Amazon must give up Echo recordings in double murder case, judge rules

I think I'll continue to hold off on smart speakers (and digital assistants in general) until something like Mycroft is a bit more useful. I'd rather the additional resources and overhead of being able to host my own, the various big players (Google, Apple, Samsung, Microsoft, Amazon, and whoever else) are just too damned creepy.

Apple does not do server side processing for that kind of information.
 
Upvote
-4 (3 / -7)

AdamM

Ars Praefectus
5,928
Subscriptor
I think Amazon has the right idea but has confused the law.

As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.

That seems quite likely.

Helping solve a double murder is obviously good but, commercially, I very much doubt they want there to confirm that they’re potentially recording everything that goes on in your home. It’s interesting that they aren’t, or so far as I can see from the linked story don’t seem to be, denying the recordings exists.

Even if Amazon are allowed to keep the recordings under the TOS, hardly anyone thinks about that. Playing a detailed recording of a murder in open court might bring home to customers exactly how much privacy they’ve actually given up.

It’s also a double edged sword for privacy advocates. A murderer doesn’t exactly make a sympathetic defendant and could easily swing in the other direction in the court of public opinion.

Privacy advocates need to find examples where the innocent are hurt by lack of privacy. Clinging on to cases about criminals being prosecuted doesn’t help the cause.
 
Upvote
1 (2 / -1)

Shavano

Ars Legatus Legionis
68,366
Subscriptor
I understand the request with metadata such as phone pairings, but audio recordings I don't understand. Does it mean Amazon Echo devices not only transmit the audio data to server for processing (looking for keywords and contexts) , the server stores the raw audio?

All the big data companies keep everything they can get, forever.

That's really not true. They only keep what they think might be profitable. They either delete or sell the rest and they have no incentive to keep things forever.

What they do keep, though, is enough to be troubling: Name, address, birth date, SSN (probably), credit card numbers, search history, purchase history, travels, contacts, etc.

Troubling because it's enough to credibly impersonate you and purchase stuff in your name and possibly get loans in your name, and possibly to buy stuff for you that you didn't want but would have a hard time denying that you bought and that they might even be able to convince you that you ordered.

Particularly, if you're married and your spouse shares and account with you.
 
Upvote
6 (6 / 0)

Dramethia

Wise, Aged Ars Veteran
131
I think Amazon has the right idea but has confused the law.

As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.

That's not an issue. We already know exactly what Amazon retains. It's not just a matter of taking their word for it, we can setup a proxy and capture packets and see what it's collecting. Numerous forensic groups have done so already. So the old conspiracy that they're secretly recording 24/7 is debunked. Anyone can disprove it easily by looking at their network traffic.

But you're in the ballpark...

Amazon wants to decline the request, because there's no up side to them. If they miss the discovery window, then lawyers start bitching loudly about new compliance standards, which will take amazon tens of minutes and dollars to create, and seemingly limitless amounts of time and money to self-enforce. Compliance is a bitch. The last thing they want is a mandatory retention period on data, which is specifically what criminal investigators want. Amazon is perfectly happy to store a fuzzy-hash of the audio along with key words, then discard the audio clips. They don't want to assume the overhead of storing audio on that scale when the raw audio is of virtually no value to them after processing.

Why sign up for that headache? Their best play is to drag their feet until a court compels them, then provide data which will likely be underwhelming and of no material value to the investigation. Let it be a pain in the ass to get the data, and have the data be worthless... that will disincentivize future requests, while allowing them to seem strong on consumer privacy.
 
Upvote
17 (17 / 0)

jdale

Ars Legatus Legionis
18,261
Subscriptor
I think I'll continue to hold off on smart speakers (and digital assistants in general) until something like Mycroft is a bit more useful. I'd rather the additional resources and overhead of being able to host my own, the various big players (Google, Apple, Samsung, Microsoft, Amazon, and whoever else) are just too damned creepy.

Apple does not do server side processing for that kind of information.

Are you saying none of the speech recognition is performed in the cloud? All locally on the device?

https://www.apple.com/privacy/approach-to-privacy/ says "The longer you use Siri and Dictation, the better they understand you and improve. To help them recognize your pronunciation and provide better responses, certain information such as your name, contacts, music you listen to, and searches is sent to Apple servers"
which doesn't make much sense if speech transcription is local. Admittedly they are making a better effort to respect privacy than their competitors, but I don't believe you are correct in your statement.
 
