I think I'll continue to hold off on smart speakers (and digital assistants in general) until something like Mycroft is a bit more useful. I'd rather the additional resources and overhead of being able to host my own, the various big players (Google, Apple, Samsung, Microsoft, Amazon, and whoever else) are just too damned creepy.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.I think Amazon has the right idea but has confused the law.
As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
That seems quite likely.
Helping solve a double murder is obviously good but, commercially, I very much doubt they want there to confirm that they’re potentially recording everything that goes on in your home. It’s interesting that they aren’t, or so far as I can see from the linked story don’t seem to be, denying the recordings exists.
Even if Amazon are allowed to keep the recordings under the TOS, hardly anyone thinks about that. Playing a detailed recording of a murder in open court might bring home to customers exactly how much privacy they’ve actually given up.
I understand the request with metadata such as phone pairings, but audio recordings I don't understand. Does it mean Amazon Echo devices not only transmit the audio data to server for processing (looking for keywords and contexts) , the server stores the raw audio?
All the big data companies keep everything they can get, forever.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.I think Amazon has the right idea but has confused the law.
As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
I think I'll continue to hold off on smart speakers (and digital assistants in general) until something like Mycroft is a bit more useful. I'd rather the additional resources and overhead of being able to host my own, the various big players (Google, Apple, Samsung, Microsoft, Amazon, and whoever else) are just too damned creepy.
Apple does not do server side processing for that kind of information.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.I think Amazon has the right idea but has confused the law.
As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
That seems quite likely.
Helping solve a double murder is obviously good but, commercially, I very much doubt they want there to confirm that they’re potentially recording everything that goes on in your home. It’s interesting that they aren’t, or so far as I can see from the linked story don’t seem to be, denying the recordings exists.
Even if Amazon are allowed to keep the recordings under the TOS, hardly anyone thinks about that. Playing a detailed recording of a murder in open court might bring home to customers exactly how much privacy they’ve actually given up.
It’s also a double edged sword for privacy advocates. A murderer doesn’t exactly make a sympathetic defendant and could easily swing in the other direction in the court of public opinion.
Privacy advocates need to find examples where the innocent are hurt by lack of privacy. Clinging on to cases about criminals being prosecuted doesn’t help the cause.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.I think Amazon has the right idea but has confused the law.
As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
That seems quite likely.
Helping solve a double murder is obviously good but, commercially, I very much doubt they want there to confirm that they’re potentially recording everything that goes on in your home. It’s interesting that they aren’t, or so far as I can see from the linked story don’t seem to be, denying the recordings exists.
Even if Amazon are allowed to keep the recordings under the TOS, hardly anyone thinks about that. Playing a detailed recording of a murder in open court might bring home to customers exactly how much privacy they’ve actually given up.
It’s also a double edged sword for privacy advocates. A murderer doesn’t exactly make a sympathetic defendant and could easily swing in the other direction in the court of public opinion.
Privacy advocates need to find examples where the innocent are hurt by lack of privacy. Clinging on to cases about criminals being prosecuted doesn’t help the cause.
Nor is it legally relevant. They have a court order which they got without violating anyone's rights. Same as if they asked for permission to search the filing cabinet of the victims.
Don't know if this has been mentioned already, but my concern is not so much about what audio Alexa sends home. As others have pointed out, the bitrate is not high enough for it to be relaying everything you say.
What concerns me is how much information is it extracting from what it hears when it is supposedly not listening because you haven't said the wake word.
It's a completely closed ecosystem with hardware and software expressly designed for decoding speech and yet we are expected to believe that they don't scan the audio for "interesting" keywords to report home to the advertising department.
There are too many anecdotal reports of people being shown ads on Amazon for products that they've never searched for, but mentioned while talking on the phone within listening range of their Alexa.
It also sounds to me that Amazon has been storing the audio and data unknown to the customers, so isn't that a violation of the customers privacy rights?
Funny, but a related story was covered several years ago on a Monk episode.Sounds like the plot of a Columbo episode.
I'm surprised it took this long to surface.
