Avast_Blog_Privacy: Here's what your Amazon Echo knows about you

[harlan4096]

How thoroughly do you want Amazon inside your home?

Whether you’re a parent, a busy professional, a person working three jobs — or all three — the appeal of a digital assistant is obvious. Used efficiently, the promise is that your Siri or Google or Alexa can not only make your shopping lists, but do your shopping for you. You can make calls, look at recipes hands-free, send messages, set alarms. The possibilities, in theory, are endless.

But as someone with a partner who gets very into every new tech toy, I can tell you that the reality of a digital assistant just isn’t there yet, at least for most of us. We’ve had all three of the big ones over the years, in various devices, and the most use I personally found for them was telling them turn our smart lights and Nest thermostat on and off. Maybe I’m too much of a control freak or maybe I just don’t feel like taking the time to learn a new gadget — or maybe the tech isn’t there yet — but I’ve just never found a digital assistant that provides much of an assist. 

Despite their current limited utility, however, Big Tech seems pretty committed to these assistants. So I wanted to take a look at one — Alexa — and her “presence” in Amazon Echo devices. 

Amazon Echo is Amazon’s play for the home smart device/assistant market. They have a bunch of different devices, from smart speakers to displays to tablets to smart glasses (yes, really) and more. In addition to whatever their device-specific purpose is, they also connect Amazon users to Alexa, who connects to Amazon. 

I did a quick survey around my apartment and it looks like we don’t currently have any Amazon Echo devices, although we do have Sonos smart speakers — which come with Alexa integration. (We turned it off.) So, in this case, the “me” in What Does The Internet Know About Me? isn’t me but maybe you. Or your mom. Or whomever is going all-in on Amazon products. 

What Amazon Echo tracks

First things first: Amazon Echo says it’s not recording and storing all of your conversations. It’s designed to respond to its “wake” word, which is usually Alexa, but you can change it to whatever you want. Once it’s alerted to its wake word being spoken, it starts recording from that point, but also includes about three second before the word was spoken. The only time it is supposed to record and send data back to the Amazon cloud is when that trigger word is spoken. 

For US customers, the Amazon Echo knows “all information related to your use of Alexa and Alexa Enabled Products, including your voice and other inputs, responses provided to you through Alexa, information [they] receive in connection with Third Party Services and Auxiliary Products you use, and information and content you provide or receive through the Alexa App.” In the UK, they know your voice and they “may” back up certain info to the cloud, including “account settings, notes, email and wireless configurations, bookmarks, search history, communications, and call history.” And for the rest of Europe, Amazon has country-by-country rules. 

What does Amazon Echo do with my data?

Amazon uses their data for all of the reasons most companies use data: to provide services and products; to help improve their products; to give recommendations and personalized service; to communicate with customers; to “provide voice, image, and camera service;” to “comply with legal obligations;” to prevent fraud and credit risks — and for advertising.

The Amazon Privacy Policy states that they’re “not in the business of selling” customers’ personal information. But it also says that their “services” might include third-party advertising and links to other websites and apps and that “third-party advertising partners may collect information about you when you interact with their content, advertising, and services.”

Amazon also gives users the option to review and delete recordings one-by-one or by date range. There’s also an option to set it up to verbally ask Alexa to delete your recordings. 

What am I getting in exchange for my data? What are the tradeoffs?

An Alexa user is getting the convenience of a voice assistant, which can be fun and useful. But they’re also tapping into Amazon’s vast data collection project, which includes information from services ranging from Prime to Prime TV to Kindle to AWS to… You get the idea. The point is that Amazon has a lot of information on the average person in the United States and Europe (as well as elsewhere, but those are its primary markets) already. Choosing to use any Alexa-enabled device means adding more data to their database. That’s especially interesting when you consider what’s not included in the Amazon Privacy Policy: Data aggregation. 

“Privacy policies are specifically designed to withstand legal battering and provide legal cover,” Avast Senior Global Threat Communications Manager Christopher Budd says. “So if something is specifically not mentioned in there, then that means that they essentially have carte blanche to do with it whatever they want. They haven’t said what they’re going to do with it — but they haven’t said what they aren’t going to do with it.”

In other words: Keep an eye on what they’re not saying. And I think there’s enough research out there already to know that Amazon loves data aggregation — and we don’t know what they might ultimately do with their datasets. 

Finally, there are already recorded cases of Alexa data being accessed by law enforcement and used in legal cases. While some companies — like Apple, for example — have resisted law enforcement requests, Amazon has been more cooperative. 

“If there is data and it’s being stored and especially if the data is being stored on another company’s systems, at some point some law enforcement or an intelligence agency is going to try to lay hands on it,” Budd says. “So until the case law is really sorted out, you don’t know if that data could be scooped up. If you are a risk-averse person — like I am in some ways — the best move is to just not play the game.” 

The conclusion for this one, then, is actually a question: What’s your level of comfort with Amazon? How much of your data do you feel comfortable with them having? And how thoroughly do you want them inside your home? Those aren’t questions I can answer for you — but they’re ones we should all be asking.
...

Continue Reading