20 ms·

Google says Nest’s built-in mic not listed in specs was not meant to be secret

490 points by temp1928384 8y ago

wpearse 8y ago
I wonder if Singapore Airlines has something new to say about the cameras in their IFE system? https://twitter.com/vkamluk/status/1097008518685573120 https://twitter.com/vkamluk/status/1097008518685573120
- craftyguy 8y ago
  Of all places to 'spy' on folks, on a cramped airplane seems like the worst. Most people will be 1) asleep, 2) pissed off, 3) eating shitty food, 4) watching bad movies. It's likely that they decided to shove in some cheap android tablets that someone else sold them. It's unlikely that they are actively watching everyone, though the possibility of them switching on the camera to watch/record you shifting in your seat to get away from your neighbor trying to use your shoulder as a pillow is always there.
  - fyfy18 8y ago
    For security a lot of (most?) new aircraft have Cabin Video Monitoring Systems (CVMS). Depending on where you are seated they may be able to see everything you do or just your head. An aircraft shouldn't be considered a private place, as you are probably already being watched. In 2008 a study was carried out that attempted to use facial recognition to identify passengers for signs of terrorist activity [0], so maybe they are used for that. On the other hand, as you say it was probably just cheaper to use an off the shell Android tablet that has a built in camera... [0] https://www.newscientist.com/article/dn14013-in-flight-surveillance-could-foil-terrorists-in-the-sky/ https://www.newscientist.com/article/dn14013-in-flight-surve...
    - wpearse 8y ago
      Noticed these on an Emirates A380 recently. Cameras in the ceiling at the front of each seating section.
  - kalleboo 8y ago
    I used to go to a gym where the exercise machines all had Windows tablets built in. They all had a camera and Skype installed. I'm still curious who ever wants to Skype all sweaty during an exercise, but probably the same person who wants to Skype on an airplane.
    - zimpenfish 8y ago
      > who ever wants to Skype all sweaty during an exercise I should imagine there's a non-zero number of fetishists who would pay $ for a live Skype call and/or webcam show with an exerciser.
    - userbinator 8y ago
      I'm still curious who ever wants to Skype all sweaty during an exercise Maybe a variation of this old meme might help explain: "The great thing about going to the gym isn't exercising, it's showing everyone online that you did."
  - wpearse 8y ago
    At some point someone at SIA would have thought about covering up the cameras (surely?), I imagine it would have been: 1. Accept the OEM design (cameras uncovered) but possibly have to deal with people not liking a camera shoved in their face (camera active or inactive) 2. Modify the OEM design (cover the camera, costing money) and nobody even knows that there was a camera there in the first place So I'm curious as to why they chose #1. A pure cost-saving exercise? Reserving use of the cameras at a later time? Didn't have the option of modifying the design? Didn't think people would mind the thought of being filmed?
- jakeogh 8y ago
  OT meta execute-our-code-or-else: "We've detected that JavaScript is disabled in your browser. Would you like to proceed to legacy Twitter?" [Yes] rhetorically... Why?
  - justtopost 8y ago
    'Friendly' friction. At least its not the abhorrent red it.
jrowley 8y ago
It’s really sad to see companies like google buy companies like nest, or more recently amazon and eero. These little companies build fantastic devices, then the companies get acquired and the elegant products get mutated to serve their new owners. Finally a new player enters the market and the cycle continues.
- sametmax 8y ago
  What's sad is that those companies accept. I have been offeredd job interviews at google and facebook and politely refused. Yes, millions are a much bigger temptation, but you still have a choice. In the hand, either they decided those companies where matching their ethics, or they gave up on ethics for money. Given our entreprenarial culture, is that surprising ?
  - thrav 8y ago
    In the case of Eero, I think they just knew it was surrender or be killed in another year or two. They were already starting to face heavy competition.
    - jes5199 8y ago
      Eero was VC funded, right? That means they're basically forced to exit unless they think they can keep growing quickly. (I used to share an office building with Eero's early team. They seemed nice.)
    - sametmax 8y ago
      I agree, and I'm not saying they should have done otherwise. I'm saying it's still a choice. We, sadly, prefer one option to the other. Or maybe there is a third option we don't see.
  - strictnein 8y ago
    A job interview is just a smidge different than a life changing $3.2 billion for a company that only raised $80 million.
mdekkers 8y ago
Now I'm going to have to take my Google Wifi points apart to check for "forgotten" microphones
- handzbagz 8y ago
  If you've got Google wifi points in my opinion you're simply inviting them to spy on you anyway.
strictnein 8y ago
Infosec dramas are getting more and more tiresome. Between this and the Singapore Airlines story, it just seems like people need to ratchet everything up to 11. You have two options, choose one: - 1. Google wants to spy on you with a hidden mic - 2. They had future plans for the mic, but it was disabled, so it wasn't mentioned by the marketing department For the Singapore Airlines story, you have two options, choose one: - 1. Singapore Airlines wants to record you - 2. The infotainment devices in the seats are just off the shelf Android devices One option gets you lots of clicks and let's the infosec drama crowd tweet obnoxious things and sound insightful. The other is the pretty obvious explanation.
- TeMPOraL 8y ago
  A fair point, but then again, if people don't react to #2 now, how long until it turns into #1? Things would be much simpler if companies were up front about what they're selling, instead of giving you incomplete information optimized to placate the unsophisticated buyers.
  - btown 8y ago
    Disclosure of things like microphones on internet-connected devices is the type of no-brainer regulation that our regulatory bodies should be promoting. No need for real behavior changes, no need for giant Surgeon General's warnings, just a mention in printed user documentation, the same way products attest that they aren't in violation of FCC regulations on airwaves. There can be a healthy debate about whether this needs to go even further, e.g. legally requiring what Apple does for its laptop cameras in that a hardware light is lit whenever the recording system is powered up. But at least documentation-level transparency seems like a no-brainer. Unfortunately our regulatory bodies seem incapable of common sense these days, but that's a topic for another day.
- flukus 8y ago
  Maybe if companies like google weren't so creepy and privacy invading they'd get the benefit of the doubt. But in the world of constantly expanding corporate surveillance I default to believing the worst. Only occasionally am I pleasantly surprised to be wrong.
