be recorded by the user as part of toy functionality, or uploaded as profile information. We consider a toy to transmit geolocation only at street-level granularity or below, not above (e.g., city). All the toys we examined transmit the user's public IP address, but in addition one (Toymail) sends the private IP address of the toy on the local network.  Toymail is unique also in that it transmits the user's Facebook ID and the sleep/wake cycle of the child.

\begin{table}[!htb]
    \small
    \centering
    \caption{PII collected }

    \label{tab:pii}
    \begin{tabular}{lllllll}
    ~ & \rot{Parent's full name} & \rot{Child's full name} & \rot{Child's age} & \rot{Email address} & \rot{Multimedia} & \rot{Geolocation} \\
    \hline
    Toymail & \Checkmark & \Checkmark & ~ & \Checkmark & \Checkmark & ~ \\
    Wiggy Piggy Bank & ~ & \Checkmark & ~ & \Checkmark & ~ & ~ \\
    Hello Barbie & ~ & ~ & ~ & \Checkmark & \Checkmark & ~ \\
    Sphero BB-8 & ~ & ~ & \Checkmark & ~ & ~ & ~ \\
    Anki Cozmo & ~ & ~ & ~ & ~ & ~ & ~ \\
    Ozobot Bit & ~ & ~ & ~ & ~ & ~ & ~ \\
    Osmo & ~ & ~ & ~ & ~ & ~ & ~ \\
    Smart Toy Monkey & ~ & ~ & ~ & ~ & ~ & ~ \\
    VTech InnoTab MAX & \Checkmark & \Checkmark & ~ & ~ & \Checkmark & \Checkmark \\
    Wowwee Chip & ~ & ~ & ~ & ~ & ~ & ~ \\
    Cloudpets & \Checkmark & \Checkmark & \Checkmark & \Checkmark & \Checkmark & ~ \\
    \hline
    \end{tabular}

\end{table}

\section{Recommendations}\label{sec:recommendations}

In this section, we list our recommendations for makers of connected toys, beyond following existing safety standards and privacy regulations.

\subhead{Fixing vulnerabilities} Toys, like other more generalized IoT devices, should have a process for addressing vulnerabilities. This includes a way to disclose vulnerabilities, including: a formalized reporting mechanism, a simple link to a form on their web site, or subscription to a bug bounty program, like HackerOne (\url{hackerone.com}) or BugCrowd (\url{bugcrowd.com}). At the very least, vulnerability disclosure should not be discouraged by prohibiting under the terms of use. There should be a short turnaround between identifying vulnerabilities and fixing them in the firmware or app software where they are located. Finally, it is critical to be able to push out new firmware or software updates and patches as soon as they are available. There are existing mechanisms to update companion apps through the corresponding Android or iOS app store, but pushing out firmware updates to the toy is slightly more challenging. Toys with Wi-Fi connectivity should periodically check for updates, and companion apps should check at the launch time for available updates. However, relying on the user to manually launch the app extends the window of potential exploitation between discovery of the vulnerability and time it is patched, so it is preferable for apps to have push notification functionality enabled. For this reason, companion apps should request permission to push notifications on first launch, and clearly state why this can improve the security and safety of the toy. (It is also incumbent on the app to not abuse the permission with unnecessary notifications lest the user disable it.)

\subhead{Limiting data collection, and improving storage and communication security} Toys should limit the collection, storage, and transmission of personal data to only what is strictly necessary. Toys should not store personal information such as voice recordings, photos, videos, or any personal information that identify users/children, internally on the toy's flash memory; if it is necessary for toy functionality, then it should be stored encrypted. Transmission of personal information should always occur over secure communication channels such as TLS.
Toys and companion apps should use TLS for all internet traffic, with strong cipher suites and recent TLS versions (e.g., TLS 1.2),
patched against known TLS protocol vulnerabilities. Wherever possible, host whitelisting should be used, hard coded in the smart toy firmware and the companion app, as it can mitigate phishing and MitM attacks. Certificate pinning can also help prevent MitM attacks.

\subhead{Securing Bluetooth and WiFi connections} Toys with wireless capabilities should take particular care to secure pairing and connection. If the toy uses Bluetooth, it should use Bluetooth encryption. Using open Bluetooth can allow unauthorized access to the toy and PII stored on it. Toys should also use dynamic Bluetooth MAC addresses to avoid the possibility of tracking children's locations. WiFi-enabled toys should be provisioned in a secure manner, with WiFi credentials supplied securely over an out-of-band channel.

\subhead{Fine-grained access control} Toy companies that provide links to PII on public servers, such as voice recordings, should also grant parents the ability to select whether the PII is public or private. Even when links are randomly generated, if they are sufficient to access PII without any additional authorization, it still can pose a privacy threat. We also recommend allowing the parent to configure whether such links are public or private, defaulting to private. Finally, these links should expire after a reasonably short period of time.

\subhead{End-of-life} Toys should provide a graceful means of scrubbing identifying and personal data in the event of end-of-life, loss, theft, or transitioning owners. This may mean restricting the amount of personal data stored locally on the toy to only what is strictly necessary, and requiring some form of authentication to access whatever data remains.
Toys that require the creation of online accounts tend to collect more personal information than toys that do not, at least in our sample, but also provide a convenient interface for letting a parent log in through a browser and dissociate the toy from the account if necessary. This ensures that an unauthorized third party with access to the toy cannot access the related account and any personal data stored within it, or use it to communicate with the child.

\subhead{Advertisement and tracking} We strongly caution against ad display in companion apps, especially as these apps form part of a purchased toy and thus should not require support through ad revenue. In addition, ads and analytics services should be used sparingly with children~\cite{austin1999}, and when used, should not collect any PII. Various other measures can be taken to protect the user's identity when using analytics services; Google Analytics, for instance, provides a means of anonymizing IP addresses~\cite{googleipanonymization}. Flurry Analytics prohibits the use of its services with children under the age of 13 (in accordance with COPPA) unless its restricted feature set limiting user profiling is used~\cite{flurryrestrictedset}.

Apps should respect users' request to disable ad tracking. This is an issue particularly on Android platforms.
Specifically, we observed multiple instances of Android apps flouting the user's preferred ad tracking setting, and sending the ad identifier regardless of whether it was disabled. By contrast, iOS app developers cannot access a valid ad identifier on a device that has ad tracking disabled~\cite{appleadid}.
In the Android model, a single system call returns both the ad identifier and the limit ad tracking setting, and the developer is assumed to not abuse them~\cite{googleadid}.

