6 ms·

The one thing about these stories that keep coming out about the home assistants... they kind of create the impression that this is an issue specific to home sp

The one thing about these stories that keep coming out about the home assistants... they kind of create the impression that this is an issue specific to home speakers, and you can avoid it, by simply not buying them. That's misleading. Any voice command you use to operate any internet connected tech gadget, from phones to smart TV's, is potentially stored and flagged for human review. You really have to avoid using voice commands at all, on all of your devices. Even that is probably insufficient. You probably have to go even further and actively disable voice command features on all of your devices, assuming they actually support such a setting. Otherwise here's still the possibility of an accidental recording taking a journey through the clouds, to a stranger's ears.

arien 7y ago
And not to be anywhere near anyone else's listening devices. Isn't there a law in some US states that there needs to be consent before recording someone? How does this fit in and who would be held responsible, the owner of the listening device or the company behind it?
- bastawhiz 7y ago
  You already consented by agreeing to the terms of service. If someone else is talking to their smart device while you're talking, it's ostensibly their responsibility. There's no reasonable laws that prevent you from being overheard in the back of a recorded phone conversation
  - arien 7y ago
    Not in the case of the device being someone else's. I don't have any Google or Amazon smart listeners, so I never accepted them. Yet if my voice is in any of these recordings, well...
    - kahnjw 7y ago
      How do you square that with a security cameras? Do you need to consent every time you enter a space secured by them?
      - davidf560 7y ago
        The rules regarding audio recording are different from video. This is why many security cameras do not actually record audio. I think the laws are different primarily due to the different pace of audio vs. video recording technology. Audio recording of phone calls etc. has been feasible for a long time so laws were written about that. Ubiquitous video recording has really only become a thing in the past 2 decades or so.
        ethbro 7y ago
        Absolutely. I feel like the pace of adoption has been mostly driven by per-bit storage costs falling (and high efficiency codecs). Above all else, people will do useful things with computers once the price to do so matches the utility. And we're far on the other side of that with cameras. I can't wait to see what the next decade+ does to all the Facebook-esque camera startups. It's going to be hard to monetize your customer's video feeds once regulation clamps down.
      - deleted 7y ago
        [deleted]
      - ptd 7y ago
        I don’t believe there are laws prohibiting video surveillance in public by businesses. Some states have laws prohibiting filming in locations where one expects privacy. Other states allow filming in private spaces as long as the business notifies employees and customers they are being filmed.
        SolarNet 7y ago
        Yea most states also have a pretty clear "if the device is obvious" law. It's also why businesses put up "smile you are on camera" signs, especially if their camera isn't immediately recognizable.
    - testvox 7y ago
      As long as you are warned that you are being recorded then the law considers you to have given consent if you decide to continue to talk. This is why all the home devices make a loud sound that you cannot disable before they begin recording.
      - sotruetome 7y ago
        Except that I don't know what that sound means. I know what the one my device makes is, but I've never heard the others. Unless it's a human voice saying, "This conversation is now being recorded" I can't be expected to know what a random beep from a device means. It could just mean the person got a notification or something. (And even if it is a recognizable sentence, it assumes I understand the human language the device is set to.)
  - ethbro 7y ago
    (IANAL, but) Not accurate in the US. Most states are either one party or two party consent states. One party = you can unilaterally record anything (not sure this includes things you're not actively involved with, e.g. spying). Two party = you must have consent of everyone in the recording. By a plain reading of two party consent statutes, people are in violation if their home speaker records a guest without obtaining consent. I'm sure Google and Amazon's lawyers would try to weasel out of compliance via claimed anonymization, but that's definitely not the spirit of the law. Old, but thorough: http://www.mwl-law.com/wp-content/uploads/2013/03/LAWS-ON-RECORDING-CONVERSATIONS-CHART.pdf http://www.mwl-law.com/wp-content/uploads/2013/03/LAWS-ON-RE... You're also going to bump up into specific wording on whether a given statute covers only telephone conversations or oral conversations, as most of these are phone wiretap laws that may or may not have been worked ambiguously. Additionally, there are federal statutes that likely also bear.
    - mgamache 7y ago
      My understanding of recording law is that in One Party states you need to be part of the conversation to record it. Speculation: This would mean that the device / owner would be in violation if the owner was not in the room?
      - ethbro 7y ago
        Ironically, if the owner were not in the room, I'd expect the device manufacturer would be more directly liable. How can a homeowner be responsible for a device for which they (a) don't control the operation of & (b) don't control the software of? At that point, whether a device captures incidental recording seems entirely under control of the manufacturer.
        fwip 7y ago
        Sorry for the extreme analogy, but a gun owner is responsible if their nephew accesses their gun when they're not home. It is not farfetched to imagine that, to be in compliance with the law, you would need to unplug your listening devices to avoid them accidentally going off.
  - pessimizer 7y ago
    I find this reasonable; you wouldn't sue the manufacturer of a recording device if someone made a secret recording with it. I do think this means that the smartphone owner is liable, and should be fined or jailed.
    - arien 7y ago
      But in this particular case, it's the company doing the recordings, not the owner of the device, so it's a slightly different situation, in my opinion. That said... The owner could be liable if for example it were necessary to explicitly inform of the existence of such devices the possibility of being recorded.
