10 ms·

Amazon stores Alexa transcripts indefinitely

180 points by iafrikan 7y ago

kerng 7y ago
Why not delete by default or after 30 days or something more user friendly...
- me_me_me 7y ago
  Yeah I wonder why would they not voluntary delete all of that data?
  - pintxo 7y ago
    Why delete something if there might be the slightest chance of it being useful in the future, and there is no downside (storage, reputation, legal)? I assume storage of this data for them is nearly 0 cost, reputation is not an issue as most >99% of people seem to simply don't care about privacy and there is probably no legal limit.
    - me_me_me 7y ago
      I was being overly sarcastic in my prev comment. There is no reason for them to do it. In fact if they did, it would be considered a loss of value. Its valuable dataset. Even deleting stuff in 'big data environment' is generally considered too expensive rather than just un-indexing data points that are not relevant anymore.
    - _Codemonkeyism 7y ago
      "no legal limit." There is in the EU. Keeping data indefinitely is illegal. Expert opinion varies on how long you can keep it, many think you're save with 12 months, most think 36 months is too long.
      - mytailorisrich 7y ago
        If it's personal data. A transcript in itself is not personal data unless an individual can be identified or it is linked to an individual. So "Alexa, order more beer" in itself can be kept for as long as you want. The audio recording may be a different matter because of voice recognition. As to how long personal data may be kept, well in the UK one can sue on a civil matter for up to 6 years so there is a good argument that anything related to the service you provide and in relation to which you might be sued should be kept for 6 years. I expect it's similar in other countries.
        kerng 7y ago
        According to the article the transcript is directly associated with the users. It's some of the most personal PII there can be in my opinion. One day it will all be compromised or misused, because that's what history teaches us.
        mytailorisrich 7y ago
        > According to the article the transcript is directly associated with the users They just need to destroy that link and can then keep the transcripts for as long as they want.
  - IshKebab 7y ago
    It's used for training.
- vincent-toups 7y ago
  You aren't the user.
  - _Codemonkeyism 7y ago
    ... but the product.
- richajak 7y ago
  Why do we believe this concept? It's a business or political decision to delete something after X days/years, not a technical limitation. It's similar to government policy about data retention policy for X years. This concept is invented to calm the public, but there's no difference in technical aspect. The servers still keep everything. It's the contrast of the old days, when the mainframe has to discard data because there's no space left, or it's simply too expensive to keep everything.
amanzi 7y ago
To be fair, they make it easy to review and delete past recordings here: https://www.amazon.com/alexaprivacysettings https://www.amazon.com/alexaprivacysettings
- fs2 7y ago
  I really doubt the recording is actually deleted from all of their servers. Wouldn't be surprised when a few years from now there is another news item about how they accidentally kept these logs in backups or how they were shared with law enforcement or ad companies.
  - mysterydip 7y ago
    It's ok, they have "an ongoing effort to ensure those transcripts do not remain in any of Alexa’s other storage systems."
  - cremp 7y ago
    > kept these logs in backups Is that unreasonable? I mean, I cannot possibly expect myself to go through my backups and delete a folder from everything, down to the multi-year incremental. Once you start tampering with a backup, it stops being a backup.
    - _Codemonkeyism 7y ago
      Well then "delete past recordings here" is probably not true.
    - skybrian 7y ago
      This can be done by encrypting each backed-up item and forgetting the key for deleted items that shouldn't be restorable from backup. You still need to decide how long the keys should be kept, though.
- Normal_gaussian 7y ago
  This page was empty for me, I had to open the Alexa app and do it from there. It isn't clear why, as the random trash alexa misinterpreted and added to our shopping cart was in the alexa cart ok...
sorokod 7y ago
It will be interesting to see how this plays out wrt GDPR
- ghawk1ns 7y ago
  It's not that interesting unfortunately. You can physically delete all of your recordings at any time at https://www.amazon.com/alexaprivacysettings https://www.amazon.com/alexaprivacysettings All of that data is wiped when you initiate a delete request under GDPR.
  - sorokod 7y ago
    What about privacy by default?
vincent-toups 7y ago
I'm tempted to feel that if you are dumb enough to put one of these things in your house, you deserve to have your privacy obliterated by a huge private corporation who is as likely to hand it over to a government as they are to sell it to advertisers or worse. I don't believe that, but it is shocking to me that anyone would want one of these things.
- jasonlfunk 7y ago
  How is a smart phone any different? It has a microphone that, for most people, is always listening. It’s not shocking at all. I find my Echo to be incredibly useful and I’ve decided that it’s worth the trade-off. Just like I did with the microphone I have on my wrist and the one in my pocket.
  - windexh8er 7y ago
    It's very different. My expectation that of my smart phone is that it's not listening unless I want it to (I don't). If I find out it is listening/recording and it's configured not to then I will find an alternative. The "smart speaker", on the other hand, is 100% useless if the microphone is disabled. It also has microphones designed to hear as far away as possible given its design. Finally, the phone in your pocket and watch on your wrist likely handle the audio data very different than that speaker manufacturer. You might find it useful now, but don't discount now you'll ever find it intrusive.