jerkstate 8y ago
Couldn't read the article due to adblocker, but I assume the mic was for home/away detection. Is there any evidence that it uploaded audio?
dmitriid 8y ago
> “the revelation is especially problematic for the company that blah blah blah” How is it problematic? What exactly will change? Customer’s will abandon Google’s products? Google will stop this practice? There will be exactly zero repercussions, and more “ooops it’s an error we never meant it to he a secret” down the line.
pdkl95 8y ago
> It also said the microphone was originally included in the Nest Guard for the possibility of adding new security features down the line, like the ability to detect broken glass. Detecting broken glass with a microphone? Does the device even have enough CPU power (and RAM) to add advanced advanced audio processing features? Or was this going to upload the audio to Google's servers to do the work? If it's the latter, that would necessarily[1] require uploading audio without a wake-word trigger. Either they just admitted to wanting always on microphones in the home, or they are blatantly ling about why the microphone hardware was included. Designing hardware for a large market usually involves a lot of value engineering to reduce the number of parts or replace a feature that requires expensive parts with a functionally similar design that is cheaper. Saving $0.01 (or less) by removing an optional resistor doesn't sound like a lot, but it adds up if you're selling >100k units. A microphone is much more expensive[2]. A part that costs $0.366 (or more[3]?) needs a good reason to be included, and "for the possibility of new features" isn't good enough. So what was the real intended use that justified including a moderatly expensive part? [1] The robber about to break your window isn't going to call out "Ok, Google" first so the Nest Guard knows it can upload an audio clip. [2] https://www.mouser.com/Electromechanical/Audio-Devices/Microphones/_/N-awp4b/?Ns=Pricing|0 https://www.mouser.com/Electromechanical/Audio-Devices/Micro... [3] $0.366 when buying >10,000. Up to $0.75 in lower quantities. (prices from a random example: https://www.mouser.com/ProductDetail/DB-Unlimited/MO064402-4?qs=sGAEpiMZZMtcsMZaWNSquyIpiU55CdOlgUxGjuk%2fltGvCULOk0lGsA%3d%3d https://www.mouser.com/ProductDetail/DB-Unlimited/MO064402-4... )
- baddox 8y ago
  > Or was this going to upload the audio to Google's servers to do the work? If it's the latter, that would necessarily[1] require uploading audio without a wake-word trigger. Couldn’t it run a local model to detect possible incidents, and when a local confidence threshold was exceeded, upload to Google to run a more intense model? I’m pretty sure this is how things like “Hey Siri” and “okay Google” are implemented.
- saurik 8y ago
  Broken glass alarms based on sound are really really common, and are effectively just a slightly modified The Clapper (that maybe cares more about specific frequencies) attached to an alarm that calls the police. My house had one when I was growing up (though it didn't call the police: we turned that part off as it went off every time my father belched ;P).
deleted 8y ago
[deleted]
brisance 8y ago
At the bare minimum Google should offer a full refund for those who bought a Nest Guard. This could be covered under the breach of implied warranty of "fitness for particular purpose", where the purpose is "to purchase a device and having a reasonable expectation of being free from surveillance".
- deleted 8y ago
  [deleted]
est31 8y ago
Oh wow, this is amazing. There's been a lawsuit in court about someone in Germany who sued their landlord because the landlord has put a Google Nest fire alarm into their flat against their will, ignoring offers by the renter to put in a non-google-non-iot fire alarm at the renter's expense. The landlord won because apparently the court was not convinced that the fire alarm could spy on conversations [1]... What would have happened if Google had secretly put a microphone into their fire alarms as well, not just their home security system? [1]: https://www.bundesverfassungsgericht.de/SharedDocs/Entscheidungen/DE/2015/12/rk20151208_1bvr292115.html https://www.bundesverfassungsgericht.de/SharedDocs/Entscheid...
- deleted 8y ago
  [deleted]
- cbg0 8y ago
  > What would have happened if Google had secretly put a microphone into their fire alarms as well, not just their home security system? You could have found it by dismantling the device and the renter would have won their case against the landlord.
  - xg15 8y ago
    As people could - in theory - have with the security system, yet apparently didn't.
  - merb 8y ago
    it wouldn't the case was dismissed, because it's the wrong court. second it was dismissed because just because it's modern and has several technology that can be missused doesn't mean that it will be missused. in germany you need to actually have evidence to really get something like that dismissed. Especially since the landlord actually also offered that she can use her own fire alarm (when she buys it)
  - jve 8y ago
    I hope you all know that Nest fire alarm aka Nest Protect v2 features microphone for automatic sound (health) checks.
atoav 8y ago
What never ceases to amaze me, is the absolute inability of companies like google to understand what their actions look like for somebody who is concerned about privacy. Maybe they understand and do not care, because there are many vocal critics. But having a microphone in a product and not disclosing it? If not even google can keep track of what they should tell us, how on earth do they think they deserve trust?
- kmlx 8y ago
  who's "concerned about their privacy" and why?
  - AlexandrB 8y ago
    "The cause is in my will."[1] It's no one's business why I don't want FAANG snooping on me. That's what a right to privacy means. [1] http://shakespeare.mit.edu/julius_caesar/julius_caesar.2.2.html http://shakespeare.mit.edu/julius_caesar/julius_caesar.2.2.h...
  - atoav 8y ago
    Privacy is a important factor in the stability of free democratic societies. Today we have a asymmetry of transparency: institutions and companies are intransparent while the individual isn’t. This assymetry in information translates into an asymmetry of power. The traditional way citizen of free societies dealt with asymmetries of power was to divide them. A government could easily sentence and jail anybody if it weren’t for some strangely roundabout rules that made this hard. The privacy movement is part of a powerplay between individuals and entities that go beyond single persons. Of course you also have those who think it is about their dick pics..
- stewartm 8y ago
  It never ceases to amaze me, that despite the pattern of behaviour, people continue to be willing to consider that Google/FAANGs/politicians/etc are just a bit thick and don't get it. (Not a dig incidentally, just that at some point the pattern of behaviour must reach a point that swings Occam's Razor to malevolence being the most likely explanation)
