TAMPA, Fla. — The convenience of smart speakers – like Amazon’s Echo, Google’s Home and Apple’s HomePod – could come at a price to your privacy and these popular tech tools may be recording you even when you’re not using them, the I-Team uncovered.
Justin McDonald told I-Team Investigator Adam Walser that he loves his Amazon Echo. With simple commands, McDonald controls his ceiling fan, thermostat and smart tv without getting off his couch.
“I think I have between 10 and 12 internet connected devices,” said McDonald, who regularly asks Amazon’s virtual assistant “Alexa” about the news, weather and stock reports. “It’s worked its way into our morning routines.”
He even has an additional Echo in his infant son’s room.
When asked what Alexa knows about him, Manatee County resident McDonald replied, “More than I’d like to know probably.”
The I-Team asked Justin McDonald to listen to his own Amazon audio data, which can be accessed through Amazon’s privacy dashboard.
Alexa saved errant recordings
McDonald not only saw requests he made to Alexa but also discovered dozens of other audio clips that should not have been recorded.
“This is what kind of concerned me a little bit – ‘Text not available – Audio is not intended for Alexa,’” said McDonald, pointing to the message on his laptop screen.
</p><p>An I-Team review of McDonald’s errant recordings were less than a second long and contained little decipherable information.
I-Team Investigator Adam Walser contacted Amazon about the errant recordings. The company said the recordings were likely generated by something sounding like “Alexa” – the word that triggers the device to start recording.
An Amazon spokeswoman said audio files stored on its servers can be deleted by users at any time through the privacy dashboard and also suggested users set their Echo device to “Amazon Echo” or “computer” – instead of “Alexa” – to eliminate some of those errant recordings.
Smart speakers always listening
But Gus Dimitrelos, a retired U.S. Secret Service special agent who now works as a cyber security consultant, said changing the name of your Amazon Echo won’t protect your privacy.
He compares these devices to allowing a stranger to come into your home and listen to your private conversations.
“If you enable that device to monitor your activity within the privacy of your home, then you’re exposing yourself,” said Dimitrelos.
Dimitrelos said many users often grant tech companies that full permission when signing the service agreements – without even thinking about it.
“Whether it’s Microsoft, whether it’s Google, whether it’s Apple – you’re agreeing to store your data on their servers,” said Dimitrelos. “In these cases, where audio recorders are in your house, you’re allowing them to monitor your voice at all times.
And the government is increasingly requesting those voice recordings.
Feds requesting more user data
Local and federal law enforcement – including the FBI – sought data from nearly 700,000 user accounts in a just a one-year period, according to so-called “transparency reports” released twice a year by the big tech companies.
See the latest transparency reports:
- Amazon Web Service: aws.amazon.com/blogs/security/tag/transparency-report/
The NSA also made thousands of more requests for user information during that time period and an I-Team review found the tech companies handed over the information requested by local and federal agencies in more than two-thirds of those cases.
In November, a New Hampshire judge ordered Amazon to turn over recordings from smart speakers at a home where two women were murdered.
“I think most people probably don’t even realize that Alexa is taking account of what’s going on in your house, in addition to responding to your demands,” said New Hampshire University Law Professor Albert Scherr at time of the investigation.
Demand for smart speakers is on the rise. Amazon, Google and Apple have reportedly sold hundreds of millions of these devices in recent years.
The I-Team reached out to Google and Apple about how users are recorded on smart speakers.
In a statement, a Google spokesperson said, “All the devices that come with the Google Assistant are designed with privacy in mind.”
“Google only stores voice-based queries received immediately after recognizing of hot words ‘OK Google’ or ‘Hey Google.’ Hot word detection runs locally on the Google Home device across a short snippet of microphone data. If the hot word is not detected on that short snippet, the snippet is immediately discarded. If the hot word is recognized the data including the query contents are sent to Google servers for analyzing and storage in personal activity history.”
A company spokesperson for Apple said its smart speakers are only triggered to record with the phrase “Hey Siri” and data is protected on its cloud servers through end-to-end encryption and not associated with your Apple ID – but a random identifier.
You can download your own data from big technology companies to see exactly what they collect and store:
- Amazon voice recordings: www.amazon.com/gp/help/customer/display.html?nodeId=201602040
