Anybody heard of this story yet?

Quote:Quote:

[Written by Ellen Lampe] BENTONVILLE, Ark. - In the ongoing investigation into an Arkansas man's 2015 murder, smart technology in the suspect's home could prove to be the "smoking gun".

Investigators believe there is a possibility that the suspect's Amazon Echo - a gadget that listens and responds to its owner's commands - could have possibly heard and recorded key details from that pivotal November night.

Police are working with Amazon to get a hold of the stored information and recordings on the suspect's Echo, but not without facing barriers in the process. Amazon did hand over the suspect's account details, but declined to hand over the voice records.

Amazon's 'Terms Of Use' policy states, "...We do not guarantee that Alexa or its functionality or content is accurate, reliable, or complete..."

Bentonville Police have now issued a warrant to Amazon to turn over any records or audio from the Echo belonging to the suspect, who police identify as James Bates.

Bates' attorney, Kimberly Weber, says this is crossing the line when it comes to personal privacy.

"That's information that needs to be private. And to use it, to take an innocent man, and to charge him with this crime... it's an anomaly in and of itself," Weber said. "It's absurd, after 23 years of doing this, I've never seen a case like it."

The details:

Around 9:40 a.m. Sunday, Nov. 22, officers were called to a house in the 3500 block of SW Elm Manor Ave. in Bentonville to investigate a death.

Police said a man by the name of James Bates called 911 to report that another man by the name of Victor Collins was found dead in the hot tub on the back patio of his house.

Collins was pronounced dead at the scene by officers and EMS.

When police interviewed Bates, he told them he lives at the home with his 5-year-old son, but his son was not at home that weekend because he was staying with his mother.

Bates said he had three friends over the night before, Nov. 21, to watch the Razorbacks football game. He named the friends as Victor Collins, Owen McDonald and Sean Henry.

Bates said he and his friends were drinking beer and taking shots of vodka. After the game, Henry left. Bates said he and the two others decided to get in the hot tub on the back patio.

Bates said he, Collins and McDonald drank until about 1 a.m. Sunday morning. Collins and McDonald said they were going to stay at Bates' house because they were arguing with their wives. Bates said he gave them a place to sleep and went to bed.

The next morning, Bates said he was cleaning up from the night before when he opened the back door and saw a male body - who he identified as Collins - laying face down, floating in the hot tub.

Bates said he flipped Collins over, pulled him out of the hot tub and realized he was dead. At that point, he called 911.

Bates said that McDonald was gone from his home by the time he found Collins.

Bates gave authorities permission to search his home, during which they said they found blood and signs of struggle in and around the hot tub. They determined that a physical altercation had taken place, which resulted in Collins' death.

When questioned, Bates and McDonald said they did not know how Collins died. They said they were intoxicated at the time and didn't remember much from the night.

McDonald consented to an examination and medical examiners found no injuries on his body that would indicate involvement in a physical altercation. After McDonald was cleared, police say that's when Bates stopped cooperating with officials.

Bates became the primary suspect in the case. One year later, after meticulous searching in the ongoing investigation, the Amazon Echo could be the keeper of much-needed evidence.

A video for the more auditory-inclined members:






What do ya'll think? Should the state police be able to force Amazon to turn over the voice recordings? It looks like Amazon has already turned over his purchase history and all the personal information in his Amazon account. And it looks like the police already have his "smart water meter" (there is such a thing?) and he used 140 gallons of water between 1 and 3 AM. He must have been prepping for a killer hangover!

I'm not going to explain profound ramifications and importance of privacy.

Having certain devices at home is a bad idea. Nest thermostat, cameras and fire-alarm (all connected to Google), devices that has a microphone built in like that Amazon Echo, some Samsung Smart TVs... All can be hacked, specially if the attacker is a State sponsored. With or without help of the company. They might be getting the data as a mass surveillance (metadata) and who knows have A.I to look for specific patterns and speech recognition to catch something "interesting".