Upvote
8 (8 / 0)

Shavano

Ars Legatus Legionis
68,366
Subscriptor
I think Amazon has the right idea but has confused the law.

As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.

That seems quite likely.

Helping solve a double murder is obviously good but, commercially, I very much doubt they want there to confirm that they’re potentially recording everything that goes on in your home. It’s interesting that they aren’t, or so far as I can see from the linked story don’t seem to be, denying the recordings exists.

Even if Amazon are allowed to keep the recordings under the TOS, hardly anyone thinks about that. Playing a detailed recording of a murder in open court might bring home to customers exactly how much privacy they’ve actually given up.

It’s also a double edged sword for privacy advocates. A murderer doesn’t exactly make a sympathetic defendant and could easily swing in the other direction in the court of public opinion.

Privacy advocates need to find examples where the innocent are hurt by lack of privacy. Clinging on to cases about criminals being prosecuted doesn’t help the cause.

Nor is it legally relevant. They have a court order which they got without violating anyone's rights. Same as if they asked for permission to search the filing cabinet of the victims.
 
Upvote
5 (5 / 0)

SixDegrees

Ars Legatus Legionis
48,304
Subscriptor
I think Amazon has the right idea but has confused the law.

As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.

That seems quite likely.

Helping solve a double murder is obviously good but, commercially, I very much doubt they want there to confirm that they’re potentially recording everything that goes on in your home. It’s interesting that they aren’t, or so far as I can see from the linked story don’t seem to be, denying the recordings exists.

Even if Amazon are allowed to keep the recordings under the TOS, hardly anyone thinks about that. Playing a detailed recording of a murder in open court might bring home to customers exactly how much privacy they’ve actually given up.

It’s also a double edged sword for privacy advocates. A murderer doesn’t exactly make a sympathetic defendant and could easily swing in the other direction in the court of public opinion.

Privacy advocates need to find examples where the innocent are hurt by lack of privacy. Clinging on to cases about criminals being prosecuted doesn’t help the cause.

Nor is it legally relevant. They have a court order which they got without violating anyone's rights. Same as if they asked for permission to search the filing cabinet of the victims.

I have to agree that this is how things ought to work. This isn't rogue prosecutors battering down Amazon's server doors directly, without any oversight. This is the judicial oversight process at work.

I don't want to shut police off from all evidence. But I do want their actions perused by the courts to ensure that the cops aren't being total dicks, which sadly seems to be their go-to behavior much of the time.
 
Upvote
6 (6 / 0)
Don't know if this has been mentioned already, but my concern is not so much about what audio Alexa sends home. As others have pointed out, the bitrate is not high enough for it to be relaying everything you say.

What concerns me is how much information is it extracting from what it hears when it is supposedly not listening because you haven't said the wake word.

It's a completely closed ecosystem with hardware and software expressly designed for decoding speech and yet we are expected to believe that they don't scan the audio for "interesting" keywords to report home to the advertising department.

There are too many anecdotal reports of people being shown ads on Amazon for products that they've never searched for, but mentioned while talking on the phone within listening range of their Alexa.
 
Upvote
-4 (2 / -6)

SixDegrees

Ars Legatus Legionis
48,304
Subscriptor
Don't know if this has been mentioned already, but my concern is not so much about what audio Alexa sends home. As others have pointed out, the bitrate is not high enough for it to be relaying everything you say.

What concerns me is how much information is it extracting from what it hears when it is supposedly not listening because you haven't said the wake word.

It's a completely closed ecosystem with hardware and software expressly designed for decoding speech and yet we are expected to believe that they don't scan the audio for "interesting" keywords to report home to the advertising department.

There are too many anecdotal reports of people being shown ads on Amazon for products that they've never searched for, but mentioned while talking on the phone within listening range of their Alexa.

Seems unlikely. Amazon's recommendations, in fact, always strike me as extremely crude; they consist of recommending what I just bought, or the items that already showed up in their "Customers also bought..." list. There doesn't seem to be any deeper analysis - or reconnaissance - going on than that.
 