And you believe that?There is a microphone button you can press to deactivate the Alexa microphone. It does indicate with a little red light that the mic is off.
Don't know if this has been mentioned already, but my concern is not so much about what audio Alexa sends home. As others have pointed out, the bitrate is not high enough for it to be relaying everything you say.
What concerns me is how much information is it extracting from what it hears when it is supposedly not listening because you haven't said the wake word.
It's a completely closed ecosystem with hardware and software expressly designed for decoding speech and yet we are expected to believe that they don't scan the audio for "interesting" keywords to report home to the advertising department.
There are too many anecdotal reports of people being shown ads on Amazon for products that they've never searched for, but mentioned while talking on the phone within listening range of their Alexa.
Seems unlikely. Amazon's recommendations, in fact, always strike me as extremely crude; they consist of recommending what I just bought, or the items that already showed up in their "Customers also bought..." list. There doesn't seem to be any deeper analysis - or reconnaissance - going on than that.
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.I think Amazon has the right idea but has confused the law.
As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
Most judges should be familiar that ethical companies do no hand out customer data on request. There is just too much social engineering to trust a verbal demand of the court.
A subpoena or search warrant should be a standard any time a judge requests information not physically present at the crime scene to create an appropriate paper trail of data scope and custody. Something which should be digitally signed and easily verified and can be kept on file as proof of delivery.
They argued against fulfilling a warrant from a judge, it's risible to frame this as due diligence against random social engineering attack.
There ms not really a way to distinguish a real gunshot or scream sound in an Alexa “home” from a movie or a show laying. This suggestion sounds really nice but it is ridiculous. The police depts are already under staffed and this would send them out chasing ghosts rather than helping in real crimes.
There ms not really a way to distinguish a real gunshot or scream sound in an Alexa “home” from a movie or a show laying. This suggestion sounds really nice but it is ridiculous. The police depts are already under staffed and this would send them out chasing ghosts rather than helping in real crimes.
I wasn't suggesting that Alexa units upload the data to the local police department, only to Amazon cloud servers. Where it would stay, quietly, unless it happened that a real crime was committed at that place and time, and Amazon recieved a warrant about it.
So the police wouldn't have their time wasted. Of course, Amazon might need more cloud storage, so there could still be a problem at that end.
Although privacy is certainly a concern, it seems to me that products like Alexa would actually be improved if, say, when they heard a gunshot or a scream, they then sent the last 60 minutes or so of internally recorded audio up to the cloud for possible retrieval by law enforcement.
After all, murder victims won't always have the opportunity to activate an emergency record mode.
Of course, in any house with children, or near where exhausts backfire, there would be false positives - but no one would ever hear them, because there wouldn't be any warrants issued in those cases.
I guess we are going to find out. We desperately need clear privacy protections even in our own homes.
Shouldn’t wireshark be able to put to rest the speculation over whether these type of devices are recording outside the wake word?
Seems more like they don't want to admit to saving recordings when the wake word isn't issued.I think Amazon has the right idea but has confused the law.
As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
The Alexa TOS makes it pretty clear they store a lot of your audio. It's less clear who owns that audio but I suspect it isn't the person doing the speaking.
2MB is a considerable amount of text though. It's possible that the text to speech is happening on the device and only the transcript is uploaded.Seems more like they don't want to admit to saving recordings when the wake word isn't issued.I think Amazon has the right idea but has confused the law.
As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
My router records how much data each connected device downloads and uploads. My Echo uploads around 2 MB per day, and I probably give it around 10 requests per day. Pretty sure it’s just uploading what it hears after the wake word. It would be very hard to compress 24 hours worth of audio into 2 MB. Even if it threw out all of the audio where no one was talking, and just had to upload 1 hour’s worth of talking, a 1 hour audio file compressed to 2 MB would have to have a bitrate no higher than 4.5 Kbps, which is quite a bit lower quality than even a standard cell phone call. And the quality would actually have to be even lower than that because voice recordings from after the wake word are definitely higher quality, leaving less data to allocate towards uploading audio not after the wake word.