\section{Conclusions}\label{sec:conclusions}
In this paper, we examined the security and privacy practices of eleven popular smart toys on the market. Our findings show widespread use of data collection by toy makers and third party analytics servers, with almost all toys embedding analytics services within their apps, and many of them transmitting advertising identifiers even when ad tracking is disabled by the user. Several toys do not take adequate measures to protect sensitive data, and some toys do not protect locally stored PII at all, making it trivially accessible to anyone with physical access. Children's physical safety may also be at risk, as all Bluetooth-capable toys we examine advertise a static MAC address, making it possible to track them through physical space. Finally, several toys are vulnerable to exploits that can result in handing an attacker control of the toy or some of its functionality, potentially causing harm to a child.

\section*{Acknowledgments}
This work is supported by a grant from the Office of the Privacy Commissioner of Canada (OPC) Contributions Program.
\bibliographystyle{abbrv}

redpajama_set_name: RedPajamaArXiv


text:
\section{Introduction}
\pst
It is known \cite{Vil} that there exists a possibility to get some relations for special functions which turn out
to be the matrix elements of irreducible unitary representation of compact and noncompact groups.
\par On the other hand, in classical probability theory  and in quantum tomographic approach \cite{Ibort}
for description of quantum states the specific probability distributions expressed in terms of some special functions appear
in a natural way. Since entropies  are determined by the probability distributions and there exist relations,
in particular, in the form of entropic and information inequalities, one can apply these   inequalities to get
some new inequalities for the special functions.
\par For one random variable the probability distribution which appears as a result of experiment with finite number of outcomes is characterized by
the Shannon entropy \cite{Shannon}. The results of experiments where two random variables are measured can be associated with a joint probability distribution. The
distribution is connected with $N=N_1\cdot N_2$ outcomes where for the first random variable we have $N_1$ results and for second random variable we have $N_2$ results.
The joint probability distribution and dependence between two random variables determine two marginal probability distributions by the Sklar's theorem \cite{Nelsen}. For these  three probability distributions one can calculate Shannon entropies \cite{Shannon}.
These entropies satisfy the inequality called the subadditivity condition \cite{Lieb}. The entropic inequalities for the bipartite systems were used in \cite{Chernega,Mendes} in the
framework of the tomographic probability representation of quantum mechanics to characterize two degrees of quantum correlations in the systems. On the other hand the
mathematical structure of the subadditivity condition permits to apply   this inequality in all cases where the set of nonnegative numbers or functions appears and
the sum of numbers or functions equals to unity.
\par The aim of our work is to consider the unitary matrices connected with the irreducible representation of the rotation group and other groups and construct probability
distributions creating from
entropic inequalities the inequalities for such special functions  as Jacobi and Legendre polynomials.
\section{Inequalities for $SU(2)$ - representation matrix elements}
\pst
It is known that the unitary irreducible representations of rotation group with spins (or $SU(2)$)   are expressed in terms of Jacobi polynomials \cite{Vil,Landau}.
The squared modules of the matrix elements are
\begin{eqnarray}\label{1}
\Big|d_{m',m}^{(j)}(\beta)\Big|^2\!\!\!\!\!&=&\!\!\!\!\frac{(j+m')!(j-m')!}{(j+m)!(j-m)!}\left(\cos\left(\frac{\beta}{2}\right)^{m'+m}\sin\left(\frac{\beta}{2}\right)^{m'-m}
P_{j-m'}^{(m'-m,m'+m)}(\cos\beta)\right)^2,
\end{eqnarray}
where $P_{j-m'}^{(m'-m,m'+m)}(\cos\beta)$ denote the Jacobi polynomials \cite{Landau}
\begin{eqnarray*}
P_{n}^{(a,b)}(z)&=& \frac{(-1)^n}{2^nn!}(1-z)^{-a}(1+z)^{-b}\frac{d^n}{dz^n}(1-z)^{a+n}(1+z)^{b+n}.
\end{eqnarray*}
The following relation
\begin{eqnarray}\label{11}
d_{m',m}^{(j)}(\beta)&=&(-1)^{m'-m}d_{m,m'}^{(j)}(\beta)=d_{-m,-m'}^{(j)}(\beta)
\end{eqnarray}
holds.
We shall apply the generic inequalities for probabilities expressed in terms of Shannon entropies to these matrix elements.
The point is that one has $\Big|d_{m'm}^{(j)}(\beta)\Big|^2\geq0$ and
\begin{eqnarray}\label{2}
\sum\limits_{m'=-j}^{j}\Big|d_{m',m}^{(j)}(\beta)\Big|^2&=&1,\quad
\sum\limits_{m=-j}^{j}\Big|d_{m',m}^{(j)}(\beta)\Big|^2=1.
\end{eqnarray}
Thus the values $\Big|d_{m'm}^{(j)}(\beta)\Big|^2$ can be considered as probabilities.
We denote these probabilities as
\begin{eqnarray}\label{3}
P_{m'}^{(j)}(\beta)&=&\Big|d_{m',m}^{(j)}(\beta)\Big|^2,\quad P_{m}^{(j)}(\beta)=\Big|d_{m',m}^{(j)}(\beta)\Big|^2.
\end{eqnarray}
We will use the map of the numbers $m'$ and $m$ onto the numbers $1,2,\ldots,N=2j+1$ using the following rule
\begin{eqnarray*}
-j\Rightarrow 1,\quad -j+1\Rightarrow 2,\quad\ldots,\quad j \Rightarrow N.
\end{eqnarray*}
Thus we can study the relation which can be obtained by considering the probability vector $\overrightarrow{p}=(p_1,p_2,\ldots,p_N)$, where
$\sum\limits_{k=1}^{N}p_k=1$, $p_k\geq0$ hold.
\par The Shannon entropy associated with the probability vector $\overrightarrow{p}$ is determined by
\begin{eqnarray}\label{10}H_{p}&=&-\sum\limits_{k}p_{k}\ln p_{k}.
\end{eqnarray}