Upvote
2 (3 / -1)

gballard

Wise, Aged Ars Veteran
179
Subscriptor++
It also sounds to me that Amazon has been storing the audio and data unknown to the customers, so isn't that a violation of the customers privacy rights?

Not under the Echo TOS. If you bought it, plugged it in and clicked through the license, the only "rights" you have are those that Amazon grants to you (at least in the US).
 
Upvote
0 (2 / -2)

LexaGrey

Wise, Aged Ars Veteran
118
Subscriptor++
Most judges should be familiar that ethical companies do no hand out customer data on request. There is just too much social engineering to trust a verbal demand of the court.

A subpoena or search warrant should be a standard any time a judge requests information not physically present at the crime scene to create an appropriate paper trail of data scope and custody. Something which should be digitally signed and easily verified and can be kept on file as proof of delivery.
 
Upvote
4 (4 / 0)

ARS_dabbler

Ars Scholae Palatinae
613
Subscriptor++
I am going to speculate here that Amazon does not record audio unless the wake word is uttered. I am basing this speculation on simple economics.
1) The internet traffic that would be generated by all the Echo devices sending audio simultaneously would be overwhelming even for Amazon.
2) What would Amazon gain from the information. It would be far more than even their AI could possibly handle. Where is the value in processing the information?
3) The blow back that would occur from the revelation that Amazon was recording indiscriminately would destroy the Echo business line. No risk officer (think lawyer) would allow the company to do that.

So while a prosecutor can demand such information, I doubt they will get much from the demand. But as always it hard to prove a negative. There will always be the conspiracy minded that will think that Amazon simply didn't comply.
 
Upvote
7 (7 / 0)
D

Deleted member 1

Guest
Sounds like the plot of a Columbo episode.
Funny, but a related story was covered several years ago on a Monk episode.

I'm surprised it took this long to surface.

There is a microphone button you can press to deactivate the Alexa microphone. It does indicate with a little red light that the mic is off.
And you believe that?

Did you know your tv is recording you? They can have an LTE transmitter in it, so they don't need your wifi access. Also, your refrigerator is sending out messages using the cooling metal as an antenna signal boost. They also listen to you shower by recording the vibrations through the water pipes.

And yeah, I believe that Amazon's equipment turns off the mic when the button is pressed. Because they don't benefit by increasing the paranoia if they ever get caught. I did unplug my Alexa device, since the only use for it I found wasn't worth the random times it would try to respond to the videos I was watching. But I'm not saying ANYTHING important enough or interesting enough to record that I wouldn't be willing to whisper sweetly in Bezos' sleeping ear. Please have rational paranoia: neither Amazon nor Google get enough out of recording you secretly to justify risking the benefit they get out of what most people give them voluntarily. Which is acres of money. Acres and acres of it.
 
Upvote
6 (6 / 0)
D

Deleted member 1

Guest
Don't know if this has been mentioned already, but my concern is not so much about what audio Alexa sends home. As others have pointed out, the bitrate is not high enough for it to be relaying everything you say.

What concerns me is how much information is it extracting from what it hears when it is supposedly not listening because you haven't said the wake word.

It's a completely closed ecosystem with hardware and software expressly designed for decoding speech and yet we are expected to believe that they don't scan the audio for "interesting" keywords to report home to the advertising department.

There are too many anecdotal reports of people being shown ads on Amazon for products that they've never searched for, but mentioned while talking on the phone within listening range of their Alexa.

Seems unlikely. Amazon's recommendations, in fact, always strike me as extremely crude; they consist of recommending what I just bought, or the items that already showed up in their "Customers also bought..." list. There doesn't seem to be any deeper analysis - or reconnaissance - going on than that.

Their recommendations are inconsistently downright awful. They recommended two add-on items recently, neither of which were actually useful for the product in question. As in, they were actively unneeded and entirely useless.
 
Upvote
0 (1 / -1)

zstansfi

Seniorius Lurkius
42
I think Amazon has the right idea but has confused the law.

As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.

I am not exactly a huge fan of Amazon's ethics, but from the statements made above they haven't indicated that privacy rights were an issue in this case. The statement that referred to privacy rights was discussed regarding a separate previous case with which Amazon apparently complied.

