I still don't understand why this is possible.
I've frequently seen the claim that an Echo only records brief snippets, looking for the wake word.
If that's so, there's next to nothing for Amazon to hand over.
I've frequently seen the claim that an Echo only records brief snippets, looking for the wake word.
If that's so, there's next to nothing for Amazon to hand over.
You can monitor Echo itself over your network and quickly realize that it’s not sending a constant stream of voice data. For the most part the device is off until it hears its name.
Amazon winning DoD cloud business is actually the smartest thing the US government could do to align interests.
If the government show up with a valid court order, generally they can do what the hell they want? That's how justice works in a democracy?
It's not a legal stretch to extend CALEA wiretaps to IoT devices. And if the device manufacturer cooperates (in the same way ATT does), then the hurdles shrink drastically.
A) Giving the government access to communications that provider already has legal access to.
B) Collecting additional data from inside homes by exploiting current legal access to the software?
No.
If I hosted 10 billion dollars worth of unrelated business functionality, then told you to provide me with access for widespread surveillance purposes in an unrelated vertical of your business, you would think that is justifiable?
I beg your pardon, but what color is the sky where you are? Business doesn't work that way. Neither does ethics or morality.
Profit does not whitewash societal harm. It may create other business opportunities to remedy negative externalities, but there is no guarantee that the nature of the harm inflicted has a profitable capitalism compatible remediation.
This is one of those cases.
The "government wants to listen to every Echo user" idea is paranoid fantasy.
The "government would really like to listen to these individuals, but doesn't want to go through full court proceedings" is less fanciful and not without precedent.
It's not just profit. It's the morass of backroom bargains to stave off regulation, honest desire to "do good", future contracts, and political goodwill.
There's a rich history of US technology companies enabling the government / military for all of the above reasons.
It's the same reason you should try and bite the person attacking you and scratch the hell out of them.
I used to do telcom work for a machine shop. Part of my job was doing two 911 test calls every week (with and without an extra 9 for an outside line).
Now, on my cell phone in the Alexa app, this text is present, regardless of anything else. Amazon also has this data. They absolutely have every command/request sent to them, even if the request was not understood/processed.
Seems like a pretty good use for a voice-activated service.
"Alexa, lock the doors!" also sounds useful in this context.
"Alexa, unlock the door, command override Janeway alpha-two-phi."
[1] https://www.ifixit.com/Teardown/Amazon+Echo+Dot+Teardown/613... [2] https://soundandpicture.com/2011/06/audio-memory-cards-how-m...
Also, if we're going conspiracy mode: we're all surrounded by devices with very good microphones that are always on, primarily our phones.
99.9% of HN readers are just too boring (read: not terrorists or foreign officials) to have to worry about it.
No, you can't. The SSL certs are pinned.
You can determine the metadata and quantity of data transferred, but not the contents.
On the other hand, it's widely documented that Amazon stores recordings on their servers every time the watch word activates. And Amazon provides users an easy interface to listen to those recordings.
Right. And it doesn't look like that happened. This is some sort of fishing expedition based on the premise that Amazon gets more than just wake-word activated data.
What indication of that is there? My original comments were listing scenarios in which the wake word might have activated.
>based on the premise that Amazon gets more than just wake-word activated data.
I don't see that at all. It seems to me the police are saying "there's a chance the wake word activated, let's check, and if so, get those recordings".
And what indication do you have that it has happened?
> I don't see that at all. It seems to me the police are saying "there's a chance the wake word activated, let's check, and if so, get those recordings".
Well, no.
> "The court directs Amazon.com to produce forthwith to the court any recordings made by an Echo smart speaker with Alexa voice command capability, FCC ID number ZWJ-0823, from the period of January 27, 2017 to January 29, 2017, as well as any information identifying cellular devices that were paired to that smart speaker during that time period."
The key information for the police would probably be the device-pairings. It'd be more likely to occur and more helpful in proving the suspect was on-site at the time they're alleging.
My allegations are based on police misunderstanding how the device works.
> Prosecutors believe there are Echo recordings capturing the attack on Sullivan and removal of her body that could be found on the server maintained by Amazon.
... They believe the Echo recorded the entire attack, and then continued recording whilst the body was removed. That's a fair while for the Echo to continue recording after a wake word, especially one that is unlikely to be clear. Especially when, as far as I know, the Echo times out after 10 seconds when not given a valid command.
Of course, if you could install a custom cert on the device, you could just MiTM the connection and see exactly what is sent...
Now, if the device were to get compromised, it would be an entirely different story (and this is why I don't have one, despite trusting Amazon in that regard).
Amazon isn't stupid. They know that if a back-door is found in these devices, or if they have bugs that allow them to be compromised, that they are toast in the market. I'd be surprised if they didn't have internal briefs and a bunch of planning on many scenarios like this.
Amazon has almost certainly made the most secure device it can, knowing it will be under intense scrutiny, and will have prepped its legal teams appropriately.