newnewpdro 8y ago
If you work for Alphabet, please quit or at least just sit on your hands while collecting a paycheck.
vetler 8y ago
So no one opened up one of these and looked at the components?
- mateo1 8y ago
  Just like many physical and non-physical (software) products, very often, literally nobody reviews/verifies/checks them. Google will learn from this mistake, and next time they'll use a fancy MEMS microphone or a similar technology and place it inside a semiconductor package. When do you think such a feat will be discovered by independent researchers? Probably never.
  - freeflight 8y ago
    There's also the reality that they can simply change the components/layout without ever telling anybody about it. People just keep buying the same boxes without even being aware that the hardware inside these boxes might be completely different revisions. Who's to say that future batches of Nest won't have cameras added for "future use"? Who's gonna go through the effort of checking every fresh batch of Nests for revisions like that? And what are the chances of actually catching it when it's only rolled out in small batches?
    - mateo1 8y ago
      Good point. I'd like to also mention that it is possible for companies like Amazon to "personalise" orders before they are shipped.
distant_hat 8y ago
I wonder how would people react if it had an undisclosed 360-degree IR camera with LED.
amelius 8y ago
That's bad, but remember that every smartphone has a microphone built in ...
- beatgammit 8y ago
  Only two more months until Librem 5 launch. Yes it has a microphone (it has to), but it's far more trustworthy than any other smartphone from a privacy perspective.
atemerev 8y ago
One would have thought that in post-Snowden world, such reassurances would be completely unacceptable. Yet many people even here are dismissing the case with the "conspiracy" catch-all label.
- fixermark 8y ago
  If there's one thing we've learned from post-Snowden world, it's that most people don't care enough to dodge the surveillance because most people didn't respond by voluntarily throwing out all their computing devices, smartphones, ISP service plans, etc.
  - krapp 8y ago
    Another thing we've learned from the post-Snowden world is that people invoke the post-Snowden world as an excuse to abandon critical thinking and skepticism and assume all conspiracies are valid, and often don't actually understand what, specifically, Snowden did and didn't demonstrate. People still believe the PRISM program was about companies giving the NSA direct and unlimited backdoor access to their databases, and that every logo on a single slide is more or less an NSA front. It's a similar phenomenon to the "post-Hilary" world of the Wikileaks email docs. People assume there was hard evidence proving a criminal conspiracy by the DNC to rig the election somewhere in there... mostly because that's what other people told them. Not because they've bothered to look. People's cynicism has led them to put more trust in the metafictional reality of leaks than actual reality. Which, ironically, makes them easier to manipulate even as they believe themselves to be somehow above indoctrination and control having reached enlightenment through the "Snowden revelations."
    - flycaliguy 8y ago
      My take away from the Snowden leaks was basically non-technical and simply an appreciation for how public-private partnerships have assembled a new sort of surveillance industrial complex. One which resembles the military industrial complex and may in the future even replace it? It felt like a warning along the lines of Eisenhower and even Snowden’s role as a whistle blowing contractor felt symbolic of our government’s diminished role in it all. Would you consider that as misguided? It certainly encourages a general distrust of all those company logos in the slides.
netwanderer3 8y ago
I love Google for the service values they provide, but if this were to come from another company then I might have believed it was in fact an error. Privacy has always been an important factor when people consider any Google products, and they are fully aware of that so this topic must have always been on their list of priorities. For a company like Google with rigorous testing/approving processes in place before a product is even launched, to come back and say that it was an accident is pretty hilarious, though realistically what else could they have said? I still like them. It's a love-hate relationship, we have passed the denial phase and entered the acceptance stage long time ago.
- beatgammit 8y ago
  Why does Google get a pass? They're an advertising company, and listening to conversations is very relevant to that business model. In fact, I think it's more plausible that this entire foray into IOT is to collect even more data for use in advertising (e.g. get more microphones in more places). Why else would an advertising company get into such a wide array of businesses? Yes, their products are convenient and typically get good QA testing, but there's still no way I'll be convinced that they're not trying to get as much data as possible to contribute to their core advertising business.
userbinator 8y ago
Having worked at large companies before, I'm almost certain that more than one person working on the product raised the point "this has a microphone, why isn't it documented?" or "this has privacy implications", but was silenced. (Or it could be that everyone working at Google has been carefully chosen to not have such concerns; I do get that feeling sometimes too.)
- s3r3nity 8y ago
  I remember someone in a recent HN comment thread mentioning that, as an ex-Googler, Google today feels like Microsoft under Ballmer. So while I agree with you, it _also_ wouldn't surprise me if someone raised the concern, but that person was on a different / more silo'ed team and therefore the concern never reached the execution stage. Herego too many management layers and/or nodes of entropy for communication. But that's just a hypothesis.
  - eitally 8y ago
    As a current googler, this seems like the most plausible explanation. Entirely likely that the person who noticed didn't actually know which other team to escalate to....
  - balabaster 8y ago
    Or was "yes, yes, we'll add a story to the backlog to add it to the specs" and it just flat out got forgotten. I've seen this happen so many times where I've been the one to raise the issue and because I've passed it off, I've forgotten about it only to circle back around 2 months later when someone says "Oh, we need to do this" and I say "I raised this 2 months ago, I thought X had put it in the backlog." And when you go looking, sure enough, there it is in the backlog down in Priority "We'll get to it when we get to it, after all these other more important things that needed to be completed by last week."
    - jamieson-becker 8y ago
      Although this is all possible and perhaps even more plausible than the alternative, it's still more fun and conspiratorial to view Google as the new Evil Empire, so I'll just keep doing that, thanks.
uberman 8y ago
