To answer my own question, other outlets have some extra bits of info:

http://www.unionleader.com/news/crime/judge-orders-amazon-to...

The Union-Leader quotes the district attorney's request, which seems to have cognizance of how Echo works:

> On Oct. 30, Senior Assistant Attorney General Geoffrey Ward asked Houran to direct Amazon.com to produce any recordings made between Jan. 27 and Jan. 29, 2017, suggesting evidence of the crime of murder and/or hindering apprehension of prosecution could be found on the device.

> “As part of the normal functioning of an Echo electronic device activated either intentionally or accidentally by ‘wake up words,’ audio recordings are made of the moment when the device is activated,” Ward wrote.

> “Specifically, when the Echo detects a ‘wake up word(s),’ the device begins audio recording through its integrated microphones, including recording the fraction of a second of audio before the ‘wake up word(s),’” Ward continued.

> The motion, which was made in lieu of an application for a search warrant, also asks for information identifying cellular devices that were paired to that smart speaker in that time period.

If there's one thing these kinds of stories have effected in me, it's the knowledge that I should scream "Alexa!" (or maybe Siri/OK Google depending on which room) right before I get murdered in my own home.

What does it even mean to record? Saving to disk? You can’t start recording after hearing a trigger word and somehow get sound from before the trigger word unless you’ve already got it... I imagine a FIFO stream or buffer that only writes to disk if a trigger word is present.

Also, there may be trigger words that cause recordings even if no actions need to be taken...

I sincerely doubt people don't realise that anything after the trigger is sent home, since a "feature" of alexa is that the app let you see each request you made, how alexa answered, and let them know if she got it wrong.

I think it's more a case of "don't care" / "don't realize the risks"

I'd think the absolute vast majority would not have spent any time wondering about that the slightest. And most that do would just assume that the app asked alexa and retrieved a local log.

So much of what is collected today completely hinges on the fact that the public doesn't even grasp the feasibility nor the desirability of keeping track of them.

People perhaps assume all audio is processed locally and/or isn't stored except ephemerally.

I'd imagine there's a default "we store your data for AI training purposes" that would allow them to keep all audio.

> People perhaps assume all audio is processed locally and/or isn't stored except ephemerally.

Is there info on this from Amazon? I'd assume they do what you mention, have the speech recognition in the Alexa and just send up the words, not the entire audio stream.

Interesting implication of that in this case: if the actual audio is gone and you just have the transcription, is that valid as evidence? Or is it something closer to hearsay

It's cloud based. The device recognizes the wake-word offline and starts streaming to the recognition service. You can access a log of recordings through the app, so they are kept at least for a while.

For the tech crowd, most probably. For the average person, I'd wager most think it's magic and the device is doing all of the vocal processing. I'm assuming this just due to how many friends/family I have to explain how their Siri actually works.

A surprisingly large part of the population is completely oblivious to all of this and they don’t care unless the effects are so directly in their faces they can no longer ignore it.

On going into the app to let it know when it gets things wrong: I’d love to have it just listen for a “thank you” for a few seconds after it does whatever it thinks we’ve asked it to do.

I’m too sarcastic and deadpan for that to be an accurate metric for me.

I have several Alexa devices in my house. I don't care. I'm just not that interesting.

> Though I’m sure most users don’t realize that when Alexa does trigger, she sends the audio to the Amazon mothership, which are then stored/analyzed for an indefinite time.

Additionally, Amazon receives several seconds of audio _before_ the trigger word was used

Edit: I can't find a source for this, but IIRC this was part of the initial Echo roll out, and one of the reasons I decided not to purchase. Perhaps Amazon has changed this so now it only listens and sends data after the wakeword.

It does appear to have been updated: "When you use the wake word, the audio stream includes a fraction of a second of audio before the wake word, and closes once your request has been processed."[0]

[0]: https://www.amazon.com/gp/help/customer/display.html?nodeId=...

The recorded hotword is sent to allow more sophisticated hosted models to reject false positives.

> What is it that users don’t realize?

You answered yourself in an exemplary fashion, but I'll state it explicitly (and simply). People don't think about it. I'd like to imagine anyone who realises the implications of owning such a device would refuse to own one, although I know I'm mistaken.