2MB is a considerable amount of text though. It's possible that the text to speech is happening on the device and only the transcript is uploaded.
The Echo has a little single-core A8, which is about as much power as you could expect in a phone 8 years ago, or a desktop 20 years ago. Speech-to-text existed back then, and it was pretty terrible. It improved by throwing more power at it, far more power than is available on that little unit. That's why the local processing is pretty bad at even picking up just the "Alexa" keyword. If it were processing speech continuously, there should be a significant power spike any time you start talking in its vicinity.2MB is a considerable amount of text though. It's possible that the text to speech is happening on the device and only the transcript is uploaded.Seems more like they don't want to admit to saving recordings when the wake word isn't issued.I think Amazon has the right idea but has confused the law.
As I understand, the Echo belonged to the victim. That negates the privacy right Amazon is claiming.
My router records how much data each connected device downloads and uploads. My Echo uploads around 2 MB per day, and I probably give it around 10 requests per day. Pretty sure it’s just uploading what it hears after the wake word. It would be very hard to compress 24 hours worth of audio into 2 MB. Even if it threw out all of the audio where no one was talking, and just had to upload 1 hour’s worth of talking, a 1 hour audio file compressed to 2 MB would have to have a bitrate no higher than 4.5 Kbps, which is quite a bit lower quality than even a standard cell phone call. And the quality would actually have to be even lower than that because voice recordings from after the wake word are definitely higher quality, leaving less data to allocate towards uploading audio not after the wake word.
There ms not really a way to distinguish a real gunshot or scream sound in an Alexa “home” from a movie or a show laying. This suggestion sounds really nice but it is ridiculous. The police depts are already under staffed and this would send them out chasing ghosts rather than helping in real crimes.
Do people think anymore?
People still don't seem to get it.
Echo devices ONLY record and send audio to Amazon when the "wake word" is heard (or if it is accidentally misheard), and even then, only for a brief period of time - enough to parse the spoken audio and act upon it. Amazon does store these recordings basically forever, but Echo devices DO NOT constantly record and stream everything you say and do to Amazon.
Now, could Amazon remotely turn on the mics and start streaming? Maybe. Could the device store more than the few seconds of audio internally which would be needed to detect the wake word? Maybe. But let's consider these possibilities in the context of an investigation:
1. If Amazon could remotely start the mics and stream the audio...well they'd have to be able to anticipate a murder in progress and start the mics. Again, Amazon DOES NOT constantly stream audio all the time from all Echo devices. I have verified this with packet captures - when nothing is occurring, the Echo is not sending enough data to be sending audio.
2. If the device does store some quantity of audio, you would have to be able to stop it from recording very soon after the event that you wanted recordings for took place. Even if it has more than a few seconds, it would be recording in a "black box" fashion - i.e. the oldest recordings fall off the end as new ones happen. This means that unless the Echo has days and days worth of buffer, or unless the police took the Echo immediately upon discovering the murder (to be fair, this MIGHT have happened, but it's still a big "if" whether the Echo even stores enough audio), the Echo would have recorded over any relevant audio by the time it is probed anyway.
I think all of this "subpoena Amazon for Echo data" comes out of the consistently reinforced and sensationalized belief that Echo devices are constantly recording everything we do all the time and storing it in perpetuity. That fact has never been proven. In fact, if it actually was being done it would have been clearly discovered by security researchers by now and Amazon would be in the doghouse. Every single one of the events where we have heard of an Echo device ostensibly spying on someone can be explained easily by either spurious detection of the wake word, a person having their privacy settings set far too permissive, or a bug in software.
Now, if the victim screamed "Alexa, I'm being murdered, I'm being murdered" over and over... Well then maybe we might have some useful audio. (Hint: Look at it that way - if you ARE being victimized by a crime, scream to your Echo...)
I think all of this "subpoena Amazon for Echo data" comes out of the consistently reinforced and sensationalized belief that Echo devices are constantly recording everything we do all the time and storing it in perpetuity.