Will they recall the product or offer a replacement without the mic? If not, they are not sorry, the breaking glass claim is false and this invasion of privacy was always the intent.
vectorEQ 8y ago
it wasn't meant to be secret. it just happened to turn out that way. so weird huh? sorry guys!
darkerside 8y ago
Literally, "Oh, we're sorry. We thought it was obvious we were spying on you by now". Guess their conditioning program isn't yet complete...
- fixermark 8y ago
  When a person hires a personal assistant, the person doesn't generally turn around and accuse the assistant of spying on them because the assistant listens too attentively.
  - beatgammit 8y ago
    Sure, but the assistant also doesn't typically record all conversations and give them to the service they work for, and they also don't typically bug the entire house so they can hear every conversation throughout the house. There's no way I'm getting a digital personal assistant like Google Home or Amazon Alexa. It's a novelty that trades privacy for a little convenience, and I'm not that lazy.
    - fixermark 8y ago
      That's a personal choice you are welcome to make. I have a Google Home Mini sitting on the shelf behind my head right now, and it really doesn't bother me. (... in fact, I tend to think about it in just the opposite way: if I'm ever murdered in my home, I want the cops to be able to subpoena Google to get evidence on who the killer was. It's nice to have a system watching my back all the time).
  - darkerside 8y ago
    The Nest is not a personal assistant like the Google Home. It's a thermostat.
    - bagacrap 8y ago
      Nest makes many products. This one is a security/alarm system.
bb88 8y ago
Mods, Can you change the title to say "Nest Gaurd's", because this has nothing to do with the Nest Thermostat, which is called, "Nest".
- circa 8y ago
  Yeah, I was worried it was the thermostat too. Hopefully that day will NOT come when they tell us all their products have microphones in them.
mimixco 8y ago
And if they later activated the microphones through a software update and didn't tell anyone, I guess that would be an "error," too.
_RPM 8y ago
And most of the rich people in my neighborhood have complete voice devices in their homes, Amazon’s device and Google’s I refuse to have these devices in my home regardless of how cool they seem.
- criddell 8y ago
  What event down the road do you think will vindicate your decision? How do you think your neighbors will be harmed?
  - StanislavPetrov 8y ago
    Some people have no problem putting a little webcam in their toilet bowl so that the world can watch them eliminate every morning. Personally I prefer to keep my business private. I don't need any "vindication" to be happy with my decision to protect my privacy. If you don't understand the value of privacy nobody can explain it to you - but they may watch your morning broadcasts.
    - criddell 8y ago
      You don't see any difference between people getting a Google-connected device (like a Google Home or Pixel phone) and those that install a public webcam in their bathroom?
      - StanislavPetrov 8y ago
        The Google-connected monitoring device is arguable much more intrusive.
        criddell 8y ago
        It's almost as bad as a smartphone with Google's software installed.
  - AlexandrB 8y ago
    Political turmoil. Putting this data in the hands of FAANG means it's just one NSL away from being used by the government. It's foolish to think that the relative stability of western governments since the 1950s is a permanent condition. This is a blink of an eye in historical terms.
2sk21 8y ago
Sounds familiar: https://ca.news.yahoo.com/singapore-airlines-passengers-unsettled-cameras-073029950.html https://ca.news.yahoo.com/singapore-airlines-passengers-unse...
hockeybias 8y ago
Puh-lease...
mrb 8y ago
Fun fact: any device with a speaker can be turned into a microphone because a speaker is fundamentally the same thing as a microphone (a membrane connected to a coil/magnet).
- randcraw 8y ago
  Yes, any speaker can become a mic, but only if you plug it into an amp's input channel. Unfortunately for the CIA, they're all plugged into output channels.
  - throw082 8y ago
    input and output channels are not always physically different pins, sometimes it's just a software configuration. see https://news.ycombinator.com/item?id=13014435 https://news.ycombinator.com/item?id=13014435
xvolter 8y ago
It wasn't listed in tech specs, but it was never hidden or kept secret. It probably could have been more explicitly detailed, but in the FAQs for the Nest Secure it even tells the user: > Can Nest Secure detect breaking glass? No. We’re working on bringing glass break detection to Nest Guard, the main hub of Nest Secure. Nest Detect, the open/close motion sensor, doesn’t have a microphone, so it can’t detect breaking glass. But its motion sensors can detect movement by intruders as well as when a door or window opens and closes depending on how it's installed. https://nest.com/support/article/Frequently-asked-questions-about-Nest-Secure#secure-glass https://nest.com/support/article/Frequently-asked-questions-... This was listed before this big announcement.
0x262d 8y ago
ahh, hate it when the company whose business model is to spy on me accidentally forgets to mention they put a microphone in my home security device!
ewoodrich 8y ago
*Nest Guard
eternalban 8y ago
This remind of the wifi sniffing "mistake" of Google. What other "mistakes" is Google making?
gerash 8y ago
Placing an inactive mic does raise questions naturally but shipping updates to hardware is not easy/possible. So you'd want to future proof your hardware throughout its lifetime. Had Google announced in their marketing that there's an inactive mic there, it would've become the only focus by the louder segments of the media. Whether or not it would ever be activated. Perhaps had Google assistant been more useful, fewer people would've felt so upset. The mic can also be used to detect broken glass, etc.
throw2016 8y ago
This thread has been comprehensively derailed and is an embarrassment to informed discussion. Imagine if a major Chinese firm had 'forgot' to document a microphone, how many people here would be making excuses? This is an astonishing reflection of the quality of technical discussion. Anyone who is even remotely familiar with hardware design will know this cannot be an accident in any way and form. It's there because its designed to be there. The fact that its not documented takes it firmly in the territory of extreme malice and dystopic surveillance unconstrained by any ethical concerns. The only folks for whom this is not a concern are those unburdened by any sense of societal or ethical concern. They represent those sections of the tech community who have zero compass or qualms and do not see any problem building a toxic dystopic society.
sitkack 8y ago
We need an IOT protection bill that starts with labeling. * sensors * endpoints it talks to * update timeline * security protocols and device specific passwords
fastbmk 8y ago
TL;DR Google says: Blah blah blah, we're not evil!

