The last part of December contains many slow news days because so many people take off work during the holiday season. This week there was a collective sadness with the deaths of Carrie Fisher and her mother, Debbie Reynolds. (RIP Princess.) This week there was also a collective “freak out” over coverage of a 2015 Arkansas murder investigation where the police were attempting to obtain sound recordings that an Amazon Echo owned by the suspect might have preserved from Amazon. Amazon said no, citing privacy concerns. (The threat to future sales of a very popular product was not cited.) Many of us heard echoes of the Justice Department earlier this year attempting to force Apple to unlock an iPhone owned by the San Bernadino shooter.
A lot of hyperbola in the legal blogosphere, social media and even broadcast media followed the initial coverage. Even lawyer who were supposed to be able to research and analyze before commenting were tripping over themselves with references to Big Brother and statements like “these things are always listening” or “you would have to be crazy to own one of these.” Above the Law had a great clickbait headline “Echo Knows What You Did Last Summer, But Can The Cops Know What Echo Knows?” The short column even had a Nixon reference with a warning not to install recording devices in your office.
Since I am now blogging about the Echo this week, I cannot claim complete purity. But after all of the hype, a fact-based post is warranted.
Most reviewers have dubbed the Amazon Echo the best voice-activated home assistant. It has been available since 2014. Google has recently released Google Home, a competing voice activated device that allows access to Google Assistant, so we will see future competition.
At our home, we love our Echo. It was a part of our Christmas fun, playing our Christmas Spotify playlists, trying out the free trial of Amazon Music, enjoying an eclectic Spotify Christmas playlist shared by a friend from Chicago and asking “Alexa” all sorts of interesting questions. Like everyone I have ever talked to who has tried the Amazon Echo, we love ours and are definitely keeping it. It also provides the home tech tool I have long wanted, adding things to your grocery shopping list by voice command only.
It is only technically true to say that the Echo listens all the time. It listens for “wake up words” or more technically stated, activation phrases. For Echo that is “Alexa,” and for Google that is “OK Google.” (If someone in the household is actually named Alexa, you can change the activation word to Amazon.) When it hears the phrase, it beeps and lights up, waiting for a request or command. Often this can be something as simple and useful as “what’s the weather?” or “what are the sports scores?” The Echo records these commands and quickly sends them back to an Amazon data center to interpret them. Yes, they are saved, long with any ambient noise in the background, like a crying baby. For a detailed discussion of how and why this happens and what control you have over it, see this feature on Wired “Alexa and Google Home Record What You Say. But What Happens to That Data?”
Suffice it to say, the smart people at Amazon and Google designed these products to protect basic user privacy because to do otherwise could hurt sales. As the Wired article linked above notes:
“The audio zipping from your home to Amazon and Google’s data centers is encrypted, so even if your home network is compromised, it’s unlikely that the gadgets can be used as listening devices. A bigger risk is someone getting hold of your Amazon or Google password and seeing a log of your interactions online.
“There are also simple measures you can take to prevent Echo and Home from listening to you when you don’t want them to. Each device has a physical mute button, which cuts off the mic completely.”
But there is a microphone and so the chance of compromise is not zero. You can also log in and delete all of your saved audio clips to either service. But one of the questions of life today is when is deleted really deleted. I would suspect at least the verbal purchase orders of big ticket Amazon products are saved for some time in case there is a dispute.
I seriously doubt that the Arkansas investigation would find any useful data since it is pretty unlikely Alexa was asked any incriminating questions or there is useful ambient background noise. (By the way, if you are an iPhone user and haven’t asked Siri where to bury a dead body, the reply is quite humorous and, given the millions of us who have asked the question by now, probably not incriminating.)
There are incidents of unintended activation such as someone talking about Alexa on television and Alexa waking up in response. The most interesting topic for lawyers is not whether Alexa will record evidence to solve crimes, but whether it might retain ESI (electronically stored information) that could be useful in civil litigation. One can foresee a divorce lawyer seeking the stored recordings of one who used Alexa 100 times a day, hoping to catch the voice of a paramour in the background. E-discovery expert Craig Ball blogged about this possibility back in March and his “Alexa. Preserve ESI” post is great reading on the subject.
Craig also notes that the recordings might be beneficial to the Echo user as well in case one’s tech savvy friends add “buy heroin” to your shopping list and you accidently email it to local law enforcement.
At this point, it is safe to say webcams are a far greater security risk than Echos. The odds of something significant being captured and preserved as ambient noise in a quickly spoken query or command are very small. Meanwhile most business class laptops have webcams built in. A hacker who could record video and audio constantly via your webcam is definitely invading your privacy and could cause embarrassment at a minimum. I’ve long counseled that if your kids have a webcam their room, it should be covered with a cover or a band-aid on their laptops when not in use. Just a few months ago, hacked webcams were used in a denial of service attack that shut down Amazon and Twitter temporarily.
Fastcase founder Ed Walters is a thoughtful legal technologist. He posted series of tweets this week about what public policy of the privacy of your personal data should be. Your phone’s GPS can retain a map of every step you took during the day. Should that be discoverable in a routine lawsuit about something that happened at work? As the Internet of Things gains steam, your connected devices will have a frighteningly complete view of everything you do – your thermostat raises the home’s temperature as you drive home, your refrigerator knows what you ate on a given date and your home entertainment system knows what you watched and how often you switched the channels.
In 1988, the Congress passed and President Regan signed into law, the Video Privacy Protection Act, forbidding video tape rental stores from disclosing what videos citizens rented. Obviously that has decreasing application today.
Ed Walters asked how current consumer data uses square with a legal doctrine called the Third-Party doctrine, which, according to Wikipedia says “that people who voluntarily give information to third parties—such as banks, phone companies, internet service providers (ISPs), and e-mail servers—have ‘no reasonable expectation of privacy.’ A lack of privacy protection allows the United States government to obtain information from third parties without a legal warrant and without otherwise complying with the Fourth Amendment prohibition against search and seizure without probable cause and a judicial search warrant.”
Ed thinks deep thoughts. I just know I am keeping my Echo and will unplug it or use the mute button only rarely. But as we move to a society with many self-driving cars and devices we have not yet thought about, there will be more questions than answers because history tells us that law develops much more slowly than technology. It is no longer the stuff of fiction when most of us will be using voice-activated assistants and Self-driving cars are already deciding who to kill.