In a November, 2015 morning in Bentonville, Arkansas, first responders discovered a corpse floating in a hot tub. The home’s resident, James Andrew Bates, told authorities he’d found the body of Victor Collins dead that morning. He’d gone to bed at 1 AM, while Collins and another friend stayed up drinking.
This past December, The Information reported that authorities had subpoenaed Amazon over the case. The police were considering Bates a suspect in what they suspected was a murder after signs of a struggle were found at the scene. They hoped his Echo might hold some insights into what happened the night before.
While Amazon’s fight has been rendered moot, this case lays groundwork for some tough and important conversations to come, raising a slew of fascinating questions around the technologies. What do devices like the Echo or Google Home actually record and save? Have we, as consumers, effectively surrendered a reasonable right to privacy from corporations and the government by bringing such devices into our home?
“It’s like this perfect test case,” says Andrew Ferguson, a professor of law at the University of the District of Columbia. “Alexa is only one of the smart devices in that guy’s house. I don’t know if all of them were on or recording, but if you were going to set up a hypothetical situation to decide if the internet of things could be used as an investigative tool, you’ve got this mysterious hot tub murder.”
A reasonable expectation of privacy
The question of how much privacy we can reasonably expect when installing a home assistant is complex and unresolved. In a sense, people who buy an Echo or Home know what they’re getting themselves into from the very basic fact that they’ve purchased an internet-connected device, with built-in microphones, that is designed (in some sense) to always be listening — and it’s created by companies that thrive on tailoring ads based on the boatloads of data they collect from users.
Still, constant recording and storage is another question entirely. Home assistants are designed to have an ear open at all times, monitoring their surroundings for keywords like “Alexa,” “Google” or “Siri.” But once a user consents by introducing such a device into their home, are its manufacturers bound by law to only record and store the information their products were designed to act upon? Or has the consumer effectively waived those rights?
“As a legal matter, it’s unresolved, which is part of what worries us about the whole thing,” ACLU senior analyst Jay Stanley tells TechCrunch. “I think most people don’t expect that snippets of their conversation might accidentally get picked up. [Smart assistants] do hear trigger words when trigger words are not intended.”
Even with the best of intentions, such devices leave open the possibility of collecting unintended information, courtesy of advanced recording technologies capable of firing up from across the room. Stanley covered the topic recently in an article penned for the ACLU that was inspired when he encountered an Echo at a friend’s dinner party.
“The group’s conversation became self-conscious as we began joking about the Echo listening in. Joking or not, in short order, our host walked over and unplugged it,” he writes. “It is exactly this kind of self-consciousness and chilling effects that surveillance — or even the most remote threat of surveillance — casts over otherwise freewheeling private conversations, and is the reason people need ironclad assurance that their devices will not — cannot — betray them.”
It’s a familiar feeling, surely, to anyone who’s ever covered a webcam with electrical tape for fear of snooping.
“I would push back against a legal argument that said categorically that users don’t have a reasonable expectation for privacy when they’ve installed one of these devices in their home,“ says Electronic Frontier Foundation Senior Staff Attorney and Civil Liberties Director David Greene. “You are trusting that third-party to assert your rights, to notify you when your information is being sought. To me those things are independent of your reasonable expectation of privacy.”
There also seems to be some lingering legal questions regarding disclosure. It’s not entirely clear whether companies are legally bound to notify users about the manner of information they gather or how they ultimately act upon it. Some will touch upon the idea in publicly available privacy policies (which, like TOS and EULA, are rarely given a second thought by most users), but while welcome, don’t seem to be a legal obligation.
“It’s pretty much the Wild West,” explains Stanley. “I can’t think of any legal requirements that would [force them to disclose what they’re recording]. It’s caveat emptor, let the buyer beware.”