Not Only Can Alexa Eavesdrop — She Can Also Testify Against You

[straycat19]

When it was revealed last month that a team of Amazon workers were tasked with listening to and reviewing Echo customers’ recordings—including those that customers never intended to record—the news sparked a flurry of criticism and concern regarding what this meant for the average consumer’s privacy.

 

At the same time, many were left unsurprised. Previous incidents, such as when an Amazon customer in Germany accidentally received someone else’s private Alexa recordings last year, have shown not only that the devices can record when least expected (such as when the user is in the shower, or having a private conversation) but also that these recordings can end up in unexpected hands.

 

This reality can leave users feeling that the device that helps them control their schedule, their music and even their home appliances isn’t completely within their control. In fact, the Echo can even be used against its owner—and may have the potential to send some users to prison.

 

As explained by Oxygen Forensics COO Lee Reiber in an interview with Forensic Magazine, when you live with an Alexa device, “it’s almost like your room is bugged.” Of course the “almost” is that Alexa isn’t necessarily always recording, but that doesn’t mean it only records when it’s supposed to either.

 

“We have a sample Alexa (...) that I utilize to do research on, and there is a lot of information on there. And I found several (recordings) that are specifically marked by Amazon as an error,” said Reiber, who has firsthand experience using Oxygen’s digital forensic tools to extract data from Echo devices. “I’m sitting there in my kitchen and I am talking to my wife, and it’s recording that information.”

 

Echo devices are meant to record what the user says to it after using a “wake word”—either “Echo,” “Amazon,” “computer” or the classic “Alexa,” depending on what the user prefers. The catch is that Alexa, which always has its microphone on listening for that word, has a habit of mishearing other words or sounds as its wake word, causing it to activate and record the voices or noises that follow.

 

I’ve noticed this with my own Echo Dot device, which sometimes lights up blue on its own, or startles me with a robotic “I’m sorry, I didn’t catch that” when I never said anything to begin with. Reiber also said those kitchen conversations with his wife were recorded without permission from a wake word, and plenty of other users have reported similar experiences with accidentally waking up their all-hearing assistant.

 

As Reiber explained, Amazon typically marks unintentional recordings as an error, and in forensic tools like Oxygen’s extractor, they show up marked as discarded items, similar to files someone has deleted from their phone or computer but are still there in the device’s memory. And like these unseen “deleted” files that any skilled digital examiner can recover and view, those accidental recordings are still available to investigators in full—and have the potential to become valuable forensic evidence in a case.

 

“Because they are already recording, any of these types of IoT (internet of things) devices can be tremendous, because again, if it’s still listening, it could record, and the quality is fantastic,” said Reiber, who also has a law enforcement background. “It’s just a great recording of the person who’s actually speaking. So, someone could say,

 

‘Well, it wasn’t me, it wasn’t me talking.’ Well, no, it is, it’s an exact recording of your voice.”

 

I found this to be fairly accurate when I logged into my Amazon account to see what my Echo Dot had recorded me saying, which any user can do by selecting “Your Content and Devices” under the “Account & Lists” dropdown menu. After arriving at the “Content and Devices” page, selecting “Alexa Privacy” and finally “Review Voice History,” I found a list of everything my Echo device has ever recorded, mostly mundane questions and commands.

Yup, that's me.

This list was organized and filterable by date, and as I went further back, there were a few items marked “Audio not intended for Alexa,” which I could listen to as well. One was triggered not by me, but by the language learning app I was using, playing the Korean word for “table.”

 

Of course this is nothing that would be of interest to the police, but the fact that so many of these unintentional recordings can be made in the homes of average people like myself means they could also very well capture the goings on in the home of a criminal, or someone suspected of a crime. And while Echo devices themselves only store about 4 GB of data such as messages, contacts, user-created lists and downloaded Alexa skills, as Reiber explains, if a lawyer were to subpoena Amazon for a user’s full set of recordings, which the company stores indefinitely, they would have access to all the same recordings both intentional and unintentional that the user could access from their account.

All of my intentional commands were correctly transcribed, such as when I asked Alexa to play music at 3:38 a.m. and then decided two minutes later I wasn't in the mood. But the unintentional recording was marked "Audio not intended for Alexa." I had the option to delete any of my saved recordings, but Reiber noted that deleting all recordings does not stop the Echo from recording more in the future if the user continues to use the device. (Screenshot: Amazon.com)

Such was the case in a New Hampshire double murder, where prosecutors requested the recordings from the Echo device of the homeowner, the main suspect at the time. Amazon fought the request, claiming the user’s recordings were protected by the First Amendment and stressing the company’s desire to protect customers’ privacy.

 

However, Amazon ultimately turned over the data when the homeowner himself said he didn’t mind.

 

As it turned out, the Alexa recordings worked in the man’s favor, and the murder charges against him were dropped, according to the Associated Press. The recordings apparently captured during the crime have now been ordered by a judge to be turned over as evidence in the trial of Timothy Verrill, a second man whom prosecutors now believe is the true perpetrator.

 

Reiber was skeptical that Amazon’s objections to producing the recordings were really about the First Amendment, though he stressed this was just his personal impression of the situation.

 

“I would say the reason why they did it is just exactly what happened, that once (the public) found out about that storage, it kind of opened Pandora’s Box,” he said. “We have many employees who are listening to our conversations—I think that’s the bigger picture.”

 

Although Alexa and Amazon have featured prominently in the news lately, Reiber pointed out that there are many other IoT, wearable and personal assistant devices that are constantly recording an abundance of personal data from their users, which can also be used by law enforcement to investigate and prosecute crimes. As one example, he noted that investigators could get an idea of when a person died by seeing when a wearable fitness device stopped detecting their pulse. As another example, he mentioned the Google Home, a device similar to the Amazon Echo.

 

“A little bit of a difference (is that) Google always wants to know your location. So, with Google in itself, the devices can actually recover information—latitude and longitude of where the device is,” he said. “I would be more apt to say I’m more afraid of Google, because of all the intertwining devices. They have a Google account, everything is attached to it, all your searches, anything else—that’s recoverable.”

 

Source

[dMog]

Did anybody really expect anything different!