Law and Justice are not the same. We never know how our privacy will end. I could give thousand of examples:

- You live in Muslim country and talked to a friend on Skype about a private party you went. Had some drinks (breaking the law?) and had sex with a girl that's not married (another felony?). Microsoft developed a good speech recognition for translating. Maybe they use to gather conversation transcripts for targeting ads. Or maybe they sell the data for governments for a good amount of money (or being forced by law). Government could ask to automatically flag specific words related to "terrorism" or other illegal stuff, like drinking and having sex out of marriage.

Maybe your government use such capabilities to make sure you're paying all the taxes you "own" them...

Many things we imagined were confirmed thanks to Edward Snowden. He sacrificed a lot.

@joost:

For all the reasons you mentioned above, I will never been purchasing Alexa or Google Home. The companies that run these are deeply embedded with leftists that hate personal freedom and liberty, and our way of life. Worse yet, they actively are involved with often helping the government. Amazon might not have caved this time, but who's to say they won't write some NSA backdoor into a future firmware "upgrade"? Even having a smart phone around you when having a politically incorrect conversation isn't wise. Those in power have every reason to blackmail or extort you if they think it fits their needs.

While you're at it: delete Shazam off your mobile. The microphone in it, which allows it to identify songs you hear while you're out and about, is always on and always listening.

The Internet of Things smart devices trend is the end of privacy as we know it. Even refusing to get these devices yourself won't save you because all your friends and girls will soon have an Amazon Echo/Google Home/whateverthefuck listening and recording every word. Not that phones aren't already doing this.

iPhones are dogshit for privacy but with Android you can check what background services are running. Check what's running and uninstall the service, set it to close automatically with Greenify or block it if you've rooted. This doesn't prevent your acquaintances phones from recording your conversation however.

I've heard some people physically remove their phone microphone and rely on the microphone in their headset for phone calls. Or using a faraday bag. Or keeping a cell phone jammer with them. It's crazy the lengths that you must go to to ensure privacy in this day and age.

Quote:Quote:

What do ya'll think? Should the state police be able to force Amazon to turn over the voice recordings? It looks like Amazon has already turned over his purchase history and all the personal information in his Amazon account. And it looks like the police already have his "smart water meter" (there is such a thing?) and he used 140 gallons of water between 1 and 3 AM. He must have been prepping for a killer hangover!

I do think that they are going to have to hand over the recordings, if any. For whatever reason, people seem to think that there is some kind of 'special exemption' for electronic devices for search warrants or discovery in a trial.

This does not look like a case of the authorities going on a 'fishing expedition' to see what they can find out about someone, the police are trying to determine if a person was murdered, and if so, who did it.

OP, I know you’re not in the US, but we have started to see this at a governmental level, not just private companies.

The PRISM project, started by the NSA is a perfect example of this.

Quote:Wikipedia Wrote:

PRISM is a former secret code name for a program under which the United States National Security Agency (NSA) collects internet communications from at least nine major US internet companies. The program is also known by the SIGAD US-984XN. PRISM collects stored internet communications based on demands made to internet companies such as Google Inc. under Section 702 of the FISA Amendments Act of 2008 to turn over any data that match court-approved search terms. The NSA can use these PRISM requests to target communications that were encrypted when they traveled across the internet backbone, to focus on stored data that telecommunication filtering systems discarded earlier, and to get data that is easier to handle, among other things.
PRISM began in 2007 in the wake of the passage of the Protect America Act under the Bush Administration. The program is operated under the supervision of the U.S. Foreign Intelligence Surveillance Court (FISA Court, or FISC) pursuant to the Foreign Intelligence Surveillance Act (FISA). Its existence was leaked six years later by NSA contractor Edward Snowden, who warned that the extent of mass data collection was far greater than the public knew and included what he characterized as "dangerous" and "criminal" activities. The disclosures were published by The Guardian and The Washington Post on June 6, 2013. Subsequent documents have demonstrated a financial arrangement between NSA's Special Source Operations division (SSO) and PRISM partners in the millions of dollars.

Also, see the TEMPORA project that is in the UK that is even more intrusive than PRISM.

This isn’t anything new, companies have been collecting(and providing the NSA) data from our devices. This is just government testing the limits of what is deemed acceptable in the eyes of the public. The entire operation began just after 9/11 when the government could use the excuse of terrorism to collect and store our data.