490 points by temp1928384 8y ago

I wonder if Singapore Airlines has something new to say about the cameras in their IFE system? https://twitter.com/vkamluk/status/1097008518685573120 https://twitter.com/vkamluk/status/1097008518685573120

craftyguy 8y ago
Of all places to 'spy' on folks, on a cramped airplane seems like the worst. Most people will be 1) asleep, 2) pissed off, 3) eating shitty food, 4) watching bad movies. It's likely that they decided to shove in some cheap android tablets that someone else sold them. It's unlikely that they are actively watching everyone, though the possibility of them switching on the camera to watch/record you shifting in your seat to get away from your neighbor trying to use your shoulder as a pillow is always there.
- fyfy18 8y ago
  For security a lot of (most?) new aircraft have Cabin Video Monitoring Systems (CVMS). Depending on where you are seated they may be able to see everything you do or just your head. An aircraft shouldn't be considered a private place, as you are probably already being watched. In 2008 a study was carried out that attempted to use facial recognition to identify passengers for signs of terrorist activity [0], so maybe they are used for that. On the other hand, as you say it was probably just cheaper to use an off the shell Android tablet that has a built in camera... [0] https://www.newscientist.com/article/dn14013-in-flight-surveillance-could-foil-terrorists-in-the-sky/ https://www.newscientist.com/article/dn14013-in-flight-surve...
  - wpearse 8y ago
    Noticed these on an Emirates A380 recently. Cameras in the ceiling at the front of each seating section.
- kalleboo 8y ago
  I used to go to a gym where the exercise machines all had Windows tablets built in. They all had a camera and Skype installed. I'm still curious who ever wants to Skype all sweaty during an exercise, but probably the same person who wants to Skype on an airplane.
  - zimpenfish 8y ago
    > who ever wants to Skype all sweaty during an exercise I should imagine there's a non-zero number of fetishists who would pay $ for a live Skype call and/or webcam show with an exerciser.
  - userbinator 8y ago
    I'm still curious who ever wants to Skype all sweaty during an exercise Maybe a variation of this old meme might help explain: "The great thing about going to the gym isn't exercising, it's showing everyone online that you did."
- wpearse 8y ago
  At some point someone at SIA would have thought about covering up the cameras (surely?), I imagine it would have been: 1. Accept the OEM design (cameras uncovered) but possibly have to deal with people not liking a camera shoved in their face (camera active or inactive) 2. Modify the OEM design (cover the camera, costing money) and nobody even knows that there was a camera there in the first place So I'm curious as to why they chose #1. A pure cost-saving exercise? Reserving use of the cameras at a later time? Didn't have the option of modifying the design? Didn't think people would mind the thought of being filmed?
jakeogh 8y ago
OT meta execute-our-code-or-else: "We've detected that JavaScript is disabled in your browser. Would you like to proceed to legacy Twitter?" [Yes] rhetorically... Why?
- justtopost 8y ago
  'Friendly' friction. At least its not the abhorrent red it.

jrowley 8y ago

It’s really sad to see companies like google buy companies like nest, or more recently amazon and eero. These little companies build fantastic devices, then the companies get acquired and the elegant products get mutated to serve their new owners. Finally a new player enters the market and the cycle continues.

sametmax 8y ago
What's sad is that those companies accept. I have been offeredd job interviews at google and facebook and politely refused. Yes, millions are a much bigger temptation, but you still have a choice. In the hand, either they decided those companies where matching their ethics, or they gave up on ethics for money. Given our entreprenarial culture, is that surprising ?
- thrav 8y ago
  In the case of Eero, I think they just knew it was surrender or be killed in another year or two. They were already starting to face heavy competition.
  - jes5199 8y ago
    Eero was VC funded, right? That means they're basically forced to exit unless they think they can keep growing quickly. (I used to share an office building with Eero's early team. They seemed nice.)
  - sametmax 8y ago
    I agree, and I'm not saying they should have done otherwise. I'm saying it's still a choice. We, sadly, prefer one option to the other. Or maybe there is a third option we don't see.
- strictnein 8y ago
  A job interview is just a smidge different than a life changing $3.2 billion for a company that only raised $80 million.

mdekkers 8y ago

Now I'm going to have to take my Google Wifi points apart to check for "forgotten" microphones

handzbagz 8y ago
If you've got Google wifi points in my opinion you're simply inviting them to spy on you anyway.

strictnein 8y ago

Infosec dramas are getting more and more tiresome. Between this and the Singapore Airlines story, it just seems like people need to ratchet everything up to 11. You have two options, choose one: - 1. Google wants to spy on you with a hidden mic - 2. They had future plans for the mic, but it was disabled, so it wasn't mentioned by the marketing department For the Singapore Airlines story, you have two options, choose one: - 1. Singapore Airlines wants to record you - 2. The infotainment devices in the seats are just off the shelf Android devices One option gets you lots of clicks and let's the infosec drama crowd tweet obnoxious things and sound insightful. The other is the pretty obvious explanation.