I don't mean that people should know better (although ofc they should), but new technology is all too easily likened to any household appliance nowadays. Alexa is a utility, for better and worse.

It's my opinion that we should very much attempt to educate the non-professional about the realities of these spy-machines, in much the same way we don't teach people about dishwashers.

As for the article: I find it morbidly curious that I could tell Alexa who is murdering me. A benign 1984 for now I suppose.

“the implications of owning such a device would refuse to own one, although I know I'm mistaken.”

You are mistaken. I use my Alexa everyday. I suppose if someone creates a better version that doesn’t phone home, I’ll switch. In the meantime, I really enjoy having this type of device.

By the way, last year I blogged about the need for HN users to constantly complain about Alexa’s privacy.

https://h4labs.wordpress.com/2017/09/27/groundhog-day-amazon...

If you could take that energy and build an open source replacement, that would be more worthwhile.

You are mistaken. The utility of Alexa/Google Home is worth any privacy intrusion for me. I simply don't care. Convince me otherwise.

Though the person is being a slight jerk with the last sentence in this comment, there's no reason to mass-downvote someone just because they don't value their privacy as much as anyone else. The poster is not telling people they should not value privacy, only that the poster does not in exchange for utility.

Even without that last sentence, the comment is not helpful. We’re not told what the user sees as the benefits of Alexa, and we don’t know what he sees as the privacy trade offs. It’s possible he uses Alexa for some lifesaving utility that far outweighs even if Amazon were illegally violating his privacy. Or maybe he’s ignorant tot he specifics of what Echo and Amazon do/don’t collect. And anyone who replies is forced to play the annoying game of read-my-mind/how-dare-you-assume-that’s-what-I-meant.

It is a useful comment in an echo chamber like HN's. And seeing the downvotes it has received, it's double useful.

I think they have been massively downvoted because they were being a jerk, not because they (don't) value their privacy.

That’s interesting. Can you elaborate a bit? Are you not worried because you think the information is not sensitive or do you think the risk of it being abused, lost or stolen is negligible? I’m really curious to know (and while I have a different opinion I think yours is legitimate as well).

All of the above. I don't think it's sensitive and I think the risk is negligible but even if it happened I still think it's worth it. Like I said in my sibling comment I'm against mass-surveillance in general because then you have no choice but here I'm actively deciding to expose myself because I find the utility worth it.

I agree.

We talk about the "identity theft" problem here quite a bit. One time someone wrote about how there is no such thing as identity theft. If someone persuaded a bank to give them money by pretending it was me, the thief didn't steal anything from me. The bank gave the thief money and should try to recover it themselves. I'm not a part of that equation.

I think it is stupid to establish any kind of causality based on the things I search online or the things I do on the computer. The problem isn't that Amazon is recording my activity. The problem is that somehow we allow this to be admissible in a court of law. My shower thoughts don't make me a criminal. I'm innocent until proven guilty. Searching for nitroglycerine or whatever is not the same as the proverbial trout in cow milk that prosecutors claim to be. What's next? Private diaries as evidence that I killed someone?

Edit: spelling

> What's next? Private diaries as evidence that I killed someone?

Well if your diary contains perpetrator's knowledge then obviously yes? Even if not, it may count as circumstantial evidence.

I anal but in my not so humble opinion it can at best establish motive not that I did it.

I've been hearing recently about how the forensic "science" we allow in the court room isn't all that scientific either. I think our law enforcement and our prosecutors are just too lazy. I'd not mind so much if they let criminals free but it seems they will try to frame someone who is plausible and let "science", "evidence", and "experts" do the talking which is not good.

I think we should provide proper incentives for our prosecutors. We clearly can't lean on their moral compass.

What kind of utility do you derive from Alexa/Google Home that is so vital to you?

I'm genuinely curious because your comment made me think I might be entirely missing the point of those devices.

Yes, I agree but for me personally I don't care even if that dystopia happened. It's still worth it for me, again, personally. I'm against mass-surveillance because then it affects everyone, whether you agree on it or not but in this case I'm actively buying this thing and expose myself to it.