If any of you haven’t seen the movie Citizenfour, I highly recommend it. If anybody needs a torrent link, PM me. The movie goes into depth about Edward Snowden and what he discovered when he blew the whistle. It is a truly scary and interesting movie.

I have an Alexa at my place - it's useful for things like setting timers when cooking, converting tablespoons to cups, random stuff like that. And it can be used to control smart devices (lights, thermostats etc) which can be handy also. As homes get smarter I think things will get more integrated and useful.

From the privacy standpoint, I've long since resigned myself to the realities of having a smart phone that is much more dangerous. The smart home devices - Alexa, Google Home etc - are processing the commands using cloud processing, which means they aren't recording everything you say. It would be prohibitive to send every word recorded by every Alexa in the world back to Amazon (or Google etc) for processing and storage. This is why they won't respond until the appropriate "wake word" is detected.

So if this guy was dumb enough to ask "Alexa, how do I fake a drowning?" then he had better hope Amazon won't divulge his Alexa history (and I saw nothing in that article to suggest there's any reasonable suspicion or that this is anything other than a fishing expedition by the police).

As for the broader privacy implications (i.e. the government hacking your Alexa type device to constantly record) my personal feeling is they could already do it with my cell phone which follows me around almost anywhere. If you aren't concerned about the privacy implications of the microphone on your smart phone, you shouldn't be overly concerned with the implications of your Alexa.

Quote: (12-30-2016 05:49 PM)kmhour Wrote:  

The smart home devices - Alexa, Google Home etc - are processing the commands using cloud processing, which means they aren't recording everything you say.

How could you possibly know that? Do you somehow have the source code for the closed-source software these devices run? Do you know how to decrypt the encrypted web traffic they send back to their servers?

No. I'd never dare consider getting a smart home device unless it was completely open-source, and even then I'd be highly wary because if hacked this device could be extremely harmful to your privacy.

Quote:Quote:

It would be prohibitive to send every word recorded by every Alexa in the world back to Amazon (or Google etc) for processing and storage. This is why they won't respond until the appropriate "wake word" is detected.

This is just naive on the costs of voice data these days, as well as how much they can sell this data for (WhatsApp and Facebook Messenger calls aren't free due to being good Samaritans).

Quote:Quote:

As for the broader privacy implications (i.e. the government hacking your Alexa type device to constantly record) my personal feeling is they could already do it with my cell phone which follows me around almost anywhere. If you aren't concerned about the privacy implications of the microphone on your smart phone, you shouldn't be overly concerned with the implications of your Alexa.

You're right about this, phones are still easy to hack by gov due to the closed-source all-access baseband processor.

However Google Home and the like are worse, because these very likely are passively always recording you and they're able to share with the gov a huge backlog of content, whereas you've got to be deemed a target for gov to hack your phone via your baseband processor and they require close proximity to do so with a Stingray. Even then you can get a heads-up if your phone is being hacked in this way with the AIMSICD app.

how could I know it? I don't have to. what mechanism does the device have to do this otherwise? either it's sending an enormous amount of unsolicited data back to home base - which is easily discovered by anyone who cares enough to monitor their home network traffic. or it has enough storage onboard to hold large amounts of recorded audio - which is also easily discovered by any hardware hacker who tears the thing down.

to say nothing of the overhead required to process every moment of every Alexa or Google Home device's recordings in Silicon Valley - or the PR disaster that would ensue if they were - simple logic dictates they can't send all audio recorded back home to be processed without people noticing it. they are definitely passively listening - they need to, in order to recognize the 'wake word'. but what past that?

I don't disagree for a moment that "usage data" will be aggregated and analyzed. the music you play, whether you have an Ecobee or a Nest, Phillips Hue lights, can you infer the amount of electricity used and segment households - that just scratches the surface. and yeah, I made peace with that more than ten years ago when I signed up for a Gmail account.

like I said, it's your prerogative whether you want to move toward a smart home or not. I'm a tech enthusiast and I admit the idea of voice control and integration is worth the risk of something like the first episode of Mr Robot Season 2 (spoiler alert, the general counsel's smart home goes batshit). but in opposition, five or ten years it'll be the same as the guy who swore he wouldn't give up his analog phone for a smart phone.