For the current case they simply indicated that they want an appropriate legal request before giving up any data that they are in possession of - which is perfectly in line with the legal and ethical obligations of any business.

As for tech companies surreptitiously recording audio with our personal devices - the cat's pretty much out of the bag at this point - there's nothing stopping them other than the risk of public backlash. The only question is how long it will take regulators to step in and step some restrictions on this practice. I sure hope that day is coming soon.
 
Upvote
0 (1 / -1)
Most judges should be familiar that ethical companies do no hand out customer data on request. There is just too much social engineering to trust a verbal demand of the court.

A subpoena or search warrant should be a standard any time a judge requests information not physically present at the crime scene to create an appropriate paper trail of data scope and custody. Something which should be digitally signed and easily verified and can be kept on file as proof of delivery.

They argued against fulfilling a warrant from a judge, it's risible to frame this as due diligence against random social engineering attack.

This wasn't trying to validate the request, but attempting to quash an issued warrant- on the basis of concern for the 1A rights of a 3rd party. There is already legal procedure for removing irrelevant parts of evidence, which could otherwise prejudice a jury. Including such 1A speech would risk a mistrial and charges of prosecutorial misconduct. I would be amazed if any functional democracy didn't have similar provision.

Amazon attempt to frame themselves as the ultimate "trusted party" by inferring that legal system's checks and balances on admissible evidence don't exist or don't work.

You know what Amazon, I don't trust you either; stating that minimal data is collected, whilst trying to emphasis the risk of releasing it.
 
Upvote
-1 (1 / -2)
Although privacy is certainly a concern, it seems to me that products like Alexa would actually be improved if, say, when they heard a gunshot or a scream, they then sent the last 60 minutes or so of internally recorded audio up to the cloud for possible retrieval by law enforcement.

After all, murder victims won't always have the opportunity to activate an emergency record mode.

Of course, in any house with children, or near where exhausts backfire, there would be false positives - but no one would ever hear them, because there wouldn't be any warrants issued in those cases.
 
Upvote
-7 (0 / -7)
For this technology to work as the product description states it has to be always listening & recording.

Always listening for the keyword to activate it.
Always recording to learn & distinguish different voices, tones, etc. For Alexa to learn ... it must refer back to sounds and learn, to refer back it clearly has to record &store all the time.

To think otherwise is folly.
 
Upvote
-6 (3 / -9)
There ms not really a way to distinguish a real gunshot or scream sound in an Alexa “home” from a movie or a show laying. This suggestion sounds really nice but it is ridiculous. The police depts are already under staffed and this would send them out chasing ghosts rather than helping in real crimes.

Do people think anymore?
 
Upvote
-6 (0 / -6)
They argued against fulfilling a warrant from a judge, it's risible to frame this as due diligence against random social engineering attack.

Yes, they already recieved a search warrant. So what more should be needed?

It could be that their legal department had grounds for believing the search warrant was not valid. But it's certainly reasonable to suspect that Amazon is spending money on lawyers here as a PR stunt to paint themselves as concerned about customer privacy.

However, there may be a rational explanation for this. There is a segment of Amazon's customer base that is likely to believe that police routinely perjure themselves when going before judges to get search warrants.

What segment might that be? Fans of conspiracy theorists? No, I'm thinking of members of another group. Here's a clue: fill in the missing word to complete the following sentence - "Unarmed ____ man shot by police officer".

So, yes, you can say that Amazon is making a statement that the system is not working. Perhaps such a statement may seem unpatriotic, but it doesn't consequently also seem false, at least to many.
 
Upvote
-3 (0 / -3)
There ms not really a way to distinguish a real gunshot or scream sound in an Alexa “home” from a movie or a show laying. This suggestion sounds really nice but it is ridiculous. The police depts are already under staffed and this would send them out chasing ghosts rather than helping in real crimes.

I wasn't suggesting that Alexa units upload the data to the local police department, only to Amazon cloud servers. Where it would stay, quietly, unless it happened that a real crime was committed at that place and time, and Amazon recieved a warrant about it.