TeMPOraL 8y ago
A fair point, but then again, if people don't react to #2 now, how long until it turns into #1? Things would be much simpler if companies were up front about what they're selling, instead of giving you incomplete information optimized to placate the unsophisticated buyers.
- btown 8y ago
  Disclosure of things like microphones on internet-connected devices is the type of no-brainer regulation that our regulatory bodies should be promoting. No need for real behavior changes, no need for giant Surgeon General's warnings, just a mention in printed user documentation, the same way products attest that they aren't in violation of FCC regulations on airwaves. There can be a healthy debate about whether this needs to go even further, e.g. legally requiring what Apple does for its laptop cameras in that a hardware light is lit whenever the recording system is powered up. But at least documentation-level transparency seems like a no-brainer. Unfortunately our regulatory bodies seem incapable of common sense these days, but that's a topic for another day.
flukus 8y ago
Maybe if companies like google weren't so creepy and privacy invading they'd get the benefit of the doubt. But in the world of constantly expanding corporate surveillance I default to believing the worst. Only occasionally am I pleasantly surprised to be wrong.

jerkstate 8y ago

Couldn't read the article due to adblocker, but I assume the mic was for home/away detection. Is there any evidence that it uploaded audio?

dmitriid 8y ago

> “the revelation is especially problematic for the company that blah blah blah” How is it problematic? What exactly will change? Customer’s will abandon Google’s products? Google will stop this practice? There will be exactly zero repercussions, and more “ooops it’s an error we never meant it to he a secret” down the line.

pdkl95 8y ago

> It also said the microphone was originally included in the Nest Guard for the possibility of adding new security features down the line, like the ability to detect broken glass. Detecting broken glass with a microphone? Does the device even have enough CPU power (and RAM) to add advanced advanced audio processing features? Or was this going to upload the audio to Google's servers to do the work? If it's the latter, that would necessarily[1] require uploading audio without a wake-word trigger. Either they just admitted to wanting always on microphones in the home, or they are blatantly ling about why the microphone hardware was included. Designing hardware for a large market usually involves a lot of value engineering to reduce the number of parts or replace a feature that requires expensive parts with a functionally similar design that is cheaper. Saving $0.01 (or less) by removing an optional resistor doesn't sound like a lot, but it adds up if you're selling >100k units. A microphone is much more expensive[2]. A part that costs $0.366 (or more[3]?) needs a good reason to be included, and "for the possibility of new features" isn't good enough. So what was the real intended use that justified including a moderatly expensive part? [1] The robber about to break your window isn't going to call out "Ok, Google" first so the Nest Guard knows it can upload an audio clip. [2] https://www.mouser.com/Electromechanical/Audio-Devices/Microphones/_/N-awp4b/?Ns=Pricing|0 https://www.mouser.com/Electromechanical/Audio-Devices/Micro... [3] $0.366 when buying >10,000. Up to $0.75 in lower quantities. (prices from a random example: https://www.mouser.com/ProductDetail/DB-Unlimited/MO064402-4?qs=sGAEpiMZZMtcsMZaWNSquyIpiU55CdOlgUxGjuk%2fltGvCULOk0lGsA%3d%3d https://www.mouser.com/ProductDetail/DB-Unlimited/MO064402-4... )

baddox 8y ago
> Or was this going to upload the audio to Google's servers to do the work? If it's the latter, that would necessarily[1] require uploading audio without a wake-word trigger. Couldn’t it run a local model to detect possible incidents, and when a local confidence threshold was exceeded, upload to Google to run a more intense model? I’m pretty sure this is how things like “Hey Siri” and “okay Google” are implemented.
saurik 8y ago
Broken glass alarms based on sound are really really common, and are effectively just a slightly modified The Clapper (that maybe cares more about specific frequencies) attached to an alarm that calls the police. My house had one when I was growing up (though it didn't call the police: we turned that part off as it went off every time my father belched ;P).

deleted 8y ago

[deleted]

brisance 8y ago

At the bare minimum Google should offer a full refund for those who bought a Nest Guard. This could be covered under the breach of implied warranty of "fitness for particular purpose", where the purpose is "to purchase a device and having a reasonable expectation of being free from surveillance".

deleted 8y ago
[deleted]

est31 8y ago

Oh wow, this is amazing. There's been a lawsuit in court about someone in Germany who sued their landlord because the landlord has put a Google Nest fire alarm into their flat against their will, ignoring offers by the renter to put in a non-google-non-iot fire alarm at the renter's expense. The landlord won because apparently the court was not convinced that the fire alarm could spy on conversations [1]... What would have happened if Google had secretly put a microphone into their fire alarms as well, not just their home security system? [1]: https://www.bundesverfassungsgericht.de/SharedDocs/Entscheidungen/DE/2015/12/rk20151208_1bvr292115.html https://www.bundesverfassungsgericht.de/SharedDocs/Entscheid...

deleted 8y ago
[deleted]
cbg0 8y ago
> What would have happened if Google had secretly put a microphone into their fire alarms as well, not just their home security system? You could have found it by dismantling the device and the renter would have won their case against the landlord.
- xg15 8y ago
  As people could - in theory - have with the security system, yet apparently didn't.
- merb 8y ago
  it wouldn't the case was dismissed, because it's the wrong court. second it was dismissed because just because it's modern and has several technology that can be missused doesn't mean that it will be missused. in germany you need to actually have evidence to really get something like that dismissed. Especially since the landlord actually also offered that she can use her own fire alarm (when she buys it)
- jve 8y ago
  I hope you all know that Nest fire alarm aka Nest Protect v2 features microphone for automatic sound (health) checks.

atoav 8y ago

What never ceases to amaze me, is the absolute inability of companies like google to understand what their actions look like for somebody who is concerned about privacy. Maybe they understand and do not care, because there are many vocal critics. But having a microphone in a product and not disclosing it? If not even google can keep track of what they should tell us, how on earth do they think they deserve trust?

kmlx 8y ago
who's "concerned about their privacy" and why?
- AlexandrB 8y ago
  "The cause is in my will."[1] It's no one's business why I don't want FAANG snooping on me. That's what a right to privacy means. [1] http://shakespeare.mit.edu/julius_caesar/julius_caesar.2.2.html http://shakespeare.mit.edu/julius_caesar/julius_caesar.2.2.h...
- atoav 8y ago
  Privacy is a important factor in the stability of free democratic societies. Today we have a asymmetry of transparency: institutions and companies are intransparent while the individual isn’t. This assymetry in information translates into an asymmetry of power. The traditional way citizen of free societies dealt with asymmetries of power was to divide them. A government could easily sentence and jail anybody if it weren’t for some strangely roundabout rules that made this hard. The privacy movement is part of a powerplay between individuals and entities that go beyond single persons. Of course you also have those who think it is about their dick pics..
stewartm 8y ago
It never ceases to amaze me, that despite the pattern of behaviour, people continue to be willing to consider that Google/FAANGs/politicians/etc are just a bit thick and don't get it. (Not a dig incidentally, just that at some point the pattern of behaviour must reach a point that swings Occam's Razor to malevolence being the most likely explanation)

newnewpdro 8y ago

If you work for Alphabet, please quit or at least just sit on your hands while collecting a paycheck.

