Who’s listening? Privacy questions echo across the Internet of Things

While new technology improves our lives, it also could be used against us

Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInEmail this to someonePrint this page

Could Amazon’s Alexa be a tat­tle­tale? Yes, as could any inter­net-con­nect­ed device in your home, we were all remind­ed this week.

News out­lets lit up on Tues­day with news that Ama­zon had been served with a search war­rant in a mur­der case, as detec­tives in Ben­tonville, Arkansas, want to know what Alexa heard in the ear­ly morn­ing hours of Nov. 22, 2015—when Vic­tor Collins was found dead in a hot tub behind a home after an Arkansas Razor­backs foot­ball game.

Alexa, you are prob­a­bly aware, is the per­son­i­fi­ca­tion of Amazon’s Echo device. She is among the more pop­u­lar Inter­net of Things gad­gets bang­ing down our doors try­ing to “break” into our homes. Echo lis­tens con­stant­ly, using an array of sev­en micro­phones, ready to hear com­mands from her owner.

Relat­ed video: Why com­pa­nies don’t need to for­feit pri­va­cy to make profits

Police in Arkansas want to know what, if any­thing, Alexa might have over­heard in what author­i­ties allege was a vio­lent mur­der that Novem­ber night. Ama­zon, accord­ing to the search war­rant, has not com­plete­ly com­plied with this request, which ini­tial­ly was served in Decem­ber 2015, and then re-served later.

Wake word starts recording

Police prob­a­bly won’t get much from Alexa. She lis­tens all the time, but only records and trans­mits con­ver­sa­tions after a “wake word” is issued—usually, “ALEXA.” Echo gad­gets hear the wake word, then trans­mit com­mands back to Ama­zon for lan­guage processing.

Those record­ing are stored by Ama­zon and can be viewed and delet­ed at any time by users (by vis­it­ing http://amazon.com/mycd). Police who heard the record­ing prob­a­bly would only obtain a list of bor­ing com­mands like, “Tell me the weath­er” or “Order me more toi­let paper.”

There is a small pos­si­bil­i­ty that Ama­zon may know some­thing more, however—and one can see why an enter­pris­ing detec­tive would want to bring in Alexa for an “inter­view.”

As Echo users know, Alexa occa­sion­al­ly is awak­ened by mis­take, and rude­ly shoves her way into con­ver­sa­tions. There is a small chance that some­thing use­ful to police might have been record­ed by acci­dent. (The chance is tru­ly small, because Alexa is trained to block out back­ground noise, which pre­sum­ably would even include the sound of a grue­some murder).

Slim chance of gain­ing information

There’s an even small­er chance that a sus­pect might have said out loud, “Alexa … how do I mur­der some­one in a hot tub?” That’s why this case is prob­a­bly much ado about noth­ing. While Ama­zon has sup­plied some data to police, accord­ing to reports, the firm is refus­ing to sup­ply the Alexa chat­ter. But that’s prob­a­bly not a big deal.

Here’s the big deal: The sus­pect, James Bates, appar­ent­ly was a con­nect­ed home fan, and had sev­er­al Inter­net of Things devices in his “smart” home. He had a Nest ther­mome­ter, a WeMo device for his garage door, and motion sen­sors around his home. Of great­est inter­est, he also had a smart water meter.

Local reports indi­cate police have alleged­ly deter­mined that an unusu­al amount of water was used in the house late that night, per­haps to clean the victim’s blood from the crime scene. Bates’ “smart” home is so smart that it like­ly will tes­ti­fy against him in court.

Let me be clear: If data helps put a mur­der­er in jail, that’s great. I have no prob­lem with evi­dence that’s obtained through prop­er chan­nels, when a judge agrees that a war­rant is deserved.

Secu­ri­ty holes open

But this case should be a stark reminder of the real­i­ty that is arriv­ing fast, thanks to the Inter­net of Things: With George Jet­son comes George Orwell. Just as every­thing you type in a key­board could one day be used in a court of law against you, so too could any­thing you do or say inside a smart home.

And remem­ber, courts aren’t just for bad guys. Smart home data—just like gro­cery store loy­al­ty card data—will find its way into civ­il court, where it will help decide child cus­tody in divorce cas­es. (“Your hon­or, look at how often my ex-hus­band comes home late at night!”)

There’s just no stop­ping this, out­side a broad new pri­va­cy law that deals with this brave new future. Think I’m exag­ger­at­ing? Well, you prob­a­bly didn’t fol­low last year’s admis­sion by Sam­sung that its Smart TVs were lis­ten­ing in on inti­mate liv­ing room con­ver­sa­tions. Or sto­ries this year about Inter­net of Toys gad­gets that record and upload your children’s chatter—and make it rel­a­tive­ly easy for strangers to lis­ten in, too.

It’s sad, because all these clever new tech­nolo­gies have great poten­tial to enhance our lives. But as often hap­pens, we race for­ward with capa­bil­i­ties before con­sid­er­ing the unin­tend­ed consequences.

More sto­ries relat­ed to IoT devices:
As the Inter­net of Things expands, so do the risks
How to keep your appli­ances from expos­ing your data
Why more attacks lever­ag­ing the Inter­net of Things are inevitable

Posted in Data Privacy, Featured Story