Apple does do server side processing for that kind of information. Siri (and Google, and probably the rest) do some local recognition for common phrases (e.g. there's no need to send "call X" to a server), but anything they don't immediately recognize is passed to a server.I think I'll continue to hold off on smart speakers (and digital assistants in general) until something like Mycroft is a bit more useful. I'd rather the additional resources and overhead of being able to host my own, the various big players (Google, Apple, Samsung, Microsoft, Amazon, and whoever else) are just too damned creepy.
Apple does not do server side processing for that kind of information.
Are they software-controlled? Seems like it'd be easier to use a relay or whatever that's software controlled, and have the LED and mic sharing that circuit so that--absent physical alteration--when one's on, both are necessarily on.Unless it's physically turned off, all sounds are transmitted.I understand the request with metadata such as phone pairings, but audio recordings I don't understand. Does it mean Amazon Echo devices not only transmit the audio data to server for processing (looking for keywords and contexts) , the server stores the raw audio?
What Amazon likely doesn't want the customers to know is that those sounds are probably stored, and analyzed for information to sell people more things. I also expect that the sounds are thrown through some AI's to improve understanding and a host of other things. I DON'T expect that people listen to them, unless there's some human/machine correction going on for the AI analysis, and even then, I expect the recordings are anonymized.
At least, the paranoid side of me says that's what they probably do. There are too many anecdotal stories about how Echo did something weird involving sending messages that weren't intended to be sent, or people not knowing it was "listening" for them to NOT store the recordings.
After all, if there were no recordings to turn over, then they could just say so. That they turned over similar data in the past tells me they probably DO record everything.
As for this:
It seems to me a court order IS a valid and binding legal demand that's incumbent upon Amazon to obey. I'm all about privacy rights, but at the same time, the fourth amendment provides a constitutional, legal avenue for the government to acquire private information. The information doesn't "belong" to Amazon in the first place. They merely collect it. It belongs to the customer (since, IIRC, the customer can wipe it at will, at least according to Amazon).Amazon did not immediately respond to Ars’ request for comment on Saturday morning, but a spokesperson told the Associated Press that it would not give up any data "without a valid and binding legal demand properly served on us."
I expect Amazon will comply on the downlow so that they don't scream to their customers that their conversations are ALL recorded as long as the thing is on and connected. As for proving this, I imagine a device by device data stream analysis through the router would probably tell a user if it "streams" their home sounds to Amazon. Not having one, I can't do that test myself.
Personally, the whole concept of a listening device, benignly intended or not, just doesn't appeal to me and I think the concept is utterly creepy. I'd love a "personal assistant", but not one controlled by a corporation interested in my using it to sell me more shit.
It's the "Always On" aspect that really bothers me. My Comcast remote has voice commands - but I have to push a button to activate the microphone, so it's normally off and doesn't bother me much (In my more paranoid moments I could conceive of the button being a ruse, but there are battery issues in a remote). As far as I know, there's no way to selectively activate/deactivate one of these Echo devices without unplugging it.
I think they need something like this, and a light to indicate when the microphone is active, to assuage privacy concerns.
There is a microphone button you can press to deactivate the Alexa microphone. It does indicate with a little red light that the mic is off.
A software controlled microphone and software controlled indicator light only merits so much trust. They are often bypassed on webcams using RAT software. Amazon probably respects them but how heavily has Alexa been security audited?
I don't know if this is still the case, but the decoded plaintext actually used to be sent back to your phone unencrypted. There were hacks (effectively Alexa Skills) that would route Siri traffic through an external network proxy, and then intercept the plaintext on its return to perform some other task.Apple does do server side processing for that kind of information. Siri (and Google, and probably the rest) do some local recognition for common phrases (e.g. there's no need to send "call X" to a server), but anything they don't immediately recognize is passed to a server.I think I'll continue to hold off on smart speakers (and digital assistants in general) until something like Mycroft is a bit more useful. I'd rather the additional resources and overhead of being able to host my own, the various big players (Google, Apple, Samsung, Microsoft, Amazon, and whoever else) are just too damned creepy.
Apple does not do server side processing for that kind of information.