    - BeetleB 7y ago
      >My expectation that of my smart phone is that it's not listening unless I want it to (I don't). If I find out it is listening/recording and it's configured not to then I will find an alternative. >My expectation This is the key phrase here. Just as you have your expectations, Alexa/Home owners have their expectations. And if Alexa owners find out that Amazon/Google is using their inputs in ways they don't want it to, they'll drop it or find an alternative. Different people have different expectations. I was late into the whole smartphone thing, and refused to buy one for years because of the privacy leak it represents (heck, I refused to buy a dumb phone for years for the same reason). Back in those days, I would have been as unsympathetic for your rationale of owning a smartphone as you are of those owning smart speakers. Do you not see that there are different levels of comfort, and not everyone has the same level as you do? Furthermore, do you not see that on that continuum, even you have made compromises?
vitorgrs 7y ago
What's the news here? The same happens with Google and Microsoft. You can even check on their websites and see ALL your audios on Google Assistant and Cortana. https://myactivity.google.com https://myactivity.google.com Even your dictations on Windows is there too (Win+H). https://account.microsoft.com/privacy/activity-history?view=voice https://account.microsoft.com/privacy/activity-history?view=...
- LinuxBender 7y ago
  Also Discord. They brag about it a bit. [1] Don't say or type anything you don't want archived forever. Loose lips sink ships. [1] - https://blog.discordapp.com/how-discord-stores-billions-of-messages-7fa6ec7ee4c7?gi=ee4db605fb86 https://blog.discordapp.com/how-discord-stores-billions-of-m...
  - skybrian 7y ago
    This is like criticizing Gmail for keeping your email forever by default. It's your account and you can delete your data when you don't want it anymore. A more substantive critique would be that these services don't let you set a retention policy. Google Vault lets an organization automatically delete old email, but other than Snapchat, you don't see this for consumer accounts, so you have to do it manually.
    - LinuxBender 7y ago
      I do criticize Google for many things, including their usage of email. But you are right, they can keep it forever as there is no mutually legal binding agreement and mutual NDA signed, witnessed and counter-signed by all parties. When gmail was first created, I was one of the people to first whine about them trawling through messages for URLs and crawling them. Some friends and I would link to files that didn't set content length and would feed them data forever. They eventually caught on to that.
      - kbenson 7y ago
        > Some friends and I would link to files that didn't set content length and would feed them data forever. That seems spectacularly unwise (or at least useless) for all but a minuscule portion of people. Either you stop feeding them data after a short while, and don't care, or you keep feeding them data, and I'm pretty sure Google cares less about (and pays less for) data transfer than you do. Best case scenario you're trickling data to them and just keeping the connection open as long as possible. Even then, Google likely cares about one connection and the resources it takes far less than you do (even if you care little). If it makes you feel better, it's maybe worth it, but it feels akin to carrying a marker with you so you can cross out Google's name in any newspaper you happen to be reading. It's an act of protest, but its impact leaves a lot to be desired.
whatamidoingyo 7y ago
After reading this thread I really think we need more people like Richard Stallman in the world. "Embrace and educate", you'll say. No, people don't care. Let them do what they will. I will not participate in the destruction of privacy. However this, to me, isn't even the scariest part. The real scary stuff is when you realize what this data is most certainly being used for. Remember when the CIA gave unknowing citizens LSD? Remember the unclassified docs that revealed their intentions to be able to basically warp a mind, and control it at their will? Well, today, we hand them the data for deep examination. Our emotions, intelligence, etc. will be revealed by a quick scan of our face. Just imagine the databases these government agencies have available. I imagine labs filled with scientists and engineers trying to crack the data. It sounds conspiratorial, but come on. Imagine if you held humanities brain within your hands. Would you not study it, trying to figure out how to make it work more to your personal needs? Or maybe you'll tell yourself it's to make society better, to make it safer. Just a note: I'm not accusing the CIA exactly of doing this. There is no doubt in my mind, though, that somebody is out there doing this (the CIA seems most reasonable). Sorry for rambling, I've been awake for 24 hours (is there irony in that?)
vasili111 7y ago
Do you use any open source Alexa alternative? If yes, please share your experience.
- shawabawa3 7y ago
  I set up a https://snips.ai/ https://snips.ai/ raspberry pi, got it to respond to its wake word Then realised it was going to take like 6+ hours (if not days) to get it to play music and set timers, so gave up on it Ecosystem might be more mature now, when i looked there weren't any good spotify apps you could get for it
circlingthesun 7y ago
Something something GDPR?

