Imagine getting a call from a coworker. They say that they just got an audio recording of a private conversation in your house sent to their phone, without your knowledge. The culprit isn’t a hacker, but Amazon’s home assistant device, Alexa.
This is exactly what just happened to a husband and wife from Portland, according to reporting from local news outlet KIRO 7, not to mention Amazon admitted to the outlet that the company had erred. One of the husband’s employees, based in Seattle, called the family and alerted them that he had been receiving audio files of conversations between the couple.
"At first, my husband was, like, 'no you didn't!'” the wife told KIRO 7. “And the [husband’s employee] said 'You sat there talking about hardwood floors.' And we said, 'oh gosh, you really did hear us.'"
Amazon admitted to the family that there was a vulnerability in Alexa’s software that “guessed” what the family was saying, and it sent their conversation to the husband’s coworker without informing them.
The family claims that they immediately unplugged all of their Alexa devices, and they don’t plan on using then again. Amazon reportedly declined the family's request for a refund.
An Amazon representative said in an email to The Outline that the problem was caused by Alexa misinterpreting a series of words that eventually directed it to send several audio messages:
“Echo woke up due to a word in background conversation sounding like 'Alexa.' Then, the subsequent conversation was heard as a “send message” request. At which point, Alexa said out loud 'To whom?' At which point, the background conversation was interpreted as a name in the customers contact list. Alexa then asked out loud, '[contact name], right?' Alexa then interpreted background conversation as 'right.' As unlikely as this string of events is, we are evaluating options to make this case even less likely.”
In a statement to KIRO 7, an Amazon spokesperson said, “Amazon takes privacy very seriously. We investigated what happened and determined this was an extremely rare occurrence. We are taking steps to avoid this from happening in the future.”
An “extremely rare occurrence” isn’t exactly equivalent to an isolated incident. But at this point, it’s not clear exactly how many Alexas have this vulnerability, or when else this might have happened.
In April, security firm Checkmarx discovered a vulnerability in Alexa’s “Reprompt” function. Ideally, when the device doesn’t understand a person properly, Alexa is supposed to ask the user if it can continue listening. But it’s possible to rewrite Alexa’s programming so that Alexa doesn’t have to ask permission. This would allow it to listen – theoretically – indefinitely.
Alexa works by listening to its environment ceaselessly. Once a person uses an activating word, like “Alexa,” the device streams your voice to a server, and Alexa figures out how to respond to your request. All of this information is stored under your Amazon account, and users have to manually delete this information if they don’t want it stored indefinitely.
Amazon claims that background sound isn’t sent to company servers and stored there. However, the company filed a patent earlier this year that would enable its smart devices to save that information in order to improve “the ability of the service.”
Compared to other issues involving privacy and data protection, it’s relatively easy to understand the risk of sharing spoken conversations. The notion of a device literally listening to and sharing your words is much more tangible than grasping the implications of, say, giving a third-party app access to your Facebook account. It’s also a classic Orwellian vision of what a surveilled society looks like. It’s emotionally distressing in a very obvious way.
This at least part of the reason people are convinced that Facebook is listening to them through their microphone and selling that data to advertisers. Certain parties, including U.S. Congresspeople, remain convinced that Facebook is listening despite Facebook’s strident denials and insistence that the only time Facebook and the apps it owns, like Instagram, only use the microphone when the user starts a recording. But there isn’t any public, concrete evidence yet to substantiate the long-term lawsuit from startup Six4Three, which has been alleging for years that Facebook collects audio data, metadata, photos, and text messages on Androids without user permission.
Regardless, Amazon’s violation of its user’s privacy, however unintentional, indicates there may be clear disconnects between what a company’s tech is capable of, what it actually does, what the company knows it does, and what the users know it does. Companies like Amazon are filing patents to own and use even more information about their users, yet there still aren’t enough protections to protect the information it already has.
Update 5/24/2018 5:25 PM: This article has been updated to include a statement from Amazon.