So the police wouldn't have their time wasted. Of course, Amazon might need more cloud storage, so there could still be a problem at that end.
 
Upvote
0 (1 / -1)
D

Deleted member 1

Guest
There ms not really a way to distinguish a real gunshot or scream sound in an Alexa “home” from a movie or a show laying. This suggestion sounds really nice but it is ridiculous. The police depts are already under staffed and this would send them out chasing ghosts rather than helping in real crimes.

I wasn't suggesting that Alexa units upload the data to the local police department, only to Amazon cloud servers. Where it would stay, quietly, unless it happened that a real crime was committed at that place and time, and Amazon recieved a warrant about it.

So the police wouldn't have their time wasted. Of course, Amazon might need more cloud storage, so there could still be a problem at that end.

Alexa devices aren't built for that purpose. If someone wants that, they can get a security camera system, with or without cloud storage.
 
Upvote
6 (6 / 0)

jdale

Ars Legatus Legionis
18,261
Subscriptor
Although privacy is certainly a concern, it seems to me that products like Alexa would actually be improved if, say, when they heard a gunshot or a scream, they then sent the last 60 minutes or so of internally recorded audio up to the cloud for possible retrieval by law enforcement.

After all, murder victims won't always have the opportunity to activate an emergency record mode.

Of course, in any house with children, or near where exhausts backfire, there would be false positives - but no one would ever hear them, because there wouldn't be any warrants issued in those cases.

To do that, you'd have to be recording all the time, so that if the feature was triggered, you would have a recording of the last 60 minutes available to be uploaded. Once you have the data, it's subject to misuse.
 
Upvote
1 (1 / 0)

jb226

Ars Scholae Palatinae
601
I guess we are going to find out. We desperately need clear privacy protections even in our own homes.

If I'm the one fucking murdered in front of my device, I suspect my ghost will be just fine with police searching that days' audio.

Let's no lose sight of the fact that the "consumer" here is the murder victim, not the murderer.
 
Upvote
0 (0 / 0)

MeTo

Seniorius Lurkius
13
I think they've gone about this the right way. Law enforcement should have access to this data if there is a chance it will help determine who is guilty or innocent of the crime. But like all private data they should get a warrant first. Seems like that is happening.

A lot of people (not on this site I'm sure) don't realize the amount of data these companies have on us. I just went to My Activity under my Google account and can see that at 1106 yesterday I set up an alarm for 1215, visited Facebook at 1502, looked for Tottenham jerseys on Fanatics, etc. We really don't have much privacy anymore.
 
Upvote
-1 (0 / -1)

haar

Ars Tribunus Militum
2,634
I think Amazon has the right idea but has confused the law.

As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.


The Alexa TOS makes it pretty clear they store a lot of your audio. It's less clear who owns that audio but I suspect it isn't the person doing the speaking.



the amazon echo is a “person” and your permission was for “off the record” AND “Not for retribution” so any recording is hearsay... IMO
 
Upvote
-5 (0 / -5)
I think Amazon has the right idea but has confused the law.

As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.

My router records how much data each connected device downloads and uploads. My Echo uploads around 2 MB per day, and I probably give it around 10 requests per day. Pretty sure it’s just uploading what it hears after the wake word. It would be very hard to compress 24 hours worth of audio into 2 MB. Even if it threw out all of the audio where no one was talking, and just had to upload 1 hour’s worth of talking, a 1 hour audio file compressed to 2 MB would have to have a bitrate no higher than 4.5 Kbps, which is quite a bit lower quality than even a standard cell phone call. And the quality would actually have to be even lower than that because voice recordings from after the wake word are definitely higher quality, leaving less data to allocate towards uploading audio not after the wake word.
2MB is a considerable amount of text though. It's possible that the text to speech is happening on the device and only the transcript is uploaded.
 
Upvote
-3 (0 / -3)

wagnerrp

Ars Legatus Legionis
31,634
Subscriptor
I think Amazon has the right idea but has confused the law.

As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.