>Yes, I agree but for me personally I don't care

That is contradictory.

It is not. The difference is choice. Mass surveillance does not offer you a choice about participating, or ties that choice to some everyday activity. Putting an Echo in your home is a choice.

Choice can be a very weak consolation. Just like how not driving isn't really a viable choice in many regions (although nobody is technically being forced to drive), if choice makes surveillance acceptable, that choice could easily be eroded to the point of being merely a theoretical option. "You want to live without surveillance? Your choice, because we respect that choice so much we have set up special surveillance free zones in Pennsylvania"

What he probably meant to say: "I do care, but only because of others who may need/want privacy."

What will you do if a friend who does care and does not want the privacy intrusion comes over to visit? Do you at least give people the courtesy to inform them and ask their permission to have recordings of their voice sent to a third party service?

If enough of these devices are installed, having every utterance recorded will become a fact of life. You might not care, but when people believe they are being recorded they become less willing to challenge authority. That might be something society is willing to accept, but according to your individualistic view, society will not be asked -- it would only take a minority of people installing these devices to create a world of widespread surveillance, and the majority of people would never have been asked for their consent.

> What will you do if a friend who does care and does not want the privacy intrusion comes over to visit?

If a friend has really idiosyncratic and unusual preferences, they should be good enough to announce those when they visit. Of course a normal host would be willing to unplug their Google Home or Amazon Echo.

Counter argument: It’s not just you. When your privacy is invaded, that data can be used to damage all of us. Just as we saw happen during Brexit and the 2016 US election, where data collected on individuals was used to microtarget propaganda.

See Cory Doctorow on how privacy invasion socializes risk.

https://locusmag.com/2018/07/cory-doctorow-zucks-empire-of-o...

Obviously you weighted the risks/ benefits and made your choice, and that's perfect. The problem with these type of devices is people who are totally oblivious to the workings of it and the implication and that will click "i agree" without even read anything. Personally i prefer control over pseudo-convenience on anything.

Luckily for those of us that do care about privacy, we have HonePod. Not quite as comprehensively creepy as Alexa, but of similar utility and definitely better when it comes to audio quality.

How are they useful? I watch their commercials on TV and frankly I don't understand why I should use one even if all processing would happen inside the device.

Statitstics and non-biased double blind emphereal fictitious studies show that those who don't care about privacy, usually have not fully developed privacy awareness intelligence due to social constrictions nominally developed during the abstraction formance and concretion phase of the multi-hemispherical expansion of the brain. Often, this leads to higher overall social acceptance, integration, and adjustment- with loss of self awareness and self identity,giving over completely to the social hive mind indications and constructs, usually producing characteristics similiar to, but not nearly as developed as, the common bee, with hyponitic driven intelligence and pre-defined scripted actions produced from the social feedback loop of the group. Privacy is then regards as a trivial concept, as the social feedback never identifies individual self actions, rather group activity motions to accomplish group goals, not individual self goals. Integration of personal self into the hive is almost impossible because to be part of the hive one must sacrifice the self and individualism , conversely, the hive cannot exist as a individual only a selfless group of commonality- it cannot bee otherwise.(please forgive the pun)

I don't know why people will happily carry a cell phone (which is a microphone attached to a transmitter, with location tracking to boot) but recoil at an Echo device in their home. Both are equally capable of surveillance, but the phone certainly more so as it's not limited to Wifi (which I could also monitor if I was worried about Echo sending a constant data stream).

Apple lets me select which apps can access to both the microphone and the GPS. Of course you have to trust Apple, though they've made a big thing about privacy, as the biggest public company in the world, I don't think they'd risk lying about that.

Phones are accepted as common carrier devices, even if people don’t completely understand who gets access to the data, they know it’s been decently reviewed and “battle proven”.

The Echo is a completely new device from a company that has very few oversight and regulation, and laws and usages are not really up to date for these use cases.

Are you kidding? A secured cell phone (like a modern iphone) is a hell of a lot harder to turn into a bug than a quasi-smart device that needs the cloud for all its processing

> Do they assume/suspect that Echo/Amazon continuously records and logs audio, akin to a security camera?