\section{Example of the spin $j=3/2$}
\pst
Let us discuss the arbitrary probability distribution identified with  the $4$-vector $\overrightarrow{p}=(p_1,p_2,p_3,p_4)$.
For the probability vector $\overrightarrow{p}$ we can introduce the following invertible map of the indices
\begin{eqnarray}\label{14}
1\Leftrightarrow 11,\quad 2\Leftrightarrow 12,\quad 3 \Leftrightarrow 21,\quad 4 \Leftrightarrow 22.
\end{eqnarray}
Then the probabilities are given in the form of the matrix $(p_{il})$ which could be interpreted as a joint probability of the bipartite system
(two coins)
\begin{eqnarray*}
p_1\Leftrightarrow p_{11},\quad p_2\Leftrightarrow p_{12},\quad p_3 \Leftrightarrow p_{21},\quad p_4 \Leftrightarrow p_{22}.
\end{eqnarray*}
It means that we mapped the probabilities for the system without subsystems into joint probability distribution associated with the bipartite system. Marginal probability distributions determined by the joint probability distribution are
\begin{eqnarray}\label{15}\pi_i&=&\sum\limits_{l=1}^2p_{il}=p_{i1}+p_{i2},\\ \nonumber
\Pi_l&=&\sum\limits_{i=1}^2p_{il}=p_{1l}+p_{2l}.
\end{eqnarray}
Thus, according to definition of Shannon entropy \eqref{10} the entropies associated with the initial probability distribution and two marginals are
\begin{eqnarray}\label{6}H_{p}&=&-p_1\ln p_1 -p_2\ln p_2-p_3\ln p_3-p_4\ln p_4,\\\nonumber
H_{\pi}&=&-(p_1+p_2)\ln(p_1+p_2)-(p_3+p_4)\ln(p_3+p_4),\\\nonumber
H_{\Pi}&=&-(p_1+p_3)\ln(p_1+p_3)-(p_2+p_4)\ln(p_2+p_4).
\end{eqnarray}
It is known that the Shannon entropies associated with the bipartite system satisfy some inequalities.
The following inequality which is called the subadditivity condition reads
\begin{eqnarray*}&&H_{\pi}+H_{\Pi}\geq H_{p}.
\end{eqnarray*}
The Shannon information is defined as the difference of the sum of the entropies of the subsystems and entropy of the bipartite system, i.e.
\begin{eqnarray}\label{7}I(\beta)&=&H_{\pi}(\beta)+H_{\Pi}(\beta)-H_{p}(\beta).
\end{eqnarray}
Obviously the Shannon information satisfies the inequality $I(\beta)\geq 0$ for all angles $\beta$.
\par Now we focus on the particular probability distribution determined by matrix elements of four dimensional irreducible representation of the group $SU(2)$ which corresponds to spin $j=3/2$.
\par
For $j=3/2$ the numbers $m$ and $m'$ which are spin projections on $z$-axis take the values  $-3/2$, $-1/2$, $1/2$, $3/2$. All elements of \eqref{1}
are represented in Table \ref{tab:1},
\begin{table}[Ht]
    \begin{center}
    \begin{tabular}{c|c|c|c|c}
    $m'\setminus m$ &$3/2$ & $1/2$ &$-1/2$ & $-3/2$ \\
    \hline
    $3/2$  &$\widetilde{d}_{3/2,3/2}^{(j)}(\beta)$&$\widetilde{d}_{3/2,1/2}^{(j)}(\beta)$ &$\widetilde{d}_{3/2,-1/2}^{(j)}(\beta)$&$\widetilde{d}_{3/2,-3/2}^{(j)}(\beta)$\\
    \hline
     $1/2$&$\widetilde{d}_{1/2,3/2}^{(j)}(\beta)$&$\widetilde{d}_{1/2,1/2}^{(j)}(\beta)$&$\widetilde{d}_{1/2,-1/2}^{(j)}(\beta)$&$\widetilde{d}_{1/2,-3/2}^{(j)}(\beta)$\\
    \hline
    $-1/2$  &$\widetilde{d}_{-1/2,3/2}^{(j)}(\beta)$&$\widetilde{d}_{-1/2,1/2}^{(j)}(\beta)$&$\widetilde{d}_{-1/2,-1/2}^{(j)}(\beta)$&$\widetilde{d}_{-1/2,-3/2}^{(j)}(\beta)$\\
    \hline
     $-3/2$&$\widetilde{d}_{-3/2,3/2}^{(j)}(\beta)$&$\widetilde{d}_{-3/2,1/2}^{(j)}(\beta)$&$\widetilde{d}_{-3/2,-1/2}^{(j)}(\beta)$&$\widetilde{d}_{-3/2,-3/2}^{(j)}(\beta)$\\
    \end{tabular}
\caption{\label{tab:1}}
    \end{center}
    \end{table}
    where it was used the notation $\Big|d_{m',m}^{(j)}(\beta)\Big|^2\equiv\widetilde{d}_{m',m}^{(j)}(\beta)$.
\par Using \eqref{11} we can write the following relation for $\widetilde{d}_{m',m}^{(j)}(\beta)$
\begin{eqnarray*}
\widetilde{d}_{m',m}^{(j)}(\beta)&=&\widetilde{d}_{m,m'}^{(j)}(\beta)=\widetilde{d}_{-m,-m'}^{(j)}(\beta).
\end{eqnarray*}
Therefore, it is also straightforward to verify the following equations for the matrix elements
\begin{eqnarray}\label{12}\widetilde{d}_{3/2,3/2}^{(j)}(\beta)&=&\widetilde{d}_{-3/2,-3/2}^{(j)}(\beta),\quad
\widetilde{d}_{-3/2,3/2}^{(j)}(\beta)=\widetilde{d}_{3/2,-3/2}^{(j)}(\beta),\\\nonumber
\widetilde{d}_{1/2,1/2}^{(j)}(\beta)&=&\widetilde{d}_{-1/2,-1/2}^{(j)}(\beta),\quad
\widetilde{d}_{-1/2,1/2}^{(j)}(\beta)=\widetilde{d}_{1/2,-1/2}^{(j)}(\beta),\\\nonumber
\widetilde{d}_{3/2,1/2}^{(j)}(\beta)&=&\widetilde{d}_{1/2,3/2}^{(j)}(\beta)=
\widetilde{d}_{-3/2,-1/2}^{(j)}(\beta)=\widetilde{d}_{-1/2,-3/2}^{(j)}(\beta),\\\nonumber
\widetilde{d}_{3/2,-1/2}^{(j)}(\beta)&=&\widetilde{d}_{-1/2,3/2}^{(j)}(\beta)=
\widetilde{d}_{3/2,-1/2}^{(j)}(\beta)=\widetilde{d}_{1/2,-3/2}^{(j)}(\beta).
\end{eqnarray}
Hence  probabilities associated with them are also equal.