My router records how much data each connected device downloads and uploads. My Echo uploads around 2 MB per day, and I probably give it around 10 requests per day. Pretty sure it’s just uploading what it hears after the wake word. It would be very hard to compress 24 hours worth of audio into 2 MB. Even if it threw out all of the audio where no one was talking, and just had to upload 1 hour’s worth of talking, a 1 hour audio file compressed to 2 MB would have to have a bitrate no higher than 4.5 Kbps, which is quite a bit lower quality than even a standard cell phone call. And the quality would actually have to be even lower than that because voice recordings from after the wake word are definitely higher quality, leaving less data to allocate towards uploading audio not after the wake word.
2MB is a considerable amount of text though. It's possible that the text to speech is happening on the device and only the transcript is uploaded.
The Echo has a little single-core A8, which is about as much power as you could expect in a phone 8 years ago, or a desktop 20 years ago. Speech-to-text existed back then, and it was pretty terrible. It improved by throwing more power at it, far more power than is available on that little unit. That's why the local processing is pretty bad at even picking up just the "Alexa" keyword. If it were processing speech continuously, there should be a significant power spike any time you start talking in its vicinity.
 
Upvote
3 (3 / 0)
People still don't seem to get it.

Echo devices ONLY record and send audio to Amazon when the "wake word" is heard (or if it is accidentally misheard), and even then, only for a brief period of time - enough to parse the spoken audio and act upon it. Amazon does store these recordings basically forever, but Echo devices DO NOT constantly record and stream everything you say and do to Amazon.

Now, could Amazon remotely turn on the mics and start streaming? Maybe. Could the device store more than the few seconds of audio internally which would be needed to detect the wake word? Maybe. But let's consider these possibilities in the context of an investigation:

1. If Amazon could remotely start the mics and stream the audio...well they'd have to be able to anticipate a murder in progress and start the mics. Again, Amazon DOES NOT constantly stream audio all the time from all Echo devices. I have verified this with packet captures - when nothing is occurring, the Echo is not sending enough data to be sending audio.

2. If the device does store some quantity of audio, you would have to be able to stop it from recording very soon after the event that you wanted recordings for took place. Even if it has more than a few seconds, it would be recording in a "black box" fashion - i.e. the oldest recordings fall off the end as new ones happen. This means that unless the Echo has days and days worth of buffer, or unless the police took the Echo immediately upon discovering the murder (to be fair, this MIGHT have happened, but it's still a big "if" whether the Echo even stores enough audio), the Echo would have recorded over any relevant audio by the time it is probed anyway.

I think all of this "subpoena Amazon for Echo data" comes out of the consistently reinforced and sensationalized belief that Echo devices are constantly recording everything we do all the time and storing it in perpetuity. That fact has never been proven. In fact, if it actually was being done it would have been clearly discovered by security researchers by now and Amazon would be in the doghouse. Every single one of the events where we have heard of an Echo device ostensibly spying on someone can be explained easily by either spurious detection of the wake word, a person having their privacy settings set far too permissive, or a bug in software.

Now, if the victim screamed "Alexa, I'm being murdered, I'm being murdered" over and over... Well then maybe we might have some useful audio. (Hint: Look at it that way - if you ARE being victimized by a crime, scream to your Echo...)
 
Upvote
0 (2 / -2)

Shavano

Ars Legatus Legionis
68,366
Subscriptor
There ms not really a way to distinguish a real gunshot or scream sound in an Alexa “home” from a movie or a show laying. This suggestion sounds really nice but it is ridiculous. The police depts are already under staffed and this would send them out chasing ghosts rather than helping in real crimes.

Do people think anymore?

Screams no, gunshots yes. Gunshots in movies don't sound like real gunshots. Your sound system can't reproduce that SPL and unless you think hearing loss is a good thing, you don't want it to be able to do so.

The false positive to real event ratio would be enormous just from things that sound like domestic violence but aren't.

Also, Amazon definitely doesn't want to be dragged into thousands of court cases so it behooves them to not unnecessarily record and store audio in Flash. Could they? Sure. There's 4G of flash on an (older, I think) Echo.
https://www.ifixit.com/Teardown/Amazon+ ... down/33953

What's really there? Probably about the same as is on your smart phone: your account info, voice profiles, names, addresses, contact info, configuration settings and possibly a complete copy of your Amazon account data.
 
Upvote
0 (0 / 0)

Shavano

Ars Legatus Legionis
68,366
Subscriptor
People still don't seem to get it.