180 points by iafrikan 7y ago

kerng 7y ago

Why not delete by default or after 30 days or something more user friendly...

me_me_me 7y ago
Yeah I wonder why would they not voluntary delete all of that data?
- pintxo 7y ago
  Why delete something if there might be the slightest chance of it being useful in the future, and there is no downside (storage, reputation, legal)? I assume storage of this data for them is nearly 0 cost, reputation is not an issue as most >99% of people seem to simply don't care about privacy and there is probably no legal limit.
  - me_me_me 7y ago
    I was being overly sarcastic in my prev comment. There is no reason for them to do it. In fact if they did, it would be considered a loss of value. Its valuable dataset. Even deleting stuff in 'big data environment' is generally considered too expensive rather than just un-indexing data points that are not relevant anymore.
  - _Codemonkeyism 7y ago
    "no legal limit." There is in the EU. Keeping data indefinitely is illegal. Expert opinion varies on how long you can keep it, many think you're save with 12 months, most think 36 months is too long.
    - mytailorisrich 7y ago
      If it's personal data. A transcript in itself is not personal data unless an individual can be identified or it is linked to an individual. So "Alexa, order more beer" in itself can be kept for as long as you want. The audio recording may be a different matter because of voice recognition. As to how long personal data may be kept, well in the UK one can sue on a civil matter for up to 6 years so there is a good argument that anything related to the service you provide and in relation to which you might be sued should be kept for 6 years. I expect it's similar in other countries.
      - kerng 7y ago
        According to the article the transcript is directly associated with the users. It's some of the most personal PII there can be in my opinion. One day it will all be compromised or misused, because that's what history teaches us.
        mytailorisrich 7y ago
        > According to the article the transcript is directly associated with the users They just need to destroy that link and can then keep the transcripts for as long as they want.
- IshKebab 7y ago
  It's used for training.
vincent-toups 7y ago
You aren't the user.
- _Codemonkeyism 7y ago
  ... but the product.
richajak 7y ago
Why do we believe this concept? It's a business or political decision to delete something after X days/years, not a technical limitation. It's similar to government policy about data retention policy for X years. This concept is invented to calm the public, but there's no difference in technical aspect. The servers still keep everything. It's the contrast of the old days, when the mainframe has to discard data because there's no space left, or it's simply too expensive to keep everything.

amanzi 7y ago

To be fair, they make it easy to review and delete past recordings here: https://www.amazon.com/alexaprivacysettings https://www.amazon.com/alexaprivacysettings

fs2 7y ago
I really doubt the recording is actually deleted from all of their servers. Wouldn't be surprised when a few years from now there is another news item about how they accidentally kept these logs in backups or how they were shared with law enforcement or ad companies.
- mysterydip 7y ago
  It's ok, they have "an ongoing effort to ensure those transcripts do not remain in any of Alexa’s other storage systems."
- cremp 7y ago
  > kept these logs in backups Is that unreasonable? I mean, I cannot possibly expect myself to go through my backups and delete a folder from everything, down to the multi-year incremental. Once you start tampering with a backup, it stops being a backup.
  - _Codemonkeyism 7y ago
    Well then "delete past recordings here" is probably not true.
  - skybrian 7y ago
    This can be done by encrypting each backed-up item and forgetting the key for deleted items that shouldn't be restorable from backup. You still need to decide how long the keys should be kept, though.
Normal_gaussian 7y ago
This page was empty for me, I had to open the Alexa app and do it from there. It isn't clear why, as the random trash alexa misinterpreted and added to our shopping cart was in the alexa cart ok...

sorokod 7y ago

It will be interesting to see how this plays out wrt GDPR

ghawk1ns 7y ago
It's not that interesting unfortunately. You can physically delete all of your recordings at any time at https://www.amazon.com/alexaprivacysettings https://www.amazon.com/alexaprivacysettings All of that data is wiped when you initiate a delete request under GDPR.
- sorokod 7y ago
  What about privacy by default?

vincent-toups 7y ago

I'm tempted to feel that if you are dumb enough to put one of these things in your house, you deserve to have your privacy obliterated by a huge private corporation who is as likely to hand it over to a government as they are to sell it to advertisers or worse. I don't believe that, but it is shocking to me that anyone would want one of these things.