\par The probability vector $\overrightarrow{p}$ can be chosen as in \eqref{2}. For example, for the fixed $m=3/2$ and considering all elements with different $m'$, i.e. the elements of the first column in the Table \ref{tab:1} we obtain
\begin{eqnarray}\label{4}p_1(\beta)&=&\widetilde{d}_{3/2,3/2}^{(j)}(\beta)=\cos\left(\beta/2\right)^6P_{0}^{(0,3)}(\cos\beta)^2
=\frac{(\cos\beta+1)^3}{8},\\\nonumber
 p_2(\beta)&=&\widetilde{d}_{1/2,3/2}^{(j)}(\beta)=\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 P_{1}^{(-1,2)}(\cos\beta)^2
= 3\sin\left(\beta/2\right)^2\left(\sin\left(\beta/2\right)^2-1\right)^2,\\\nonumber
p_3(\beta)&=&\widetilde{d}_{-1/2,3/2}^{(j)}(\beta)=\frac{\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}P_{2}^{(-2,1)}(\cos\beta)^2
=\frac{3}{8}\left(\cos\beta-1\right)^2(\cos\beta+1),\\\nonumber
 p_4(\beta)&=&\widetilde{d}_{-3/2,3/2}^{(j)}(\beta)=\frac{1}{\sin\left(\beta/2\right)^6}P_{3}^{(-3,0)}(\cos\beta)^2
= -\frac{(\cos\beta-1)^3}{8}.
\end{eqnarray}
The sum of latter probabilities is equal to $\sum\limits_{k}p_{k}(\beta)=1$ for any angle $\beta$.
\par For example, for the angle $\beta=1$ the probabilities are the following
\begin{eqnarray*}&&p_1(1)=0.4568019,\quad p_2(1)=0.40899267,\quad
p_3(1)=0.1220624,\quad p_4(1)=0.012143
\end{eqnarray*}
and their sum is equal to $1$.
\par It is possible to fix $m'$ and consider all matrix elements of the $m'$th row of the Table \ref{tab:1}. Note that it is possible to construct vector   $\overrightarrow{p}$ by a variety of other combinations of elements in the Table \ref{tab:1} . This conclusion is a direct consequence of the equality \eqref{12}. It is only necessary to remember that the sum of the elements of such a vector must always be equal to one.
\par This gives us the opportunity to form a large number of inequalities based on inequality  \eqref{7} for the Shannon information.
\par Let us introduce the following notation $\left(P_{j-m'}^{(m'-m,m'+m)}(\cos\beta)\right)^2\equiv \widetilde{P}_{j-m'}^{(m'-m,m'+m)}$. Substituting \eqref{4} in \eqref{6} and \eqref{7} we can write the following inequality
\begin{eqnarray}\label{17}&&-\left(\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}+\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)
\ln\left(\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}+\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)\\\nonumber
&-&\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}+\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}\right)
\ln\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}+\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}\right)\\\nonumber
&-&\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}+\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)
\ln\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}+\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)\\\nonumber
&-&\left(\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}+\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}\right)
\ln\left(\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}+\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}\right)\\\nonumber
&+&\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}
\ln\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}\right)
+\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}
\ln\left(\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}\right)\\\nonumber
&+&\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}
\ln\left(\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)
+\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}
\ln\left(\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}\right)
\geq0
\end{eqnarray}
Entropies $H_{\Pi}(\beta)$, $H_{\pi}(\beta)$, $H_{p}(\beta)$ and the Shannon information $I(\beta)$ for probabilities \eqref{4} are shown in Figures \ref{fig:1} and \ref{fig:2}. Obviously the information reaches its maximum value at the point $\beta=\pi/2$.
\begin{figure}[ht]
\begin{center}
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{entropy1.eps}
\vspace{-4mm}
\caption{Entropies $H_{\Pi}(\beta)$, $H_{\pi}(\beta)$, $H_{p}(\beta)$ for probabilities \eqref{4}}
\label{fig:1}
\end{minipage}
\hfill
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{information.eps}
\vspace{-4mm}
\caption{Information $I(\beta)$ for probabilities \eqref{4}}
\label{fig:2}
\end{minipage}
\end{center}
\end{figure}
\par Let us consider how the permutation of the probabilities \eqref{4} affects on the entropies $H_{\pi}$ and $H_{\Pi}$ \eqref{7}.
The new vector $\widetilde{p}=(\widetilde{p}_1,\widetilde{p}_2,\widetilde{p}_3,\widetilde{p}_4)$ can be determined by
\begin{eqnarray}\label{13}