Quote: (12-30-2016 10:40 PM)kmhour Wrote:  

how could I know it? I don't have to. what mechanism does the device have to do this otherwise? either it's sending an enormous amount of unsolicited data back to home base - which is easily discovered by anyone who cares enough to monitor their home network traffic. or it has enough storage onboard to hold large amounts of recorded audio - which is also easily discovered by any hardware hacker who tears the thing down.

Amazon Echo has 4GB of storage space, so ignoring the size of the software it runs it can hold up to 4000 mins of audio (approximately 1mb = 1 min of audio).

This can then be sent at intervals, so network analysis is not going to be very revealing.

It doesn't even have to record all the data. It could simply 'wake up' on other unknown key words such as "credit cards", "guns" or "fuck the government".

Quote:Quote:

to say nothing of the overhead required to process every moment of every Alexa or Google Home device's recordings in Silicon Valley - or the PR disaster that would ensue if they were - simple logic dictates they can't send all audio recorded back home to be processed without people noticing it. they are definitely passively listening - they need to, in order to recognize the 'wake word'. but what past that?

That's the point, we don't know exactly how much they are listening because their software is closed-source. In this post-Snowden age if they really had good intentions they would open-source it to show that, but for now I refuse to give them the benefit of the doubt after already seeing the depth of the NSA PRISM program for instance, which proves tech behemoths are already all-in on absorbing as much customer data as possible for profit.

Quote:Quote:

like I said, it's your prerogative whether you want to move toward a smart home or not. I'm a tech enthusiast and I admit the idea of voice control and integration is worth the risk of something like the first episode of Mr Robot Season 2 (spoiler alert, the general counsel's smart home goes batshit). but in opposition, five or ten years it'll be the same as the guy who swore he wouldn't give up his analog phone for a smart phone.

Being a tech enthusiast and privacy conscious are not mutually exclusive. Everyone who has created privacy-focused tech are massive tech enthusiasts. The difference is they want to make the tech benefit them, rather than potentially harm them.

It's not as easy as 1-click Amazon checkout but open-source home automation already exists today, for those who value both.

Quote: (12-30-2016 10:59 PM)Valentine Wrote:  

Amazon Echo has 4GB of storage space, so ignoring the size of the software it runs it can hold up to 4000 mins of audio (approximately 1mb = 1 min of audio).

Depending on the quality of the audio, even less that 1mb/min. Could be anywhere from 4 minutes and up... Granted your audio would sound like a wet dog fart though... However it would still be legible.

Understandable audio can be a lot smaller than 1 MB per minute, too (as I see Ivanis mentioned while I was writing this). That's okay-quality MP3 audio for music. I have old audiobooks that are perfectly fine to listen to that are like 180 MB for 12 hours of audio. That's ~256 kilobytes per minute.

There are all kinds of tricks Amazon could use if they wanted to. For instance, they could use transcription software to get text files, which are much, much smaller than audio files, and which also compress well. It's just a question of whether or not they want to risk being caught doing that.

Quote: (12-30-2016 10:59 PM)Valentine Wrote:  

Amazon Echo has 4GB of storage space, so ignoring the size of the software it runs it can hold up to 4000 mins of audio.

This can then be sent at intervals, so network analysis is not going to be very revealing.

It doesn't even have to record all the data. It could simply 'wake up' on other unknown key words such as "credit cards", "guns" or "fuck the government".

eventually the data has to go somewhere. if the device is recording the data and bursting it out, you don't think people are going to notice a sudden and unsolicited 4 GB burst of traffic on their network that originates from their Alexa? or they aren't going to notice a trickle of data over time that has no root in spoken commands (e.g. outgoing data at 4am)? "I just asked Alexa what the weather was and it sent 500 MB of data to Amazon?!?" 4000 minutes sounds like a lot. it's 2.78 days.

I don't disagree that other "key phrases" could be surreptitiously included. "Allah", "or "bomb" and "flight" in close proximity? Absolutely. But that same capability existed years ago with the first smart phones.