Yes, I think random non-technical homicide detectives might very well assume this. They're fishing for anything they can get, even if it's a 1% chance. Almost certainly the subpoena response from Amazon will be that they are not in possession of a recording.

Is there any suggestion that a system is in place to lie openly and hand over a recording privately? Or is that only for national security cases?

If a comment were keeping recordings they weren't allowed to make, and just lied to deny it is there a verification process that could reveal the lie?

> she

It. Alexa is a a device, not a person.

As are ships. But we still often say she.

I think using pronouns reserved for humans on a ship (engineered mass of wood/metal that doesn't spy on you and you can own) is more acceptable than using it on a company (which spies on you, is not something you own, etc).

Good luck lecturing people what to call things...

You must not have been anywhere near the tech community for, oh, the last five years or so... :-)

Alexa is a service, accessed [via an app] through devices. I have it on my phone and on an Amazon FireTV stick.

It's a matter of taste whether to apply a gendered pronoun to an object. Some people refer to their car as she or he.

Clearly from Amazon's pov it's a marketing thing, but I think you'll be aiming against a rather vicious current of you refuse to use gendered pronouns for tech that we interact with in a human manner.

Last time I stayed in an Airbnb rental, I discovered an Amazon Echo device in the room. I immediately unplugged it and then wondered whether the landlord has violated my privacy as a tenant. The consensus on a couple of forums I found discussing it was that the Echo doesn't record anything unless explicitly activated by the user, and so it's not anything like a wiretap. Some landlords were pretty condescending and dismissive of any claims to the contrary. I felt differently. I can't audit the device hardware/firmware/software to verify that it isn't tracking and recording information about me that I don't consent to be tracked or recorded when I'm in my rental unit.

> Do they assume/suspect that Echo/Amazon continuously records and logs audio, akin to a security camera? Or do they have evidence that Echo was actually activated around the time of the murders, or afterwards by the suspect himself?

They're looking for any scrap of information. It could be that someone task Alexa with something that becomes pertinent to determining motive, or opportunity, or even just presence or absence of an individual.

They're not necessarily (or even imaginably) thinking they'll get wiretap or bug type recordings. It's more like getting phone records - who did they call? Then following up those leads.

>Echo is doing far more surreptitious surveillance and analysis, i.e. not just listening for the trigger word

This should be trivial to prove.

It has been demonstrated that it does not send network traffic apart from requests made to it; e.g. it is not continuously streaming data. Of course that could be changed at any time with a software update that you have no choice about accepting. To prove it is not recording locally could be much more difficult, but there are practical questions there. What media is it recording to, and if the recordings are never sent to the cloud, what is the purpose of keeping them?

That does not demonstrate anything. It could "buffer" the data it wants to send and only send it after the trigger word is detected, precisely to trick such naive analysis.

That would result in a much larger payload, and a payload size that is variable depending on how long it has been, and how much audio was record-able between requests. But if instead we observe a small payload of constant size given the same request, regardless of how long between requests, then we can reasonably be assured the device is not doing this.

Or you can be reasonably sure the device is only sending a payload of max size N at a time, padding your requests with some recording data when it can

Any smart tv could be doing the same thing. Why do you think that Amazon in particular is likely to be conducting a massive, secret and illegal surveillance operation?

>Any smart tv could be doing the same thing.

And many have been found to, which kind of proves my point.

>Why do you think that Amazon in particular is likely to be conducting a massive, secret and illegal surveillance operation?

Uhm, because it makes money? Isn't that the answer to any "why" in our current economic system?

Many smart TVs have already been found to spy on you. Which answers your question.

How do we know your laptop is not doing this? Or your phone? Or your TV?

In fact, it seems more likely that your laptop would be doing this give that it probably has far more electronics inside it.

I would hope the researchers were competent enough to space out their explicit uploads with varying periods of noise, while also finding a decent approximation of how much data is uploaded per x seconds of audio.

Sure, Amazon could use all sorts of tricks to attempt to throw off reverse engineering, but it would be pretty hard to do so with a large enough set of tests.