UPDATE: Police got a warrant, as I predicted below. But CNN says that Amazon is still refusing to cooperate. Not sure how they’re justifying that one to the police. Will be curious if prosecutors decide to pursue the information from Amazon or let it go.

Original story:

[divider]

That new Amazon Echo you got for Christmas is spying on you! Time to freak out and never use it again! Well, not really. But alarm regarding the Echo is making rounds. USAToday, Alexa, who dunnit?:

In what may be a first, police in Arkansas asked Amazon for recordings potentially made by an Echo device in connection with a murder investigation.

Police in Bentonville, Ark., asked Amazon for audio and other records from an Echo digital assistant in the home of James Andrew Bates after Victor Collins was found dead in Bates’ hot tub last year, The Information reported Tuesday.

Bates was charged with killing Collins on Nov. 22, 2015, according to court documents.

The two had been drinking and watching football with two other friends in Bates’ home. One of the friends left but Collins and another stayed after Bates told them they could sleep on the couch and an extra bed, the affidavit for a search warrant said. Bates went to sleep and sometime in the night Collins died in the home’s hot tub, according to the affidavit.

The cause of death was strangulation with drowning as a secondary cause, according to police. Bates was arrested and charged with the murder. He is currently out on bail.

Amazon declined to provide the data.

That’s right, police saw that a murder suspect had an Amazon Echo in their home and did the natural thing – they asked Amazon to hand over any data associated with the device.

USAToday and many other news services are making a big deal over Amazon’s refusal to hand over the data, But if you look at the details:

Specifically, the Bentonville Police Department requested “electronic data in the form of audio recordings, transcribed records, or other text records related to communications and transactions between An Amazon Echo device” located at Bates’ residence and Amazon.com’s services between Nov. 21 and 22, court documents show.

Amazon refused both times. In a statement to USA TODAY, Amazon said will not release customer information without a valid and binding legal demand properly served on it. Amazon objects to over broad or otherwise inappropriate demands as a matter of course, the company said.

There is a big difference between the government “requesting” something from you and demanding something from you. Amazon took the appropriate action to protect itself and its customers in this situation. They didn’t just hand over information because the government asked for it.

Now that’s done, here’s how it’s likely going to play out:

  • Police: Can we have the recordings?
  • Amazon: Is there imminent danger if we don’t give it to you now?
  • Police: No, but we really don’t want to wait.
  • Amazon: Get a warrant.
  • Police: Damn. Okay. (to Court) Please give us a warrant.
  • Court: Here’s a warrant.
  • Police (to Amazon): Here’s a warrant.
  • Amazon: Here’s what you wanted. It’s pretty useless, but here you go anyway.

But in case you still concerned, let’s look at all the legal documents that you agree to (but never read or look at) when you begin using an Amazon Echo.

In the grand tradition of software EULAs, there is not a single legal document that affects your use of an Amazon Echo, but a multitude of legal documents. In order to get a better understanding of exactly what’s going on when you use an Echo, what information you share, how you can access it, what law enforcement needs to do to access it, etc, let’s go through them all.

Starting at the top:

Alexa Terms of Use

Available here.

1.3 Voice Services. You control Alexa with your voice. Alexa streams audio to the cloud when you interact with Alexa. Alexa processes and retains your voice input and other information, such as your music playlists and your Alexa to-do and shopping lists, in the cloud to respond to your requests and improve our services. Learn more about these voice services including how to delete voice recordings associated with your account.

This is Amazon letting you know that when you use an Echo, they’re going to send the audio data to Amazon servers.

2.1 Third Party Services. If you use a Third Party Service, we may exchange related information with that service, such as your zip code when you ask for the weather, your custom music stations, or the content of your requests. Your use of any Third Party Service is subject to this Agreement and any third party terms applicable to such Third Party Service. Certain of these third party terms can be found in the Legal Notices section of your Amazon Alexa App, or may be linked from your Amazon Alexa App, and may be updated from time to time. If you do not accept the third party terms applicable to a Third Party Service, do not use that Third Party Service. When using a Third Party Service, you are responsible for any information you provide to the third party. Amazon has no responsibility or liability for Third Party Services. Publishers of Third Party Services may change or discontinue the functionality or features of their Third Party Service.

This is Amazon letting you know that they make the audio information you send them available to other services. So if you’re using Spotify with your Echo, or controlling lights, Amazon sends the audio data to those services. So if you use any non-Amazone service with your Echo, that means you not only agree to Amazon’s various legal documents, but also the third-party service.

3.1 Information. The Software will provide Amazon with information about use of Alexa and its interaction with your Alexa Enabled Product (such as device type, voice information, content metadata, and location). Information provided through Alexa may be stored on servers outside the country in which you live. We will handle any information we receive in accordance with the Amazon.com Privacy Notice .

This is a bit redundant, but Amazon is really letting you know that they’re collecting all sort of information about your interaction with an Echo. It’s worth noting that while they give examples of information collected, they don’t explicitly state exactly what information is collected.