- deleted 7y ago
  [deleted]
- notTyler 7y ago
  Yeah, this was a big issue about a decade ago when police officers could sue someone for recording said officers doing something illegal in Massachusetts. So they redacted that law then had to fast track an updated version of it a few years later when someone got arrested for taking upskirt photos and then it wasn't illegal. My cousin was an aide to a state lawmaker and had to explain to his boss what it meant at the time.
- Someone1234 7y ago
  > And not to be anywhere near anyone else's listening devices. No assistant records all the time, not Google, Amazon, or Apple. They listen for the "Wake Word" onboard using more primitive (and lower power consumption) Speech Recognition and only utilize The Cloud after the "Wake Word" (or phase) is spoken. You can confirm this using Wireshark. You can view and listen to your recorded speech on the Google Account Dashboard.
  - alias_neo 7y ago
    No, they don't, however, accidental activation is still highly likely. I've had other people's devices activate during conversations where I couldn't figure out which part of the sentence activated them, it just happens. "Ok, Go get..." "Ok, Good ..." "All except..." "Sir, I..." Then you have television shows and adverts that intentionally use language to activate these assistants. Usually the assistants are going to say something when it accidentally detects a wake word, but if you're in another room or don't hear it for some reason, it can easily capture a conversation without you knowing.
    - freehunter 7y ago
      I use the phrase “are you serious?!” a lot when I am frustrated. Almost always it wakes up Siri on at least one of my iDevices. Which makes me say “are you serious?!” again and it just spirals from there.
- monkeynotes 7y ago
  I think when you buy a Google Home you basically accept some terms and conditions in the app to set it up. Buried in there is probably your consent to analytics etc.
  - inetknght 7y ago
    > Buried in there is probably your consent to analytics etc. That's certainly not informed consent.
- mherdeg 7y ago
  These laws vary state-by-state. I'm kind of surprised that Massachusetts's very strong laws about wiretapping permit storage of training data from Amazon Echo/Google Assistant/Apple Siri/Microsoft Cortana/Xbox, given that by their nature they naturally sometimes record incidental conversations of people who didn't intentionally trigger them. It's a fairly mainstream view that MA wiretapping law requires written consent from every participant in a conversation for the recording of their conversation in a non-public place and does not permit implicit agreement (there isn't any kind of common-sense carveout for "you should have known you were being recorded in the background by the Echo at your neighbor's house"). See MGL chapter 272 section 99 (https://malegislature.gov/laws/generallaws/partiv/titlei/chapter272/section99 https://malegislature.gov/laws/generallaws/partiv/titlei/cha... , sample writeup https://www.masslive.com/news/2014/06/massachusetts_wiretap_law_expl.html https://www.masslive.com/news/2014/06/massachusetts_wiretap_... ) Now, MA has a bunch of laws on the books that no one actually enforces. There is a law against jaywalking which provides a $1 fine and tickets are never issued. Or for a bigger example, there is a law that requires you get a temporary permit from the Alcoholic Beverages Control Commission before importing any quantity of alcohol into the state, including for example buying beer at a NH liquor store or flying home from Europe with a bottle of wine. Last time I looked I think that law provides for a $2500 fine or 6 month jail time if violated, although it was hard to tell. ABCC will absolutely insist that this is a real requirement if you ask, and will even provide a copy of all such permits they have issued for the year under freedom-of-information rules -- I once asked and was given a copy of 46 permits issued in 2015, many to a single person who reviews wine and stubbornly files a permit for every shipment he orders from out of state apparently to protest the requirement, causing so much administrative overhead that the ABCC tried to issue him a special blanket approval to get him to go away, which he refused to accept. To the extent that wiretapping laws are similarly not really enforced against the technology companies who make, retain, and distribute the recordings, this seems like an unknowably large regulatory risk a lot of companies are taking. Sure, the state loves its big local employers (IIRC Alexa development is in Cambridge?), and wouldn't want to lose their tax revenue, but what if the political winds change?
- iamnotacrook 7y ago
  "Isn't there a law in some US states that there needs to be consent before recording someone?" I doubt it - there would have been a test case involving one of the millions of people who have mobile phones capable of recording video/audio. If you're in a public place you should have no expectation of (that sort of) privacy.
dalbasal 7y ago
...and this is before you get to hacked/compromised devices. This is just devices working as specified.
checktheorder 7y ago
Whenever I'm in the home of a friend who's enthralled with their smart speaker gadget, I like to make red-flag-raising requests to their gadget. Asking for good sniper vantage points in Washington DC, a safe rohypnol dosage for 10-year-olds, the soonest flight to a non-extradition country, those sorts of things.
- deleted 7y ago
  [deleted]
monkeynotes 7y ago
Not to mention all the crap you type into your search bar, Gmail, images I upload, basically anything with any sort of machine learning backed enhancement. Any of that stuff could be sampled and reviewed by humans. Admittedly anonymised, but it's still potentially personal stuff just as the voice print data is.
baxtr 7y ago
Yes that’s true. But: with another device like a phone it is optional to turn a voice assistant on. Not so with a device with the sole purpose of being a voice assistant.
danmaz74 7y ago
When I give a voice command, I know that my voice could be recorded. What I'm actually concerned about is devices which are always listening, even when I'm not giving a voice command, and recordings from when I'm not interacting with the device potentially falling in the wrong hands.
dmix 7y ago
Twilio (and their customers) listens to phone calls too no doubt.
qwertox 7y ago
Any time I'm on a phone call and say "Ok, good", Google Assistant kicks in, which concerns me a lot. I really don't understand how they don't allow setting a custom hotword.