Quote:Quote:

That's the point, we don't know exactly how much they are listening because their software is closed-source. In this post-Snowden age if they really had good intentions they would open-source it to show that, but for now I refuse to give them the benefit of the doubt after already seeing the depth of the NSA PRISM program for instance, which proves tech behemoths are already all-in on absorbing as much customer data as possible for profit.

I don't think they're eavesdropping for profit. I absolutely think they're using the usage data for profit - just like every other company in the Valley has for the last decade.

Quote:Quote:

Being a tech enthusiast and privacy conscious are not mutually exclusive. Everyone who has created privacy-focused tech are massive tech enthusiasts. The difference is they want to make the tech benefit them, rather than potentially harm them.

It's not as easy as 1-click Amazon checkout but open-source home automation already exists today, for those who value both.

I'd be curious to hear what you'd suggest. I'd be happy to take the discussion to PM on the specifics - at a certain point the cross-pollination risk starts to grow.

Quote: (12-30-2016 11:46 PM)kmhour Wrote:  

Quote: (12-30-2016 10:59 PM)Valentine Wrote:  

Amazon Echo has 4GB of storage space, so ignoring the size of the software it runs it can hold up to 4000 mins of audio.

This can then be sent at intervals, so network analysis is not going to be very revealing.

It doesn't even have to record all the data. It could simply 'wake up' on other unknown key words such as "credit cards", "guns" or "fuck the government".

eventually the data has to go somewhere. if the device is recording the data and bursting it out, you don't think people are going to notice a sudden and unsolicited 4 GB burst of traffic on their network that originates from their Alexa? or they aren't going to notice a trickle of data over time that has no root in spoken commands (e.g. outgoing data at 4am)? "I just asked Alexa what the weather was and it sent 500 MB of data to Amazon?!?" 4000 minutes sounds like a lot. it's 2.78 days.

I don't disagree that other "key phrases" could be surreptitiously included. "Allah", "or "bomb" and "flight" in close proximity? Absolutely. But that same capability existed years ago with the first smart phones.

As other posters have already mentioned this can use far less data than even I suggested. Even the trickle is not going to appear harmful as these types of devices always seem to run "background updates" to update their search libraries, bug fixes and miscellaneous improvements.

It would never record 24/7, at most only when it hears nearby sound, at least only when it hears your wake up keyword, and at most likely it'll wake up to a variety of keywords.

Quote:Quote:

Quote:Quote:

That's the point, we don't know exactly how much they are listening because their software is closed-source. In this post-Snowden age if they really had good intentions they would open-source it to show that, but for now I refuse to give them the benefit of the doubt after already seeing the depth of the NSA PRISM program for instance, which proves tech behemoths are already all-in on absorbing as much customer data as possible for profit.

I don't think they're eavesdropping for profit. I absolutely think they're using the usage data for profit - just like every other company in the Valley has for the last decade.

Metadata (e.g. usage data) of course, but content also. Google and Yahoo for example have both have spied on user content for the government and I doubt this is pro bono.

Quote:Quote:

Quote:Quote:

Being a tech enthusiast and privacy conscious are not mutually exclusive. Everyone who has created privacy-focused tech are massive tech enthusiasts. The difference is they want to make the tech benefit them, rather than potentially harm them.

It's not as easy as 1-click Amazon checkout but open-source home automation already exists today, for those who value both.

I'd be curious to hear what you'd suggest. I'd be happy to take the discussion to PM on the specifics - at a certain point the cross-pollination risk starts to grow.

I'm happy to share here - after all it's a thread related to home automation.

Hardware
Some good places to start are Raspberry Pi and Arduino communities, as well as CrowdSupply - they have some popular open-hardware such as 1btn, Idiotware Shield and LimeSDR.

Mycroft is an open-source AI. All depends what exactly you want your house to do - then just use a search engine to find something for your needs.

Software
There are also tons of open-source dashboards to manage your IoT e.g. Freeboard and Thinger.

For connecting to a multitude of platforms you can use Huginn, or closed-source IFTTT and Zapier which support a huge variety of backends.