\widetilde{p}_1\equiv p_{4},\quad \widetilde{p}_2\equiv p_{1},\quad \widetilde{p}_3 \equiv p_{2},\quad\widetilde{ p}_4 \equiv p_{3}.
\end{eqnarray}
Entropies $H_{\Pi}(\beta)$, $H_{\pi}(\beta)$, $H_{p}(\beta)$ and information $I(\beta)$ for the probability vector $\widetilde{p}$ are shown on
Figures \ref{fig:3} and \ref{fig:4}.
\begin{figure}[ht]
\begin{center}
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{entropy2.eps}
\vspace{-4mm}
\caption{Entropies $H_{\Pi}(\beta)$, $H_{\pi}(\beta)$, $H_{p}(\beta)$ for probabilities \eqref{13}}
\label{fig:3}
\end{minipage}
\hfill
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{information2.eps}
\vspace{-4mm}
\caption{Information $I(\beta)$ for probabilities \eqref{13}}
\label{fig:4}
\end{minipage}
\end{center}
\end{figure}
Evidently the latter permutations impact only the entropy $H_{\pi}$. The information turns to zero at the point $\beta=\pi/2$.
Substituting \eqref{13} in \eqref{6} and \eqref{7} we can write the following inequality
\begin{eqnarray*}&&-\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}+\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}\right)
\ln\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}+\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}\right)\\
&-&\left(\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}+\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)
\ln\left(\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}+\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)\\
&-&\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}+\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)
\ln\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}+\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)\\
&-&\left(\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}+\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}\right)
\ln\left(\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}+\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}\right)\\
&+&\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}
\ln\left(\cos\left(\beta/2\right)^6\widetilde{P}_{0}^{(0,3)}\right)
+\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}
\ln\left(\frac{\cos\left(\beta/2\right)^4}{3\sin\left(\beta/2\right)^2}
 \widetilde{P}_{1}^{(-1,2)}\right)\\
&+&\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}
\ln\left(\frac{\widetilde{P}_{2}^{(-2,1)}\cos\left(\beta/2\right)^2}{3\sin\left(\beta/2\right)^4}\right)
+\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}
\ln\left(\frac{\widetilde{P}_{3}^{(-3,0)}}{\sin\left(\beta/2\right)^6}\right)
\geq0.
\end{eqnarray*}
Let us select the probability vector $\overrightarrow{p}$ using another combination of $\widetilde{d}_{m',m}^{(j)}(\beta)$. For the fixed  $m=1/2$ we take the elements of the second column in Table \ref{tab:1}. Then the probability vector has the following components
\begin{eqnarray}\label{20}p_1(\beta)&=&\widetilde{d}_{3/2,1/2}^{(j)}(\beta)
=3\cos\left(\beta/2\right)^4\sin\left(\beta/2\right)^2P_{0}^{(1,2)}(\cos\beta)^2
=3\cos\left(\frac{\beta}{2}\right)^4\sin\left(\frac{\beta}{2}\right)^2,\\\nonumber
 p_2(\beta)&=&\widetilde{d}_{1/2,1/2}^{(j)}(\beta)=\frac{(\cos\beta+1)}{2}P_{1}^{(0,1)}(\cos\beta)^2
= \frac{(3\cos\beta-1)^2}{8}(\cos\beta+1),\\\nonumber
p_3(\beta)&=&\widetilde{d}_{-1/2,1/2}^{(j)}(\beta)=\frac{P_{2}^{(-1,0)}(\cos\beta)^2}{\sin\left(\beta/2\right)^2}
= -\frac{(3\cos\beta+1)^2}{8}(\cos\beta-1),\\\nonumber
 p_4(\beta)&=&\widetilde{d}_{-3/2,1/2}^{(j)}(\beta)
 =\frac{3P_{3}^{(-2,-1)}(\cos\beta)^2}{\cos(\beta/2)^2(\cos(\beta/2)^2-1)^2}
=  \frac{3(\cos\beta-1)^2}{8}(\cos\beta+1).
\end{eqnarray}
Substituting \eqref{20} in \eqref{7} we can write the following inequality
\begin{eqnarray*}&&-\left(\frac{\widetilde{P}_{2}^{(-1,0)}}{\sin\left(\beta/2\right)^2}+\frac{3\widetilde{P}_{3}^{(-2,-1)}}{\cos(\beta/2)^2(\cos(\beta/2)^2-1)^2}\right)
\ln\left(\frac{\widetilde{P}_{2}^{(-1,0)}(\cos\beta)^2}{\sin\left(\beta/2\right)^2}+\frac{3\widetilde{P}_{3}^{(-2,-1)}}{\cos(\beta/2)^2(\cos(\beta/2)^2-1)^2}\right)\\
&-&\!\!\!\!\left(\frac{(\cos\beta+1)}{2}\widetilde{P}_{1}^{(0,1)}\!+\!3\cos\left(\frac{\beta}{2}\right)^4\sin\left(\frac{\beta}{2}\right)^2\widetilde{P}_{0}^{(1,2)}\right)
 \!\ln\left(\frac{(\cos\beta+1)}{2}\widetilde{P}_{1}^{(0,1)}\!+\!3\cos\left(\frac{\beta}{2}\right)^4\sin\left(\frac{\beta}{2}\right)^2\widetilde{P}_{0}^{(1,2)}\right)\\
&-&\!\!\!\!\left(\frac{(\cos\beta+1)}{2}\widetilde{P}_{1}^{(0,1)}+\frac{3\widetilde{P}_{3}^{(-2,-1)}}{\cos(\beta/2)^2(\cos(\beta/2)^2-1)^2}\right)
\!\ln\left(\frac{(\cos\beta+1)}{2}\widetilde{P}_{1}^{(0,1)}+\frac{3\widetilde{P}_{3}^{(-2,-1)}}{\cos(\beta/2)^2(\cos(\beta/2)^2-1)^2}\right)\\
