Smart speakers: Companions may be informants

John J. Carney
BridgeTower Media Newswires

Each of us uses three to four smart devices connected to the Internet—often a smartphone, tablet, wearable fitness tracker, and a smart speaker.

The smart speaker is my focus. By its location in the user’s home or office it can record personal, even intimate, information about our digital lives. And because it is powered by artificial intelligence software and often connected to many of our online accounts containing personal, health, and financial information it may discern the context of our spoken word.

Electronic evidence from smart speakers has yet to have a measurable impact in adjudicating criminal or civil cases in the U.S. But with over 150 million smart speakers out there and Amazon Alexa with 70% market share that day is coming soon. The Atlantic opined in “Alexa, How Will You Change Us?” in November of 2018:

“Within our lifetimes, these devices will likely become much more adroit conversationalists. By the time they do, they will have fully insinuated themselves into our lives. With their perfect cloud-based memories, they will be omniscient; with their occupation of our most intimate spaces, they’ll be omnipresent. And with their eerie ability to elicit confessions, they could acquire a remarkable power over our emotional lives.”

Search warrants for smart speakers

Evidence from smart speakers is often sought by law enforcement to identify suspects. Detectives are increasingly using search warrants to obtain smart speaker evidence from Amazon and Google hoping to find evidence to place a suspect at the homicide crime scene where the smart speaker is also located and listening. Or, they are hoping to find motive for the crime, or inculpatory events leading to it.
Criminal defense lawyers are using smart speaker evidence in pursuit of exculpatory evidence and alibis. Consider three cases of first impression in which Amazon Alexa evidence was collected in criminal prosecutions in Arkansas, New Hampshire, and Florida.

Smart speaker case law

In 2016 law enforcement in Bentonville, Arkansas, obtained Amazon Echo evidence for a November 2015 homicide investigation. Prosecutors hoped to see if Amazon Echo recorded anything or offered significant clues since they had evidence of a struggle. Amazon initially resisted the request, but later produced it when the defendant consented. Prosecutors found the recordings contained no evidence. In December 2017 a judge dismissed charges against the defendant, but it was the first recorded case of smart speaker evidence requested in a murder investigation.

In a separate New Hampshire case, Christine Sullivan and her housemate were brutally murdered by stabbing. Prosecutors thought an Amazon Echo device in the home near where the murders took place may have captured evidence establishing the guilt of the first woman’s live-in boyfriend, Timothy Verrill. In November 2018 a New Hampshire judge found probable cause the Amazon Echo could have recorded “evidence of crimes committed against Ms. Sullivan, including the attack and possible removal of the body from the kitchen.” He ordered Amazon to release hours of audio recordings captured on the device at or near the time of the murders and “any information identifying cellular devices that were paired to that smart speaker during that time period.”

The public defender representing Verrill told jurors during the trial that Alexa recordings show he was hanging out at the home with victims Christine Sullivan and her housemate before the murders.

The public defender further showed the evidence from Alexa captured lighthearted moments between victim and defendant reflecting them joking and making song requests. Verrill was requesting songs and Sullivan was shouting out silly questions such as, “Alexa, are you ignoring me?”

A mistrial was granted based on the state’s failure to turn over significant Brady materials before trial. A motion to dismiss based on exculpatory evidence relevant to Verrill’s alternate perpetrator defense was underway before COVID-19 affected court calendars across New Hampshire.

Police have once again obtained Alexa voice recordings from two Amazon Echo Dots as part of a murder investigation in Florida’s Hallandale Beach, 20 miles from Miami, in July 2019. Investigators want to know if Alexa inadvertently recorded audio of a violent argument between Adam Crespo and his girlfriend Silvia Galva. She died of a spear wound to the chest, but Crespo said it resulted from an accident in which the spear was snapped. Detectives are interested to hear if Alexa preserved any evidence of foul play.

Crespo’s attorney, Christopher O’Toole, said he believes the Alexa recordings will exonerate his client. WIRED magazine reports, “I had a lot of interviews where people said, ‘Oh, are you aware that this could be the first time Alexa recordings are going to be used to convict somebody of murder?’” says Christopher O’Toole, Crespo’s lawyer. “And I actually thought of it the opposite way, that this could be the first time an Amazon Alexa recording is used to exonerate somebody and show that they’re innocent.” O’Toole further told WFOR TV, "We want that evidence in because it will show our client was sleeping that night.”

Recovery of smart  speaker evidence

So how is smart speaker evidence recovered forensically? Three methods are standard options based on where the evidence resides. Can digital evidence be recovered from the smart speaker itself? Does the electronics in an Amazon Echo or a Google Home device contain the user’s question and the smart speaker’s answer? After device tear downs and disassembly, also data extractions of the electronics followed by analysis, the answer is a resounding “no”. Little of the data is available offline. So where is the evidence?

The smartphone paired to the smart speaker with Wi-Fi or Bluetooth is a promising target because the digital evidence is likely to be synced to the phone and stored in a mobile app. Mobile device forensic tools designed to recover smartphone evidence are now mature technology featuring highly probative extractions and support for hundreds of mobile apps. Some of these apps are used to install and configure smart speakers and virtual assistants. And digital evidence may be recovered from them resulting in production of voice recordings, transcriptions, to-do lists, settings, and more.

But the third method of forensic recovery of smart speaker data is effectively best evidence and the most prolific. The online cloud account subscribed to by the smart speaker’s user is accessible and often the hub for its data. Amazon Echo syncs its activity data to the user’s Amazon account. Google Home or Nest devices do the same to the user’s Google account. And we could go on about Apple’s Siri found on every iPhone synced to iCloud accounts and Cortana found on Windows devices synced to Microsoft accounts. Examiners probe and collect these accounts with legal authority using cloud forensic tools successfully every day. Besides voice recordings of suspects and victims, smart speakers keep logs of user activity that are date and time stamped. Examiners can analyze them to discover what was happening at the time and scene of the crime.

But which smart speaker or virtual assistant more readily produces discoverable evidence admissible for trials in criminal and possibly civil cases?

—————

John J. Carney, Esq., is chief technology officer of Carney Forensics, www.carneyforensics.com.