jasonlfunk 7y ago
How is a smart phone any different? It has a microphone that, for most people, is always listening. It’s not shocking at all. I find my Echo to be incredibly useful and I’ve decided that it’s worth the trade-off. Just like I did with the microphone I have on my wrist and the one in my pocket.
- windexh8er 7y ago
  It's very different. My expectation that of my smart phone is that it's not listening unless I want it to (I don't). If I find out it is listening/recording and it's configured not to then I will find an alternative. The "smart speaker", on the other hand, is 100% useless if the microphone is disabled. It also has microphones designed to hear as far away as possible given its design. Finally, the phone in your pocket and watch on your wrist likely handle the audio data very different than that speaker manufacturer. You might find it useful now, but don't discount now you'll ever find it intrusive.
  - BeetleB 7y ago
    >My expectation that of my smart phone is that it's not listening unless I want it to (I don't). If I find out it is listening/recording and it's configured not to then I will find an alternative. >My expectation This is the key phrase here. Just as you have your expectations, Alexa/Home owners have their expectations. And if Alexa owners find out that Amazon/Google is using their inputs in ways they don't want it to, they'll drop it or find an alternative. Different people have different expectations. I was late into the whole smartphone thing, and refused to buy one for years because of the privacy leak it represents (heck, I refused to buy a dumb phone for years for the same reason). Back in those days, I would have been as unsympathetic for your rationale of owning a smartphone as you are of those owning smart speakers. Do you not see that there are different levels of comfort, and not everyone has the same level as you do? Furthermore, do you not see that on that continuum, even you have made compromises?

vitorgrs 7y ago

What's the news here? The same happens with Google and Microsoft. You can even check on their websites and see ALL your audios on Google Assistant and Cortana. https://myactivity.google.com https://myactivity.google.com Even your dictations on Windows is there too (Win+H). https://account.microsoft.com/privacy/activity-history?view=voice https://account.microsoft.com/privacy/activity-history?view=...

LinuxBender 7y ago
Also Discord. They brag about it a bit. [1] Don't say or type anything you don't want archived forever. Loose lips sink ships. [1] - https://blog.discordapp.com/how-discord-stores-billions-of-messages-7fa6ec7ee4c7?gi=ee4db605fb86 https://blog.discordapp.com/how-discord-stores-billions-of-m...
- skybrian 7y ago
  This is like criticizing Gmail for keeping your email forever by default. It's your account and you can delete your data when you don't want it anymore. A more substantive critique would be that these services don't let you set a retention policy. Google Vault lets an organization automatically delete old email, but other than Snapchat, you don't see this for consumer accounts, so you have to do it manually.
  - LinuxBender 7y ago
    I do criticize Google for many things, including their usage of email. But you are right, they can keep it forever as there is no mutually legal binding agreement and mutual NDA signed, witnessed and counter-signed by all parties. When gmail was first created, I was one of the people to first whine about them trawling through messages for URLs and crawling them. Some friends and I would link to files that didn't set content length and would feed them data forever. They eventually caught on to that.
    - kbenson 7y ago
      > Some friends and I would link to files that didn't set content length and would feed them data forever. That seems spectacularly unwise (or at least useless) for all but a minuscule portion of people. Either you stop feeding them data after a short while, and don't care, or you keep feeding them data, and I'm pretty sure Google cares less about (and pays less for) data transfer than you do. Best case scenario you're trickling data to them and just keeping the connection open as long as possible. Even then, Google likely cares about one connection and the resources it takes far less than you do (even if you care little). If it makes you feel better, it's maybe worth it, but it feels akin to carrying a marker with you so you can cross out Google's name in any newspaper you happen to be reading. It's an act of protest, but its impact leaves a lot to be desired.

whatamidoingyo 7y ago

After reading this thread I really think we need more people like Richard Stallman in the world. "Embrace and educate", you'll say. No, people don't care. Let them do what they will. I will not participate in the destruction of privacy. However this, to me, isn't even the scariest part. The real scary stuff is when you realize what this data is most certainly being used for. Remember when the CIA gave unknowing citizens LSD? Remember the unclassified docs that revealed their intentions to be able to basically warp a mind, and control it at their will? Well, today, we hand them the data for deep examination. Our emotions, intelligence, etc. will be revealed by a quick scan of our face. Just imagine the databases these government agencies have available. I imagine labs filled with scientists and engineers trying to crack the data. It sounds conspiratorial, but come on. Imagine if you held humanities brain within your hands. Would you not study it, trying to figure out how to make it work more to your personal needs? Or maybe you'll tell yourself it's to make society better, to make it safer. Just a note: I'm not accusing the CIA exactly of doing this. There is no doubt in my mind, though, that somebody is out there doing this (the CIA seems most reasonable). Sorry for rambling, I've been awake for 24 hours (is there irony in that?)

vasili111 7y ago

Do you use any open source Alexa alternative? If yes, please share your experience.

shawabawa3 7y ago
I set up a https://snips.ai/ https://snips.ai/ raspberry pi, got it to respond to its wake word Then realised it was going to take like 6+ hours (if not days) to get it to play music and set timers, so gave up on it Ecosystem might be more mature now, when i looked there weren't any good spotify apps you could get for it

circlingthesun 7y ago

Something something GDPR?