&-&\!\left(\frac{\widetilde{P}_{2}^{(-1,0)}}{\sin\left(\beta/2\right)^2}+3\cos\left(\beta/2\right)^4\sin\left(\beta/2\right)^2\widetilde{P}_{0}^{(1,2)}\right)
\ln\left(\frac{\widetilde{P}_{2}^{(-1,0)}}{\sin\left(\beta/2\right)^2}+3\cos\left(\beta/2\right)^4\sin\left(\beta/2\right)^2\widetilde{P}_{0}^{(1,2)}\right)\\
&+&\!\left(3\cos\left(\beta/2\right)^4\sin\left(\beta/2\right)^2\widetilde{P}_{0}^{(1,2)}\right)\ln\left(3\cos\left(\beta/2\right)^4\sin\left(\beta/2\right)^2\widetilde{P}_{0}^{(1,2)}(\cos\beta)^2\right)\\
&+&\!\left(\frac{\widetilde{P}_{2}^{(-1,0)}(\cos\beta)^2}{\sin\left(\beta/2\right)^2}\right)\ln\left(\frac{\widetilde{P}_{2}^{(-1,0)}(\cos\beta)^2}{\sin\left(\beta/2\right)^2}\right)
+\left(\frac{(\cos\beta+1)}{2}\widetilde{P}_{1}^{(0,1)}\right)\ln\left(\frac{(\cos\beta+1)}{2}\widetilde{P}_{1}^{(0,1)}(\cos\beta)^2\right)\\
&+&\!\left(\frac{3\widetilde{P}_{3}^{(-2,-1)}}{\cos(\beta/2)^2(\cos(\beta/2)^2-1)^2}\right)\ln\left(\frac{3\widetilde{P}_{3}^{(-2,-1)}}{\cos(\beta/2)^2(\cos(\beta/2)^2-1)^2}\right)\geq0.
\end{eqnarray*}
Entropies $H_{\Pi}(\beta)$, $H_{\pi}(\beta)$, $H_{p}(\beta)$ and information $I(\beta)$ for probability vector \eqref{20} are shown on
Figures \ref{fig:5} and \ref{fig:6}. Evidently, they differ from the entropies and information constructed by the polynomials based on the first column of Table \ref{tab:1}.
\begin{figure}[ht]
\begin{center}
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{entropy3.eps}
\vspace{-4mm}
\caption{Entropies $H_{\Pi}(\beta)$, $H_{\pi}(\beta)$, $H_{p}(\beta)$ for probabilities \eqref{20}}
\label{fig:5}
\end{minipage}
\hfill
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{information3.eps}
\vspace{-4mm}
\caption{Information  $I(\beta)$ for probabilities \eqref{20}}
\label{fig:6}
\end{minipage}
\end{center}
\end{figure}
\par It is also interesting to see how the permutation of the components of probability vector $\overrightarrow{p}$
will change the information. To this end we do the same procedure as in \eqref{13}.
\par The new vector $\widehat{p}=(\widehat{p}_1,\widehat{p}_2,\widehat{p}_3,\widehat{p}_4)$ can be formed by
\begin{eqnarray}\label{21}
\widehat{p}_1\equiv p_{4},\quad \widehat{p}_2\equiv p_{1},\quad \widehat{p}_3 \equiv p_{2},\quad\widehat{p}_4 \equiv p_{3}.
\end{eqnarray}
 Thus, substituting \eqref{21} in \eqref{6} and \eqref{7} new entropies and information can be obtained. The latter are shown in Figures  \ref{fig:7} and \ref{fig:8}. In contrast to Figure \ref{fig:6}, the information for permuted vector $\widehat{p}$ equals to zero at point $\beta=\pi/2$.
\begin{figure}[ht]
\begin{center}
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{entropy4.eps}
\vspace{-4mm}
\caption{Entropies $H_{\Pi}(\beta)$, $H_{\pi}(\beta)$, $H_{p}(\beta)$ for probabilities \eqref{21}}
\label{fig:7}
\end{minipage}
\hfill
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{information4.eps}
\vspace{-4mm}
\caption{Information  $I(\beta)$ for probabilities \eqref{21}}
\label{fig:8}
\end{minipage}
\end{center}
\end{figure}
\par Finally we summarize all results of Figures \ref{fig:2}, \ref{fig:4}, \ref{fig:6}, \ref{fig:8} in Figure \ref{fig:9}. Obviously, for systems \eqref{4} and \eqref{20} the information is non zero for $\beta=\pi/2$ and for permutated vectors the information is zero.
\begin{figure}[ht]
\begin{center}
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{final_information.eps}
\vspace{-4mm}
\caption{Information of four probability vectors}
\label{fig:9}
\end{minipage}
\end{center}
\end{figure}
\par From \eqref{12} it is easy to verify that the latter two examples cover all possible probabilities.
Other combinations chosen from Table \ref{tab:1} determine their permutations. However, Jacobi polynomials corresponding to them are of course not the same. It allows us to obtain many different inequalities of the form \eqref{17}.
\section{Case of the $N$-component probability  vector}
\pst
In this section, we shall extend the latter theory on the case when the probability vector has $N$ components, i.e.  $\overrightarrow{p}=(p_1,p_2,\ldots,p_N)$. If $N$ is an even number than we can introduce the map of indices similar to \eqref{14}, namely it holds
\begin{eqnarray*}
1&\Leftrightarrow& 11,\quad 2\Leftrightarrow 12,\quad 3 \Leftrightarrow 13,\quad\ldots,\quad\frac{N}{2} \Leftrightarrow 1\frac{N}{2},\\
\frac{N}{2}+1&\Leftrightarrow& 21,\quad \frac{N}{2}+2\Leftrightarrow 22,\quad \frac{N}{2}+3 \Leftrightarrow 23,\quad\ldots,\quad N \Leftrightarrow 2\frac{N}{2}.
\end{eqnarray*}
Hence the probabilities are given in the form of the matrix $(p_{il})$, $i=1,2$, $l=1,2,\ldots,\frac{N}{2}$ with components
\begin{eqnarray}\label{23}