Echo devices ONLY record and send audio to Amazon when the "wake word" is heard (or if it is accidentally misheard), and even then, only for a brief period of time - enough to parse the spoken audio and act upon it. Amazon does store these recordings basically forever, but Echo devices DO NOT constantly record and stream everything you say and do to Amazon.

Now, could Amazon remotely turn on the mics and start streaming? Maybe. Could the device store more than the few seconds of audio internally which would be needed to detect the wake word? Maybe. But let's consider these possibilities in the context of an investigation:

1. If Amazon could remotely start the mics and stream the audio...well they'd have to be able to anticipate a murder in progress and start the mics. Again, Amazon DOES NOT constantly stream audio all the time from all Echo devices. I have verified this with packet captures - when nothing is occurring, the Echo is not sending enough data to be sending audio.

2. If the device does store some quantity of audio, you would have to be able to stop it from recording very soon after the event that you wanted recordings for took place. Even if it has more than a few seconds, it would be recording in a "black box" fashion - i.e. the oldest recordings fall off the end as new ones happen. This means that unless the Echo has days and days worth of buffer, or unless the police took the Echo immediately upon discovering the murder (to be fair, this MIGHT have happened, but it's still a big "if" whether the Echo even stores enough audio), the Echo would have recorded over any relevant audio by the time it is probed anyway.

I think all of this "subpoena Amazon for Echo data" comes out of the consistently reinforced and sensationalized belief that Echo devices are constantly recording everything we do all the time and storing it in perpetuity. That fact has never been proven. In fact, if it actually was being done it would have been clearly discovered by security researchers by now and Amazon would be in the doghouse. Every single one of the events where we have heard of an Echo device ostensibly spying on someone can be explained easily by either spurious detection of the wake word, a person having their privacy settings set far too permissive, or a bug in software.

Now, if the victim screamed "Alexa, I'm being murdered, I'm being murdered" over and over... Well then maybe we might have some useful audio. (Hint: Look at it that way - if you ARE being victimized by a crime, scream to your Echo...)

I do wonder if they got a surveillance warrant from your local law enforcement (or a FISA court) if they could remotely turn on your mic and stream audio. It wouldn't surprise me if they could. Certainly with a software change they could because all the needed hardware is there.

It also wouldn't surprise me if a three letter agency could provide them with an application all ready to download and run on your Echo that would do it for them so Amazon's involvement would be minimal.


It would trouble me a good deal if the USA stopped seeking warrants for such searches because it would suggest to me they don't need anyone's help to do so.
 
Upvote
0 (0 / 0)
I think all of this "subpoena Amazon for Echo data" comes out of the consistently reinforced and sensationalized belief that Echo devices are constantly recording everything we do all the time and storing it in perpetuity.

I think it probably comes more from the fact we know Alexa has a habit of getting accidentally activated. If you're investigating a crime (much less a double murder) and there's a device that might have captured relevant audio and metadata, it'd be truly boneheaded not to ask for it to be provided if it exists.

Personally I don't and won't have an echo or similar. The potential trade-offs simply aren't worth the functionality it provides. I don't believe that Alexa sits constantly streaming, nor do I believe that Amazon would wilfully change that (in the short term at least).

But I also don't trust that bugs won't happen (I mean, fuck, the Google mini started life accidentally streaming because of a hardware issue). The impact of that may or may not be minimal (fancy someone having a recording of your safeword?) but what do I actually gain by having one? Most people I know with them end up using them almost exclusively to play music once the novelty has worn off.

Edited to add: I also live in a country that's granted itself "bulk equipment interference" powers. Given the authoritarian route some politicians are going down, not having a dedicated, targetable listening device in the house may be a wise move in future years (or it might all be fine, of course).
 
Upvote
1 (2 / -1)

Boskone

Ars Legatus Legionis
13,025
Subscriptor
I think I'll continue to hold off on smart speakers (and digital assistants in general) until something like Mycroft is a bit more useful. I'd rather the additional resources and overhead of being able to host my own, the various big players (Google, Apple, Samsung, Microsoft, Amazon, and whoever else) are just too damned creepy.