3.6 Disputes/Binding Arbitration. Any dispute or claim arising from or relating to this Agreement or Alexa is subject to the binding arbitration, governing law, disclaimer of warranties, limitation of liability, and all other terms in the Amazon.com Conditions of Use . By using Alexa, you agree to be bound by those terms.

Got an issue with any of the above?

Throughout the Alexa Terms of Use, it makes reference to another document, the Amazon Privacy Notice. So let’s look at that next.

Amazon Privacy Notice

Available here. 

Protection of Amazon.com and Others: We release account and other personal information when we believe release is appropriate to comply with the law; enforce or apply our Conditions of Use and other agreements; or protect the rights, property, or safety of Amazon.com, our users, or others. This includes exchanging information with other companies and organizations for fraud protection and credit risk reduction. Obviously, however, this does not include selling, renting, sharing, or otherwise disclosing personally identifiable information from customers for commercial purposes in violation of the commitments set forth in this Privacy Notice. (emphasis added)

This is where Amazon tells you that they’re going to hand over your private data when “appropriate to comply with the law.” Again, in the above situation the Bentonville Police likely just asked for the data, which is not an appropriate court order with which Amazon must comply. They get a subpoena/warrant, Amazon is probably handing over that data.

The Privacy Notice also tells you to looks at Examples of Information Collected (which is not a separate page but listed further down the Privacy page).

There is a litany of examples here about the information Amazon may collect, but there is nothing listed specifically about data collected from Echoes/Alexa.

There is also a section entitled, “Which Information Can I Access?” that provides a link to what it it will have examples…but it just links you back to the same page. Not exactly useful.

Of course, all of the above is also governed by the overarching Amazon Conditions of Use.

Amazon Conditions of Use

Available here.

APPLICABLE LAW. By using any Amazon Service, you agree that the Federal Arbitration Act, applicable federal law, and the laws of the state of Washington, without regard to principles of conflict of laws, will govern these Conditions of Use and any dispute of any sort that might arise between you and Amazon.

Doing anything at all with Amazon means that you’re agreeing to the Federal Arbitration Act. You also agree that any disputes will be governed by the laws of the state of Washington, or applicable Federal law.

This is also the document that tells provides you instructions on how to subpoena Amazon…which happen to be woefully inadequate. If you want to subpoena Amazon, I’ve done it, here’s how.

Speaking of subpoenas and legal demands, buried in Amazon’s website are its Law Enforcement Guidelines.

Amazon Law Enforcement Guidelines

Available here (PDF).

This document details how Amazon complies with law enforcement requests. Of note:

Amazon will not release customer information without a valid and binding legal demand properly served on us. Amazon objects to overbroad or otherwise inappropriate demands as a matter of course.

Hence, Amazon didn’t just hand over the customer information when the Bentonville police asked for it. Once Amazon is presented with a warrant or subpoena, they’ll comply.

*E-discovery People, Pay Attention Here *

Included in the Law Enforcement Guidelines is the only information I’ve ever seen or read from Amazon about their data preservation policy.

Preservation. Upon receipt of a lawful and binding request Amazon will preserve requested information for up to 90 days.

That’s not long at all. If you’re in law enforcement investigating a crime that might have relevant data on Amazon’s servers, or involved in civil litigation that might have relevant data on Amazon’s servers, you need to get them a preservation letter ASAP. Followed by making getting a copy of the data an immediate priority.

Finally, we have the Alexa Device & Device FAQ.

Alexa Device & Device FAQ

Available here.

This provides general information about Alexa devices, but is also included under “Alexa and Alexa Device Terms, Warranties, and Notices.” On this page is where you can find the link to the information page for your Alexa device on Amazon.

4. How do I delete Alexa voice recordings? You can delete specific voice recordings associated with your account by going to History in Settings in the Alexa App, drilling down for a specific entry, and then tapping the delete button. Or, you can delete all voice recordings associated with your account for each of your Alexa-enabled products, by selecting the applicable product at the Manage Your Content and Devices page at www.amazon.com/mycd or contacting customer service.

You’ll need to navigate to your specific device once you’ve logged in. Interestingly, the Content and Devices page only provides you with one option regarding your Alexa information, delete everything:

Amazon Echo Legal Documents

If you want to delete individual recordings, that needs to be done within a Kindle App on a iOS/Android device.

But as USAToday stated, the Echo only keeps fewer than 60 seconds of recorded audio in its local storage buffer. Once new audio is recorded, old audio is erased. Meaning there’s not reams of audio data available to recover. Amazon only actually stores the information around the commands you give it once it hears a “wake word.

Which brings us back to the hypothetical conversation from earlier:

  • Police (to Amazon): Here’s a warrant.
  • Amazon: Here’s what you wanted. It’s pretty useless, but here you go anyway.

That being said, there is always a chance that an Alexa device (or Siri, Cortana, Google) have some relevant information for prosecution or a lawsuit.

Expect these devices to become a part of a regular eDiscovery process in the coming years.

[divider]

Since we’re talking about eDiscovery: At long last, the update to my 2015 Subpoena Guide should be ready soon. Be informed when it comes out at the link.

Share This