We look at some very different approaches to privacy and what the law can do
There’s no stopping the smart home. The UK government has put its weight behind smart meters. Tech giants Amazon and Google are at war over smart control of our gadgets. Apple may be behind, but its HomePod smart speaker is due out this year.
Many of us are worried about packing our homes full of eyes and ears, even if it means we can turn the heating on and dim the lights without leaving the sofa. A 2017 survey by MoneySavingExpert suggested 76% of us are “fearful” of smart home gear, with unauthorised data collection the most-cited issue.
Some of this fear is intuitive. Google Home and Amazon Alexa are useful, but we all know they are made by corporations built on money, not benevolence.
There are already several examples of smart home tech going too far as well, feeding this fear. So just how worried should we be?
Are smart home gadgets always listening?
In 2015, the spotlight fell on Samsung and its TVs. The Daily Beast dug into the privacy policy of the Samsung SmartTV platform, and found its wording on the issue of voice recording worryingly vague, even ominous:
“Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party.”
This story was picked up by a large number of publications including the BBC and The Guardian, some portraying the TVs as brazen surveillance devices. Read Samsung’s SmartTV privacy policy today and you’ll see the same sentiment, but explained with better clarity.
Samsung uses a third-party company, Nuance Communications, to handle its voice transcription and claims recordings occur “only when you make a specific search request”. And while Samsung says it uses voice recordings to “evaluate and improve the [voice recognition] features,” there’s no mention of the data being sold to online retailers or being shipped off to your local government thought police to scan for evidence of future crimes.
This example is telling, though. Officially, any Samsung TV owner had already agreed to the way Samsung treated their data. Almost no-one reads privacy policies or T&C documents, and if The Daily Beast’s Shane Harris hadn’t, this would likely never have been a story.
The problem with Google Home Mini
Breaches and mistakes happen, though. The most important recent example is the Google Home Mini. This is Google’s equivalent to the Amazon Echo Dot, a low-cost digital assistant speaker likely to be many people’s first experience of smart home equipment.
Android Police’s Artem Russakovskii was among the early waves of journalists to try out the new speaker, and found it started recording 24/7, rather than after tapping the top of the device or saying the “Ok Google” command. This is the smart home nightmare, a lifestyle device turned into a surveillance machine. But it was a mistake, a bug.
Google’s reaction was so aggressive that it has actually knocked key features out of the Google Home Mini. You can no longer use a tap to activate the speaker, suggesting the capacitive sensor on some of the units had gone haywire.
Google cares about consumer trust, even if it did drop its “don’t be evil” mantra back in 2015 and lives off your data. But what happens if one of these giants, or perhaps a more opportunistic start-up, starts breaking its own privacy policy?
The law is (sort of) on our side
Albert Gidari, director of privacy at the Stanford Center for Internet and Society, explained to us how the situation would pan out in the US.
“If they do not disclose the functionality, then they will have liability. If the device doesn’t function as intended, but through negligent design or otherwise, it collects data without user knowledge, then the FTC and State Attorneys General, as well as potential class action plaintiff lawyers, likely will respond,” he says.
We have strong criminal laws against unauthorised recording of communications – Albert Gidari
“The question will be whether there is any harm to the users – if the data collected was unknown and unused, and the remedial steps taken promptly upon discovery, it is unlikely a claim will succeed. If this is routine behaviour, the agencies may take action regardless because of the likelihood of it happening again.”
Privacy violations usually mean big fines. “The FTC has broad powers to address unfair or deceptive practice, which is what unapproved collection would be, and we have strong criminal laws against unauthorised recording of communications,” says Gidari.
The EU is also rolling out its updated data protection regulations (GDPR) in 2018, which allow for fines of up to €20million or 4% of a company’s global annual turnover (whichever is greater). The GDPR also allows users to request the information held about them by a company, for free, to be delivered within a month. And the “right to be forgotten” demands that this data can be provably deleted with no remaining backups.
This is a worry for many companies, and has a real impact on the smart home. “I don’t think you will have a robust Internet of Things if you have strict liability for all user data collected,” says Gidari. “but you certainly can look at the context, the type of data, the harm from the loss, and expect a hammer to drop in negligence cases like Equifax.”
Equifax’s servers were breached in 2017, compromising the data for over 100 million Americans (and just under 700,000 Brits). Class action suit costs could rise as high as $70 billion. Of course, the Equifax case is a little different to what we’re concerned with here. It’s a credit score company and any system can be hacked or breached. But the gradual erosion of our privacy, which is both covert and taking place in front of our eyes, is a little different.
“We all should be concerned about policy consequences of home systems,” says Gidari. “When we expose our most private places to what is essentially surveillance technology, we make it easier for others to claim a lower expectation of privacy in the home. We all should be concerned about that.”
“Each new application of technology brings about a reevaluation of the law,” but what is deemed acceptable under law isn’t absolute. It’s a “cycle of innovation and acceptance,” says Gidari, “a sandwich with fear and loathing in the middle.”
Apple and Amazon: Two approaches
Unless you plan to become a privacy activist, your best option is to inform yourself about what your smart home gear is actually doing. And decide whether you want to endorse it with a purchase.
A comparison between Amazon Alexa and Apple’s upcoming HomePod shows two completely different approaches to the smart home versus privacy. With Amazon, you give up a lot.
Recently, a story surfaced that Amazon was considering sending Alexa voice recordings to third parties. These are the clips recorded whenever an Amazon Echo hears the “Alexa” wake word.
It got people worried. An Amazon rep told us plainly “we do not share voice recordings with third-party developers”, but digging into the Alexa terms of service, it does give away the next best thing. “If you use a Third Party Service, we may exchange related information with that service, such as your zip code when you ask for the weather, your custom music stations, or the content of your requests,” it reads.
