Tagged: criminal investigation

Amazon Echo and Privacy Issues: What You Can Say Can Be Used Against You

WRITTEN BY: Anjelica Cappellino, Esq. & Prof. John Meringolo, Esq.

The Amazon Echo, a “smart speaker” device responsive to voice commands, was one of Amazon’s best selling products this holiday season. With millions sold worldwide, the Echo, and other similar “smart home” products, are becoming mainstays in any tech-savvy home. But while the Echo has many uses – it streams music, reads audio books, tells the weather forecast, and syncs to nearly any other electronic device you can think of – it is also potentially causing serious privacy concerns. Strangely enough, a murder case in Arkansas, to which the Echo may have been a “witness,” is bringing the issue of “smart” devices and privacy to the forefront of criminal and constitutional law.

In 2016, the body of Victor Collins was found floating in a hot tub at a friend’s home in Arkansas. The friend, James Andrew Bates, was charged with murder. An Echo device was found on Bates’ property, and prosecutors requested the court to compel Amazon to provide data from the Echo that may reveal more information about the events that led up to Collins’ murder. In August 2016, the judge signed a search warrant requesting all “audio recordings, transcribed records, text records and other data” on Bates’ Echo, however Amazon has yet to fully comply. An Amazon spokesperson released a statement that the company “will not release customer information without a valid and binding legal demand,” and it objected to “overbroad or otherwise inappropriate demands as a matter of course.”

Whether Amazon produces the requested data might have far-reaching implications regarding the privacy of the millions of people that use the Echo. As a case of first impression, the issues surrounding this criminal prosecution will set precedent for how future criminal matters will handle the discovery and admissibility of such information.


What Can the Echo Uncover?

The Amazon Echo offers a wide variety of functions by voice command. Responding to the name “Alexa,” the user can ask the device simple questions (such as the weather report) or more involved queries (such as recipe instructions). Once the Echo hears “Alexa” (or another activation phrase set up by the user), it begins to record. The user’s commands or questions are then sent to Amazon’s cloud servers, where the recorded snippet is run through a speech-recognition neural network. At that point, a response to the user’s command or query is sent back through the Echo. Amazon keeps all of the recordings of the user’s questions and commands. However, audio is only saved after the keyword – usually “Alexa” – is spoken and triggers the recording device. Users can elect to delete their old voice recordings on Amazon’s website or through the Echo app on their phone. In addition, the Echo has a “hard mute,” which physically disconnects the microphone, making it impossible to record audio.

Amazon does not have a stated policy about how long it holds onto such data. The Echo itself does not have large hard drive space, so only very little information is stored on the actual device. Therefore, the only means of obtaining any pertinent data from the device is through Amazon and its cloud storage.


Constitutional Implications

There are many constitutional implications of such a device being used against a person in a court of law – the first and foremost concern being one’s reasonable expectation of privacy in his home. As most citizens are aware, the Fourth Amendment protects against unreasonable searches and seizures. But what constitutes unreasonable in the case of electronic devices in the home? A search is considered reasonable if the government obtains a valid search warrant and demonstrates probable cause that the search is sufficiently particular. This showing is beyond a mere suspicion and must be based on reasonable grounds. As we have seen in the past decade or so, search warrants for cell phones and social media accounts (i.e., Facebook, Twitter, and Instagram) have composed a large portion of search warrant requests. Some proponents of releasing the Echo’s data would argue that the device is no different than the other electronic devices and applications that have come before it. However, it is important to note that unlike a cell phone or Facebook account, the Echo’s main purpose is not to communicate with others. Rather, it is more autonomous, focusing only on the user’s own commands, queries, and personal home activities. While search warrants usually request cell phone records and Facebook information to ascertain a person’s communications with others, the Echo device is a record of the owner’s communications with himself. To argue a sufficiently particular reason why the Echo would contain incriminating evidence against another is essentially saying opening the door for the discovery of any other form of home monitoring.

If the Echo can solve a murder, many would argue Amazon’s release of such information would be a noble cause. And if the courts can narrow the application of such search warrants so that they are sufficiently particular to the information sought (i.e., a recording of the suspect and victim), then even better. However, the multitude of the Echo’s uses can lead down a slippery slope beyond murder investigation, resulting in unreasonable invasions of privacy. Depending upon one’s tech savvy, some Echo devices are used to regulate nearly every function of the home. For example, the Echo integrates with a variety of other home automation smart devices, which enables the user to control a range of utilities in the home such as lighting, security systems, and electricity. If the Echo is connected to these devices, it can contain vast information that may be used in the prosecution of crimes. Incidentally, in the Bates’ case, information obtained from his “smart meter” showed that he used “excessive amount of water” during the time of the victim’s death. But such circumstantial evidence need not be used only in murder investigations. Potentially, with such information readily available and streamlined to one’s device, an Echo can just as easily expose its owner for far lesser offenses such as meter tampering and illegal cable rigging, just to name a few. Could it get to a point where Echos are routinely sought in civil proceedings as well?

The technological advancements we have witnessed in the past decade alone are astonishing. And understandably so, such innovations may need to be considered for evidentiary purposes in a court of law. Whatever Amazon chooses to do with the Echo’s data will be just the beginning. It is incumbent upon the courts to ensure that production of information is narrowly applied to fit the particular circumstances of the case. Otherwise, the threat of unreasonably invading one’s privacy in the home will become imminent.

Reminder: Event – Global Cybercrime Threat – Domestic to Int’l Cyber Investigation

Please join the Criminal Justice Institute, Criminal Justice Society, and Technology Encryption & Cyber Law Society on Wednesday, September 28 at 4:00 – 6:00 PM in Room OG-01 (Ottinger Building, Ground Level) for an event titled The Global Cybercrime Threat: And How One Successful Criminal Prosecution Brought Few International Cybercriminals to Justice. Come and engage with John Bandler, Esq., Pace Law Class of 2002 alumni, as he discusses a “groundbreaking investigation that started with a report of credit card fraud and eventually uncovered the global cybercrime industry with participants from New York and California to Ukraine and Russia.”

See the details of the event here.

Event: Global Cybercrime Threat – Domestic to International Cyber Investigation

Please join the Criminal Justice Institute, Criminal Justice Society, and Technology Encryption & Cyber Law Society on Wednesday, September 28 at 4:00 – 6:00 PM in Room OG-01 (Ottinger Building, Ground Level) for an event titled The Global Cybercrime Threat: And How One Successful Criminal Prosecution Brought Few International Cybercriminals to Justice. Come and engage with John Bandler, Esq., Pace Law Class of 2002 alumni, as he discusses a “groundbreaking investigation that started with a report of credit card fraud and eventually uncovered the global cybercrime industry with participants from New York and California to Ukraine and Russia.”

See the details of the event here.