vetler 8y ago

So no one opened up one of these and looked at the components?

mateo1 8y ago
Just like many physical and non-physical (software) products, very often, literally nobody reviews/verifies/checks them. Google will learn from this mistake, and next time they'll use a fancy MEMS microphone or a similar technology and place it inside a semiconductor package. When do you think such a feat will be discovered by independent researchers? Probably never.
- freeflight 8y ago
  There's also the reality that they can simply change the components/layout without ever telling anybody about it. People just keep buying the same boxes without even being aware that the hardware inside these boxes might be completely different revisions. Who's to say that future batches of Nest won't have cameras added for "future use"? Who's gonna go through the effort of checking every fresh batch of Nests for revisions like that? And what are the chances of actually catching it when it's only rolled out in small batches?
  - mateo1 8y ago
    Good point. I'd like to also mention that it is possible for companies like Amazon to "personalise" orders before they are shipped.

distant_hat 8y ago

I wonder how would people react if it had an undisclosed 360-degree IR camera with LED.

amelius 8y ago

That's bad, but remember that every smartphone has a microphone built in ...

beatgammit 8y ago
Only two more months until Librem 5 launch. Yes it has a microphone (it has to), but it's far more trustworthy than any other smartphone from a privacy perspective.

atemerev 8y ago

One would have thought that in post-Snowden world, such reassurances would be completely unacceptable. Yet many people even here are dismissing the case with the "conspiracy" catch-all label.

fixermark 8y ago
If there's one thing we've learned from post-Snowden world, it's that most people don't care enough to dodge the surveillance because most people didn't respond by voluntarily throwing out all their computing devices, smartphones, ISP service plans, etc.
- krapp 8y ago
  Another thing we've learned from the post-Snowden world is that people invoke the post-Snowden world as an excuse to abandon critical thinking and skepticism and assume all conspiracies are valid, and often don't actually understand what, specifically, Snowden did and didn't demonstrate. People still believe the PRISM program was about companies giving the NSA direct and unlimited backdoor access to their databases, and that every logo on a single slide is more or less an NSA front. It's a similar phenomenon to the "post-Hilary" world of the Wikileaks email docs. People assume there was hard evidence proving a criminal conspiracy by the DNC to rig the election somewhere in there... mostly because that's what other people told them. Not because they've bothered to look. People's cynicism has led them to put more trust in the metafictional reality of leaks than actual reality. Which, ironically, makes them easier to manipulate even as they believe themselves to be somehow above indoctrination and control having reached enlightenment through the "Snowden revelations."
  - flycaliguy 8y ago
    My take away from the Snowden leaks was basically non-technical and simply an appreciation for how public-private partnerships have assembled a new sort of surveillance industrial complex. One which resembles the military industrial complex and may in the future even replace it? It felt like a warning along the lines of Eisenhower and even Snowden’s role as a whistle blowing contractor felt symbolic of our government’s diminished role in it all. Would you consider that as misguided? It certainly encourages a general distrust of all those company logos in the slides.

netwanderer3 8y ago

I love Google for the service values they provide, but if this were to come from another company then I might have believed it was in fact an error. Privacy has always been an important factor when people consider any Google products, and they are fully aware of that so this topic must have always been on their list of priorities. For a company like Google with rigorous testing/approving processes in place before a product is even launched, to come back and say that it was an accident is pretty hilarious, though realistically what else could they have said? I still like them. It's a love-hate relationship, we have passed the denial phase and entered the acceptance stage long time ago.

beatgammit 8y ago
Why does Google get a pass? They're an advertising company, and listening to conversations is very relevant to that business model. In fact, I think it's more plausible that this entire foray into IOT is to collect even more data for use in advertising (e.g. get more microphones in more places). Why else would an advertising company get into such a wide array of businesses? Yes, their products are convenient and typically get good QA testing, but there's still no way I'll be convinced that they're not trying to get as much data as possible to contribute to their core advertising business.

userbinator 8y ago

Having worked at large companies before, I'm almost certain that more than one person working on the product raised the point "this has a microphone, why isn't it documented?" or "this has privacy implications", but was silenced. (Or it could be that everyone working at Google has been carefully chosen to not have such concerns; I do get that feeling sometimes too.)

s3r3nity 8y ago
I remember someone in a recent HN comment thread mentioning that, as an ex-Googler, Google today feels like Microsoft under Ballmer. So while I agree with you, it _also_ wouldn't surprise me if someone raised the concern, but that person was on a different / more silo'ed team and therefore the concern never reached the execution stage. Herego too many management layers and/or nodes of entropy for communication. But that's just a hypothesis.
- eitally 8y ago
  As a current googler, this seems like the most plausible explanation. Entirely likely that the person who noticed didn't actually know which other team to escalate to....
- balabaster 8y ago
  Or was "yes, yes, we'll add a story to the backlog to add it to the specs" and it just flat out got forgotten. I've seen this happen so many times where I've been the one to raise the issue and because I've passed it off, I've forgotten about it only to circle back around 2 months later when someone says "Oh, we need to do this" and I say "I raised this 2 months ago, I thought X had put it in the backlog." And when you go looking, sure enough, there it is in the backlog down in Priority "We'll get to it when we get to it, after all these other more important things that needed to be completed by last week."
  - jamieson-becker 8y ago
    Although this is all possible and perhaps even more plausible than the alternative, it's still more fun and conspiratorial to view Google as the new Evil Empire, so I'll just keep doing that, thanks.

uberman 8y ago

Will they recall the product or offer a replacement without the mic? If not, they are not sorry, the breaking glass claim is false and this invasion of privacy was always the intent.

