Warrant doesn't prove ­Amazon Echo is privacy risk

Nicole Black, BridgeTower Media Newswires

Amazon Echo has been around for a few years now. But last month was the first time it was reported that data from one of these devices was sought by the prosecution in a murder investigation.

For those unfamiliar with Echo, it’s a stand-alone voice recognition device that is activated when a particular word is spoken (either “Alexa,” “Echo,” or “Amazon”) by the user. Until the activation word is used, Echo actively “listens” to what’s being said around it, but it is only when the trigger word is used that it begins to record the audio received. That information is then sent to Amazon’s cloud servers for processing so that the device can respond to the inquiry with an appropriate answer. The device stops recording once the question or request has been processed. The verbal inquiries are then transcribed and both the written and, presumably (but this has not been confirmed), audio versions of the request are saved on Amazon’s servers.

In this case, Arkansas investigators are seeking to obtain data from Amazon related to the use of an Echo device that was located in the home where a murder victim was found. The prosecution served a warrant on Amazon in late 2015 and then two others in 2016.  A copy of the most recent warrant can be viewed online here: http://tinyurl.com/hg7abzo.

The prosecution’s various warrants requested all "audio recordings, transcribed records, text records and other data contained on the device” along with information “that the Echo device could have transmitted to (Amazon’s) servers.” According to the most recent search warrant affidavit, the police were able to obtain some information from the Echo device in question, but believe that Amazon’s response to the warrant would provide additional information that would aid in obtaining more information from the device itself and that information being stored on Amazon’s servers could prove relevant to the murder investigation.

Thus far, Amazon has not yet complied with the search warrants. Its official response has been that, as a matter of course, it will refuse to release customer information in the absence of a valid and binding legal demand properly served on and that it must not be either overbroad or otherwise inappropriate.

Much to do has been made about this warrant by journalists and pundits, with many opining that this case is proof in fact of the privacy implications presented by having such a device in one’s home or office. I would suggest that those making that claim don’t necessarily understand how the device works. Because it is designed to record and store data received only after the “wake” word is used, in the context of this case, it’s really no different than an Internet search engine such as Google (used in its default setting, where searches are stored).

The requests you make to Echo are much like search inquiries. The fact that Echo is actively “listening” does not make it inherently more invasive, since nothing is recorded until the trigger word is used, which then causes the device to record your input. That input is arguably similar to a search entered into Google, Westlaw or Lexis. Once you provide information to any of those services with the goal of obtaining a result, those third-party providers store your request on their servers.
That data is then subject to any lawful requests from law enforcement authorities and those companies must then respond to warrant requests on a case-by-case basis, just as Amazon did here.

Certainly the Echo is a new and different type of technology and, as is the case with any new technology, it may present problematic issues in some contexts. But that does not mean that the Echo is necessarily invasive and problematic simply by virtue of its uniqueness, and the search warrant issued in this case is certainly not evidence of that claim. In the context of this case, the nature of the underlying data being sought is not unusual and any attempt to use this warrant request as a reason to condemn this technology on privacy grounds is unfounded and is yet one more example of a knee jerk reaction to technology.

—————

Nicole Black is a director at MyCase.com, a cloud-based law practice management platform. She is also of counsel to Fiandach & Fiandach in Rochester and is a GigaOM Pro analyst. She is the author of the ABA book “Cloud Computing for Lawyers,” coauthors the ABA book “Social Media for Law­yers: the Next Frontier,” and co-authors “Criminal Law in New York,” a West-Thomson treatise. She speaks regularly at conferences regarding the intersection of law and technology. She publishes three legal blogs and can be reached at niki@mycase.com.