Now this obviously doesn't rule out the device saving stuff locally, but plenty of people have verified that it does generally only send lots of data to the server when you have just asked it to wake up.
Not saying that they do though since if they were discovered to be doing that, it's way too damaging for Amazon's reputation for it to be worth going through the trouble.
For example, you could root the device and disable the encryption.
Or, you could perform experiments in a controlled setting where you play a series of identical recordings to Alexa and measure the statistical similarity in the outgoing data for each. The encryption scheme probably provides more entropy than just the audio, so maybe statistical analysis wouldn't help, but it's a start.
To which someone once replied to me: "But what if they aren't sending traffic through your network? What if they are using 4G or something like that?"
To which I replied that while I have not personally done it. You could scan using software defined radio to detect that sort of thing. And if it was doing that someone would notice. Plus if you tore down the hardware they would notice the antenna.
To which they replied "what it it uses something you can't detect with that?"
To which I walked away because I didn't feel like explaining how physics works.
1. Listen all the time
2. Use a small neural network on the device to detect when a voice is present
3. Collect this data into one zip file, then send the file when the user says "Alexa", or anything remotely close.
They could even put a size limit on the data upload to reduce the variance to prevent you from ever testing whether they do this.
Or, they could simply transcribe the audio on the device and upload the text. Any audio they are unsure of could be uploaded to the server to be handled by a beefier neural network.
I would be very surprised if they aren't doing something like this. The power of analysing which products you talk about in your home more often, what kind of stuff you consume, what affairs do you discuss at home, etc, is too good to pass up. And seriously frightening.
However, with that said, unless they do certificate pinning on their device the answer to that is to MITM the device and snoop on the traffic.
If they do certificate pinning the answer is:
1. Pre-record an Alexa commend
2. Play back the recording
3. Wait a minute
4. Replay the command
5. Measure the size of the packets going across the network
6. Wait a week while playing something that sounds like natural conversation - say an audio book
7. Replay the command audio file
8. Measure the amount size of data sent between the end of the second command and the end of the last
It should be slightly more than the second command was to account for things like checking for updates. But if it includes the TTS (which is essentially an audio book transcribed at this point) than it would be quite a bit larger even with text compression.
As someone else mentioned, they could of course record constantly, then compress and transmit in batches, and that would probably go unnoticed.
Possibly, but it can be fingerprinted by using known audio samples and intentionally producing very large amounts of data. See my other reply.
I wonder, how on earth do you know that, that you are able to dismiss it with such confidence as a non-issue. That's the problem with proprietary systems (proprietary always-on microphones at that). I would be surprised if they weren't actually listening and analysing and storing data from the microphone feed at all times.