Amazons internet-connected home assistant devices can turn on your TV, read you the news and order you an Uber. Law enforcement officials in Arkansas hope an Amazon Echo can help them crack a murder case.
When Bentonville police found the body of Victor Collins inside James Andrew Bates home in November, they also discovered a house outfitted with a number of internet of things devices, including an Amazon Echo. The gadget is constantly listening for spoken commands, but according to the company only records and stores snippets of conversation following a wake word in the Echos case, Alexa. Bentonville police say theres reason to believe that Amazon.com is in possession of records related to (their) investigation.
Although Amazon has twice refused to release the data, the warrant is ringing alarm bells for some owners of so-called internet of things gadgets. If Alexa is always on and always listening, can she incriminate you?
The Los Angeles Times spoke to Lee Tien, senior staff attorney at the Electronic Frontier Foundation, a digital rights nonprofit, about the potential privacy risks surrounding always-on home devices. The conversation has been edited for length and clarity.
Q: How are the privacy concerns surrounding Amazon Echo different than those involving, say, smartphones?
A: Traditionally, the home has been the apex of Fourth Amendment privacy protection in respect to law enforcement. You know, a mans home is his castle, that sort of thing. You always need a warrant to get into someones house. The tricky thing about a device thats recording data inside of your home is that you may be transmitting that recording in such a way that the government can directly collect it, or, as in the case we have in Arkansas, it may be that the data is sitting on Amazons servers.
Q: What can people do to protect their information when using a device thats always listening even if its not always recording?
A: Its really hard to. You dont know how they record, and you dont when theyre recording. We know that theres supposed to be a trigger word, but whats not clear to me is exactly whats going on when you havent said it, because in order for a voice command to turn on, its got to be on in some sense in the first place.
Q: Amazon says it wont turn over user information in this case, but if Amazon, or another internet of things manufacturer, caved to law enforcement requests, how would it affect consumers?
A: A story like this highlights that your data doesnt stay at home its in the cloud. Its under the control of someone else, and because of the consent you signed or because of a legal process, they might be compelled to share it with the government.
Whats unclear is how much people are aware of that. People may feel a certain amount of confidence or security that Amazon is only listening when theyre specifically addressing the device. If they believe that at no other time is any information gathered by the microphones and that turns out to be untrue that may be dissonant with their expectations.
Q: According to Amazon, the company will not release customer information without a valid and binding legal demand properly served. Why isnt a warrant a valid and binding legal document, and if it isnt, what is?
A: For a warrant to be valid, it has to establish probable cause and describe what they want in particularity. Youre getting into problems if you say you want everything. What struck me about this warrant was the lack of particularity. It seems wrong to say that just because theres this device thats always on, that constitutes probable cause to believe that relevant recordings exist. Theres no clear establishment that there was any communication using the trigger word. Im going to assume that Amazon doesnt think the warrant has established probable cause, or has asked for more information than theyre entitled to.
Some of the Silicon Valley companies have been known to withhold data unless the warrant is valid. Its a way to abide by the law and still demonstrate that theyre trying to protect their users. Theyre in a tough spot: They want to respond to valid government requests, but at the same time they dont want to look like they give the government whatever it wants whenever they ask for it. Theyre trying to walk this line, which may be even harder when theres a new technology. Its a balancing act.