Apple does not do server side processing for that kind of information.
Apple does do server side processing for that kind of information. Siri (and Google, and probably the rest) do some local recognition for common phrases (e.g. there's no need to send "call X" to a server), but anything they don't immediately recognize is passed to a server.

And even if it's not needed for processing, unless you've set it not to it might be sending commands back for training the language processors.
 
Upvote
1 (1 / 0)

Boskone

Ars Legatus Legionis
13,025
Subscriptor
I understand the request with metadata such as phone pairings, but audio recordings I don't understand. Does it mean Amazon Echo devices not only transmit the audio data to server for processing (looking for keywords and contexts) , the server stores the raw audio?
Unless it's physically turned off, all sounds are transmitted.

What Amazon likely doesn't want the customers to know is that those sounds are probably stored, and analyzed for information to sell people more things. I also expect that the sounds are thrown through some AI's to improve understanding and a host of other things. I DON'T expect that people listen to them, unless there's some human/machine correction going on for the AI analysis, and even then, I expect the recordings are anonymized.

At least, the paranoid side of me says that's what they probably do. There are too many anecdotal stories about how Echo did something weird involving sending messages that weren't intended to be sent, or people not knowing it was "listening" for them to NOT store the recordings.

After all, if there were no recordings to turn over, then they could just say so. That they turned over similar data in the past tells me they probably DO record everything.

As for this:

Amazon did not immediately respond to Ars’ request for comment on Saturday morning, but a spokesperson told the Associated Press that it would not give up any data "without a valid and binding legal demand properly served on us."
It seems to me a court order IS a valid and binding legal demand that's incumbent upon Amazon to obey. I'm all about privacy rights, but at the same time, the fourth amendment provides a constitutional, legal avenue for the government to acquire private information. The information doesn't "belong" to Amazon in the first place. They merely collect it. It belongs to the customer (since, IIRC, the customer can wipe it at will, at least according to Amazon).

I expect Amazon will comply on the downlow so that they don't scream to their customers that their conversations are ALL recorded as long as the thing is on and connected. As for proving this, I imagine a device by device data stream analysis through the router would probably tell a user if it "streams" their home sounds to Amazon. Not having one, I can't do that test myself.

Personally, the whole concept of a listening device, benignly intended or not, just doesn't appeal to me and I think the concept is utterly creepy. I'd love a "personal assistant", but not one controlled by a corporation interested in my using it to sell me more shit.

It's the "Always On" aspect that really bothers me. My Comcast remote has voice commands - but I have to push a button to activate the microphone, so it's normally off and doesn't bother me much (In my more paranoid moments I could conceive of the button being a ruse, but there are battery issues in a remote). As far as I know, there's no way to selectively activate/deactivate one of these Echo devices without unplugging it.

I think they need something like this, and a light to indicate when the microphone is active, to assuage privacy concerns.

There is a microphone button you can press to deactivate the Alexa microphone. It does indicate with a little red light that the mic is off.

A software controlled microphone and software controlled indicator light only merits so much trust. They are often bypassed on webcams using RAT software. Amazon probably respects them but how heavily has Alexa been security audited?
Are they software-controlled? Seems like it'd be easier to use a relay or whatever that's software controlled, and have the LED and mic sharing that circuit so that--absent physical alteration--when one's on, both are necessarily on.
 
Upvote
0 (0 / 0)

wagnerrp

Ars Legatus Legionis
31,634
Subscriptor
I think I'll continue to hold off on smart speakers (and digital assistants in general) until something like Mycroft is a bit more useful. I'd rather the additional resources and overhead of being able to host my own, the various big players (Google, Apple, Samsung, Microsoft, Amazon, and whoever else) are just too damned creepy.

Apple does not do server side processing for that kind of information.
Apple does do server side processing for that kind of information. Siri (and Google, and probably the rest) do some local recognition for common phrases (e.g. there's no need to send "call X" to a server), but anything they don't immediately recognize is passed to a server.
I don't know if this is still the case, but the decoded plaintext actually used to be sent back to your phone unencrypted. There were hacks (effectively Alexa Skills) that would route Siri traffic through an external network proxy, and then intercept the plaintext on its return to perform some other task.
 
Upvote
1 (1 / 0)