p_1&\Leftrightarrow& p_{11},\quad p_2\Leftrightarrow p_{12},\quad p_3 \Leftrightarrow p_{13},\quad\ldots,\quad p_{\frac{N}{2}} \Leftrightarrow p_{1\frac{N}{2}},\\\nonumber
p_{\frac{N}{2}+1}&\Leftrightarrow& p_{21},\quad p_{\frac{N}{2}+2}\Leftrightarrow p_{22},\quad p_{\frac{N}{2}+3} \Leftrightarrow p_{23},\quad\ldots,\quad p_{N} \Leftrightarrow p_{2\frac{N}{2}}.
\end{eqnarray}
If $N$ is an odd number than we assign a zero vector $p_{N+1}=0$ to the $N$-component vector $\overrightarrow{p}$. Then we get $(N+1)$-component vector $\overrightarrow{p}=(p_1,p_2,\ldots,p_N,p_{N+1})$.
Thus the insertable map of the indices is
\begin{eqnarray*}
1&\Leftrightarrow& 11,\quad 2\Leftrightarrow 12,\quad 3 \Leftrightarrow 13,\quad\ldots,\quad\frac{N+1}{2} \Leftrightarrow 1\frac{N+1}{2},\\
\frac{N+1}{2}+1&\Leftrightarrow& 21,\quad \frac{N+1}{2}+2\Leftrightarrow 22,\quad \frac{N+1}{2}+3 \Leftrightarrow 23,\quad\ldots,\quad N+1 \Leftrightarrow 2\frac{N+1}{2}.
\end{eqnarray*}
and probabilities are given in the form of the matrix $(p_{il})$, $i=1,2$, $l=1,2,\ldots,\frac{N+1}{2}$ with components
\begin{eqnarray}\label{24}
p_1&\Leftrightarrow& p_{11},\quad p_2\Leftrightarrow p_{12},\quad p_3 \Leftrightarrow p_{13},\quad\ldots,\quad p_{\frac{N+1}{2}} \Leftrightarrow p_{1\frac{N+1}{2}},\\\nonumber
p_{\frac{N+1}{2}+1}&\Leftrightarrow& p_{21},\quad p_{\frac{N+1}{2}+2}\Leftrightarrow p_{22},\quad p_{\frac{N+1}{2}+3} \Leftrightarrow p_{23},\quad\ldots,\quad p_{N+1} \Leftrightarrow p_{2\frac{N+1}{2}}.
\end{eqnarray}
Similarly  to \eqref{15} we can write marginal probability distributions determined by the joint probability distribution. For
an odd $N$ these are the following
\begin{eqnarray}\label{16}\pi_i&=&\sum\limits_{l=1}^{\frac{N+1}{2}}p_{il}=p_{i1}+p_{i2}+p_{i3}+\cdots+p_{i\frac{N+1}{2}},\quad i=1,2\\ \nonumber
\Pi_l&=&\sum\limits_{i=1}^2p_{il}=p_{1l}+p_{2l},\quad l=1,2,\ldots,\frac{N+1}{2}.
\end{eqnarray}
For \eqref{16} it is possible to obtain inequalities similar to \eqref{17}. To this end, we define Shannon entropies by
 \begin{eqnarray}\label{18}H_{p}&=&-\sum\limits_{t=1}^{N+1}p_t\ln p_t,\\\nonumber
H_{\pi_{1}}&=&-\sum\limits_{t=1}^{\frac{N+1}{2}}p_t\ln\left(\sum\limits_{t=1}^{\frac{N+1}{2}}p_t\right),\quad
H_{\pi_{2}}=-\sum\limits_{t=\frac{N+1}{2}+1}^{N+1}p_t\ln\left(\sum\limits_{t=\frac{N+1}{2}+1}^{N+1}p_t\right),\\\nonumber
H_{\Pi_{l}}&=&-\left(p_l+p_{\frac{N+1}{2}+l}\right)\ln\left(p_l+p_{\frac{N+1}{2}+l}\right),\quad l=1,2,\ldots,\frac{N+1}{2}.
\end{eqnarray}
Then the Shannon information that is similar to \eqref{7} is based on the entropies \eqref{18}
\begin{eqnarray}\label{19}I(\beta)_{tl}&=&H_{\pi_{t}}(\beta)+H_{\Pi_{l}}(\beta)-H_{p}(\beta), \quad t=1,2\quad l=1,2,\ldots,\frac{N+1}{2} .
\end{eqnarray}
Obviously the inequality $I(\beta)\geq 0$ for all the angles $\beta$ is valid.
\par The spin projections  $m$ and $m'$ can take $2j+1=N$ values for the spin $j$. If $j$ is a fractional number ($N$ is even), than projections can be $-j,-j+1,\ldots,j-1,j$. Then the components of the probability  $\overrightarrow{p}$  are given by \eqref{23}.
On the other hand, if $j$ is an integer number ($N$ is odd), than spin projections can be $-j,-j+1,\ldots,0,\ldots,j-1,j$. Then the components of the probability  vector are given by \eqref{24}.
\par One can take the polynomials $\Big|d_{m',m}^{(j)}(\beta)\Big|^2$ as the probabilities for a fixed $m'$ and for all $m$.
One of the possible choices for an odd $N$ is the following
\begin{eqnarray}\label{27}p_1&=&\Big|d_{m',j}^{(j)}(\beta)\Big|^2, p_2=\Big|d_{m',j-1}^{(j)}(\beta)\Big|^2,\ldots, p_{\frac{N+1}{2}}=\Big|d_{m',0}^{(j)}(\beta)\Big|^2,
\ldots, p_{N}=\Big|d_{m',-j}^{(j)}(\beta)\Big|^2, p_{N+1}=0.
\end{eqnarray}
In this notations inequality \eqref{19} for $t=1$ and $l=\frac{N+1}{2}$ is given by
\begin{eqnarray}\label{25}-\sum\limits_{m=0}^{j}\widetilde{d}_{m',m}^{(j)}(\beta)\ln\left(\sum\limits_{m=0}^{j}\widetilde{d}_{m',m}^{(j)}(\beta)\right)
-\widetilde{d}_{m',0}^{(j)}(\beta)\ln\left(\widetilde{d}_{m',0}^{(j)}(\beta)\right)+\sum\limits_{m=-j}^{j}\widetilde{d}_{m',m}^{(j)}(\beta)
\ln\left(\sum\limits_{m=-j}^{j}\widetilde{d}_{m',m}^{(j)}(\beta)\right)\geq0
\end{eqnarray}
or for $t=2$ and $l=1$ it looks like
\begin{eqnarray}\label{26}&-&\sum\limits_{m=-j}^{-1}\widetilde{d}_{m',m}^{(j)}(\beta)\ln\left(\sum\limits_{m=-j}^{-1}\widetilde{d}_{m',m}^{(j)}(\beta)\right)
-\left(\widetilde{d}_{m',j}^{(j)}(\beta)+\widetilde{d}_{m',-1}^{(j)}(\beta)\right)\ln\left(\widetilde{d}_{m',j}^{(j)}(\beta)+\widetilde{d}_{m',-1}^{(j)}(\beta)\right)\\\nonumber
&+&\sum\limits_{m=-j}^{j}\widetilde{d}_{m',m}^{(j)}(\beta)
\ln\left(\sum\limits_{m=-j}^{j}\widetilde{d}_{m',m}^{(j)}(\beta)\right)\geq0.
\end{eqnarray}