vectorEQ 8y ago

it wasn't meant to be secret. it just happened to turn out that way. so weird huh? sorry guys!

darkerside 8y ago

Literally, "Oh, we're sorry. We thought it was obvious we were spying on you by now". Guess their conditioning program isn't yet complete...

fixermark 8y ago
When a person hires a personal assistant, the person doesn't generally turn around and accuse the assistant of spying on them because the assistant listens too attentively.
- beatgammit 8y ago
  Sure, but the assistant also doesn't typically record all conversations and give them to the service they work for, and they also don't typically bug the entire house so they can hear every conversation throughout the house. There's no way I'm getting a digital personal assistant like Google Home or Amazon Alexa. It's a novelty that trades privacy for a little convenience, and I'm not that lazy.
  - fixermark 8y ago
    That's a personal choice you are welcome to make. I have a Google Home Mini sitting on the shelf behind my head right now, and it really doesn't bother me. (... in fact, I tend to think about it in just the opposite way: if I'm ever murdered in my home, I want the cops to be able to subpoena Google to get evidence on who the killer was. It's nice to have a system watching my back all the time).
- darkerside 8y ago
  The Nest is not a personal assistant like the Google Home. It's a thermostat.
  - bagacrap 8y ago
    Nest makes many products. This one is a security/alarm system.

bb88 8y ago

Mods, Can you change the title to say "Nest Gaurd's", because this has nothing to do with the Nest Thermostat, which is called, "Nest".

circa 8y ago
Yeah, I was worried it was the thermostat too. Hopefully that day will NOT come when they tell us all their products have microphones in them.

mimixco 8y ago

And if they later activated the microphones through a software update and didn't tell anyone, I guess that would be an "error," too.

_RPM 8y ago

And most of the rich people in my neighborhood have complete voice devices in their homes, Amazon’s device and Google’s I refuse to have these devices in my home regardless of how cool they seem.

criddell 8y ago
What event down the road do you think will vindicate your decision? How do you think your neighbors will be harmed?
- StanislavPetrov 8y ago
  Some people have no problem putting a little webcam in their toilet bowl so that the world can watch them eliminate every morning. Personally I prefer to keep my business private. I don't need any "vindication" to be happy with my decision to protect my privacy. If you don't understand the value of privacy nobody can explain it to you - but they may watch your morning broadcasts.
  - criddell 8y ago
    You don't see any difference between people getting a Google-connected device (like a Google Home or Pixel phone) and those that install a public webcam in their bathroom?
    - StanislavPetrov 8y ago
      The Google-connected monitoring device is arguable much more intrusive.
      - criddell 8y ago
        It's almost as bad as a smartphone with Google's software installed.
- AlexandrB 8y ago
  Political turmoil. Putting this data in the hands of FAANG means it's just one NSL away from being used by the government. It's foolish to think that the relative stability of western governments since the 1950s is a permanent condition. This is a blink of an eye in historical terms.

2sk21 8y ago

Sounds familiar: https://ca.news.yahoo.com/singapore-airlines-passengers-unsettled-cameras-073029950.html https://ca.news.yahoo.com/singapore-airlines-passengers-unse...

hockeybias 8y ago

Puh-lease...

mrb 8y ago

Fun fact: any device with a speaker can be turned into a microphone because a speaker is fundamentally the same thing as a microphone (a membrane connected to a coil/magnet).

randcraw 8y ago
Yes, any speaker can become a mic, but only if you plug it into an amp's input channel. Unfortunately for the CIA, they're all plugged into output channels.
- throw082 8y ago
  input and output channels are not always physically different pins, sometimes it's just a software configuration. see https://news.ycombinator.com/item?id=13014435 https://news.ycombinator.com/item?id=13014435

xvolter 8y ago

It wasn't listed in tech specs, but it was never hidden or kept secret. It probably could have been more explicitly detailed, but in the FAQs for the Nest Secure it even tells the user: > Can Nest Secure detect breaking glass? No. We’re working on bringing glass break detection to Nest Guard, the main hub of Nest Secure. Nest Detect, the open/close motion sensor, doesn’t have a microphone, so it can’t detect breaking glass. But its motion sensors can detect movement by intruders as well as when a door or window opens and closes depending on how it's installed. https://nest.com/support/article/Frequently-asked-questions-about-Nest-Secure#secure-glass https://nest.com/support/article/Frequently-asked-questions-... This was listed before this big announcement.

0x262d 8y ago

ahh, hate it when the company whose business model is to spy on me accidentally forgets to mention they put a microphone in my home security device!

ewoodrich 8y ago

*Nest Guard

eternalban 8y ago

This remind of the wifi sniffing "mistake" of Google. What other "mistakes" is Google making?

gerash 8y ago

Placing an inactive mic does raise questions naturally but shipping updates to hardware is not easy/possible. So you'd want to future proof your hardware throughout its lifetime. Had Google announced in their marketing that there's an inactive mic there, it would've become the only focus by the louder segments of the media. Whether or not it would ever be activated. Perhaps had Google assistant been more useful, fewer people would've felt so upset. The mic can also be used to detect broken glass, etc.

throw2016 8y ago

This thread has been comprehensively derailed and is an embarrassment to informed discussion. Imagine if a major Chinese firm had 'forgot' to document a microphone, how many people here would be making excuses? This is an astonishing reflection of the quality of technical discussion. Anyone who is even remotely familiar with hardware design will know this cannot be an accident in any way and form. It's there because its designed to be there. The fact that its not documented takes it firmly in the territory of extreme malice and dystopic surveillance unconstrained by any ethical concerns. The only folks for whom this is not a concern are those unburdened by any sense of societal or ethical concern. They represent those sections of the tech community who have zero compass or qualms and do not see any problem building a toxic dystopic society.

sitkack 8y ago

We need an IOT protection bill that starts with labeling. * sensors * endpoints it talks to * update timeline * security protocols and device specific passwords

fastbmk 8y ago

TL;DR Google says: Blah blah blah, we're not evil!