Trying to look deeper into Alexa’s privacy sends you pinballing through a series of documents
So while Alexa may not share the raw audio recordings of Echo devices with third parties, it will share the transcriptions. Trying to look deeper into Alexa’s privacy sends you pinballing through a series of other privacy documents, as one Amazon department passes the buck to another.
The result is like swimming out from a beach only to find yourself above an ocean trench, a great yawning blackness in which there are almost certainly some things creeping. The final destination is Amazon’s Cookies & Internet Advertising policy: “on Amazon-owned and operated sites and unaffiliated sites, Amazon displays interest-based advertising using information you make available to us.”
Just as we expected, Amazon can more-or-less do what it wants with the transcriptions of your Alexa voice requests, including using them to inform adverts well outside of Amazon. In December 2016 Amazon also announced a couple of new “products” aimed at publishers looking to pinpoint their ads and learn more about their visitors, all informed by the data about you on Amazon’s books.
Amazon Alexa is a great digital assistant in part because it learns more about you as it’s used. However, make no mistake, Amazon is also building a file on you and using that data to make money.
Apple: Making home data anonymous
The Apple approach is different, and this is partly why Google Home and Amazon Alexa have managed to dominate the smart home space. Any learning Siri does is linked to a “random identifier” that can’t be linked to you personally, even by Apple.
When Siri makes suggestions based on your past requests, these are kept on the device. HomePod will also connect to your iPhone’s Siri using end-to-end encryption, again making sure that even Apple can’t access the data. By anonymising your Siri account, Apple makes it far less valuable. And, as privacy lawyer Gidari says, “from a privacy perspective, it is always better to de-identify data.”
Amazon and Google claim to care about privacy while dipping all elements of it bar a thin protective veneer in vats of acid, but Apple makes about as convincing a show as any tech company.
The knock-on effect is Apple HomePod will be more expensive as its data collection can’t currently be used to subsidise cost. And Siri may continue to lag behind Alexa and Home unless its plan to beat the rest with AI rather than data comes good.
How to maximise privacy
For now the most tempting smart home treats really do come with a cost, even if it is one that only adds a little to virtual case files populated every time we type something into a search engine. Quorcira communications analyst Rob Bamforth think there’s plenty we can already do, though.
“It’s not a matter of users being worried, but they should be aware of risks and take deliberate actions to mitigate them rather than not checking, or assuming that things will be ok without any effort,” says Bamforth.
“Whether it’s social media, Wi-Fi routers or smart speakers, you have an account with settings that can be adjusted. Learn to understand how much is being given away when an options is switched from ‘off’ to ‘on’.”
Both Google Home and Amazon Alexa let you see and listen to all the recordings made using smart speakers or your phone’s digital assistant. For Google, the URL is https://myactivity.google.com/myactivity. For Alexa it’s found deep in your Amazon account dashboard.
This is perhaps the best way to check your smart home equipment isn’t recording without your knowledge. My own Google Activity list is jammed full of recordings taken in my pocket. Dozens of the things. It looks like accidentally activating the Google assistant is the new “pocket dial”. These files can be deleted.
While one take on the privacy of the smart home is damning, the Google and Amazon smart home back-ends do appear to have been made with changing legal frameworks in mind.
Google Home also offers an interesting alternative to standard recording and logging of voice recording, one that is predictably not well promoted as it makes its approach much closer to Apple’s.
On the Activity Controls page you can switch off the Voice & Audio Activity feature. In Google’s words: “voice inputs won’t be saved to your Google Account, even if you’re signed in. Instead, they may only be saved using anonymous identifiers.”
This dumbs-down speech recognition and bars the machine learning that claims to make Google Home smarter the more it is used. However, it offers a degree of privacy not available when using Amazon Alexa.
Bamforth also offers a few tips for those worried about the security of smart home recordings. “Use it for things that are unlikely to be risky,” he says. “Play me some jazz” is less problematic than “let my sister know we’re away for a week and don’t need the car back”.
“Consider what might be connected to what. ‘Unlock the garage door’ might have more challenges than ‘turn up the heating’,” he says. Sometimes the old methods work best, though. “Mute the device when not needing to be used,” he suggests, “just like putting a cover over monitor top cameras when you’re not on a video call.”
Google versus the government
Some of the most worrying, and interesting, challenges of smart home privacy are still to be settled, though. Is unapproved data capture, as far as the user is concerned, permissible if the government or the police gives their approval? Should intelligence agencies and law enforcement have access to our recordings?
In late 2016 the Arkansas police issued a warrant for Alexa recordings as part of a murder case, in which victim Victor Collins was found dead in a hot tub. The investigators believed audio relevant to the investigation may have been recorded, sitting on Amazon’s servers.
Amazon denied the request claiming the recordings were covered under first amendment protection. That Amazon didn’t bow instantly to government pressure is good news, although the recordings were eventually released after defendant James Andrew Bates gave consent.
More worrying is the Equipment Interference section of the “Snooper’s Charter”, which passed into UK law in late 2016. This gives provisions for the hacking of devices such as laptops and, feasibly, smart home speakers. This could turn an Amazon Echo from a speaker that only records on hearing a wake word to a ready-made 24/7 listening device.
Tech giants Apple, Facebook, Google, Microsoft, Twitter and Yahoo all criticised the bill for its lax approach to the breaking of encryption. But it didn’t stop the bill passing.
To the best of our knowledge, a Google versus the UK government privacy prize fight is yet to happen. But it’ll be worth watching, nervously, when it does.