Our aim is to represent \eqref{25} and \eqref{26} by Jacobi polynomials. To this end, we introduce the new notation in \eqref{1}
\begin{eqnarray*}
\widetilde{d}_{m',m}^{(j)}(\beta)&=&\Big|d_{m',m}^{(j)}(\beta)\Big|^2=G_{m',m}^{j}(\beta)\cdot \widetilde{P}_{j-m'}^{(m'-m,m'+m)},
\end{eqnarray*}
where
\begin{eqnarray*}
G_{m',m}^{j}(\beta)&=&\frac{(j+m')!(j-m')!}{(j+m)!(j-m)!}\left(\cos\left(\frac{\beta}{2}\right)^{m'+m}\sin\left(\frac{\beta}{2}\right)^{m'-m}\right)^2.
\end{eqnarray*}
Hence inequalities \eqref{25} and \eqref{26} can be rewritten in the new terms as
\begin{eqnarray*}&-&\sum\limits_{m=0}^{j}G_{m',m}^{j}(\beta)\widetilde{P}_{j-m'}^{(m'-m,m'+m)}\ln\left(\sum\limits_{m=0}^{j}G_{m',m}^{j}(\beta) \widetilde{P}_{j-m'}^{(m'-m,m'+m)}\right)\\
&-&G_{m',0}^{j}(\beta)\widetilde{P}_{j-m'}^{(m',m')}\ln\left(G_{m',0}^{j}(\beta)\widetilde{P}_{j-m'}^{(m',m')}\right)\\
&+&\sum\limits_{m=-j}^{j}G_{m',m}^{j}(\beta)\widetilde{P}_{j-m'}^{(m'-m,m'+m)}
\ln\left(\sum\limits_{m=-j}^{j}G_{m',m}^{j}(\beta)\widetilde{P}_{j-m'}^{(m'-m,m'+m)}\right)\geq0,
\end{eqnarray*}
\begin{eqnarray*}&-&\sum\limits_{m=-j}^{-1}G_{m',m}^{j}(\beta)\widetilde{P}_{j-m'}^{(m'-m,m'+m)}\ln\left(\sum\limits_{m=-j}^{-1}G_{m',m}^{j}(\beta) \widetilde{P}_{j-m'}^{(m'-m,m'+m)}\right)\\
&-&\left(G_{m',j}^{j}(\beta)\widetilde{P}_{j-m'}^{(m'-j,m'+j)}+G_{m',-1}^{j}(\beta)\cdot \widetilde{P}_{j-m'}^{(m'+1,m'-1)}\right)\cdot\\
&\cdot&\ln\left(G_{m',j}^{j}(\beta\widetilde{P}_{j-m'}^{(m'-j,m'+j)}+G_{m',-1}^{j}(\beta) \widetilde{P}_{j-m'}^{(m'+1,m'-1)}\right)\\\nonumber
&+&\sum\limits_{m=-j}^{j}G_{m',m}^{j}(\beta)\widetilde{P}_{j-m'}^{(m'-m,m'+m)}
\ln\left(\sum\limits_{m=-j}^{j}G_{m',m}^{j}(\beta)\widetilde{P}_{j-m'}^{(m'-m,m'+m)}\right)\geq0.
\end{eqnarray*}
Let us consider a special case when $j=c$, where $c$  is an integer number and $m'=0$. Then \eqref{1} can be rewritten as
\begin{eqnarray}\label{22}
\Big|d_{0,m}^{(c)}(\beta)\Big|^2&=&\Big|d_{m,0}^{(c)}(\beta)\Big|^2=\frac{(c-m)!}{(c+m)!}\left(P_{c}^{m}(\cos\beta)\right)^2,
\end{eqnarray}
where $P_{c}^{m}(\cos\beta)$ are the  Legendre polynomials \cite{Landau}.
\par Hence \eqref{25} for this special case is determined by
\begin{eqnarray*}-\!\!\sum\limits_{m=0}^{j}\frac{(c-m)!}{(c+m)!}\widetilde{P}_{c}^{m}\ln\left(\sum\limits_{m=0}^{j}\frac{(c-m)!}{(c+m)!}\widetilde{P}_{c}^{m}\right)
-\widetilde{P}_{c}^{0}\ln\left(\widetilde{P}_{c}^{0}\right)+\sum\limits_{m=-j}^{j}\frac{(c-m)!}{(c+m)!}\widetilde{P}_{c}^{m}
\ln\left(\sum\limits_{m=-j}^{j}\frac{(c-m)!}{(c+m)!}\widetilde{P}_{c}^{m}\right)\geq0
\end{eqnarray*}
\begin{figure}[ht]
\begin{center}
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{information5.eps}
\vspace{-4mm}
\caption{Shannon information \eqref{19} for probabilities \eqref{27}, $t=1$}
\label{fig:10}
\end{minipage}
\hfill
\begin{minipage}[ht]{0.49\linewidth}
\includegraphics[width=1\linewidth]{information6.eps}
\vspace{-4mm}
\caption{Shannon information \eqref{19} for probabilities \eqref{27}, $t=2$}
\label{fig:11}
\end{minipage}
\end{center}
\end{figure}
\\and \eqref{26} is rewritten by
\begin{eqnarray*}&-&\sum\limits_{m=-j}^{-1}\frac{(c-m)!}{(c+m)!}\widetilde{P}_{c}^{m}\ln\left(\sum\limits_{m=-j}^{-1}\frac{(c-m)!}{(c+m)!}\widetilde{P}_{c}^{m}\right)
-\frac{(c+1)!}{(c-1)!}\widetilde{P}_{c}^{-1}\ln\left(\frac{(c+1)!}{(c-1)!}\widetilde{P}_{c}^{-1}\right)\\\nonumber
&+&\sum\limits_{m=-j}^{j}\frac{(c-m)!}{(c+m)!}\widetilde{P}_{c}^{m}
\ln\left(\sum\limits_{m=-j}^{j}\frac{(c-m)!}{(c+m)!}\widetilde{P}_{c}^{m}\right)\geq0.
\end{eqnarray*}
Here we use the notation $\left(P_{c}^{m}(\cos\beta)\right)^2\equiv\widetilde{P}_{c}^{m}$ for Legendre polynomials.

\par Information \eqref{19} is shown in Figures \ref{fig:10} and \ref{fig:11} for entropies \eqref{18} and various parameters $t$, $l$ and spins $j$.
\section{Summary}
\pst
To conclude we point out the main results of the work. Considering the matrix elements of the unitary irreducible
representations of the group $SU(2)$ and applying known subadditivity condition for joint probability distributions constructed from these matrix elements we obtained new inequalities for the Jacobi and Legendre polynomials. The inequalities correspond to entropic inequalities for Shannon entropies
of bipartite classical systems. The results are shown in detail on the example of spin $j=3/2$, where the Shannon  information of the bipartite system is expressed in terms of the polynomials. The general approach to get analogous information and entropic inequalities for the arbitrary spins $j$ is formulated.

\section*{Acknowledgments}
\pst
L. A. M. acknowledges the financial support provided within the Russian Foundation for Basic Research, grant 13-08-00744 A.