arien 7y ago

And not to be anywhere near anyone else's listening devices. Isn't there a law in some US states that there needs to be consent before recording someone? How does this fit in and who would be held responsible, the owner of the listening device or the company behind it?

bastawhiz 7y ago
You already consented by agreeing to the terms of service. If someone else is talking to their smart device while you're talking, it's ostensibly their responsibility. There's no reasonable laws that prevent you from being overheard in the back of a recorded phone conversation
- arien 7y ago
  Not in the case of the device being someone else's. I don't have any Google or Amazon smart listeners, so I never accepted them. Yet if my voice is in any of these recordings, well...
  - kahnjw 7y ago
    How do you square that with a security cameras? Do you need to consent every time you enter a space secured by them?
    - davidf560 7y ago
      The rules regarding audio recording are different from video. This is why many security cameras do not actually record audio. I think the laws are different primarily due to the different pace of audio vs. video recording technology. Audio recording of phone calls etc. has been feasible for a long time so laws were written about that. Ubiquitous video recording has really only become a thing in the past 2 decades or so.
      - ethbro 7y ago
        Absolutely. I feel like the pace of adoption has been mostly driven by per-bit storage costs falling (and high efficiency codecs). Above all else, people will do useful things with computers once the price to do so matches the utility. And we're far on the other side of that with cameras. I can't wait to see what the next decade+ does to all the Facebook-esque camera startups. It's going to be hard to monetize your customer's video feeds once regulation clamps down.
    - deleted 7y ago
      [deleted]
    - ptd 7y ago
      I don’t believe there are laws prohibiting video surveillance in public by businesses. Some states have laws prohibiting filming in locations where one expects privacy. Other states allow filming in private spaces as long as the business notifies employees and customers they are being filmed.
      - SolarNet 7y ago
        Yea most states also have a pretty clear "if the device is obvious" law. It's also why businesses put up "smile you are on camera" signs, especially if their camera isn't immediately recognizable.
  - testvox 7y ago
    As long as you are warned that you are being recorded then the law considers you to have given consent if you decide to continue to talk. This is why all the home devices make a loud sound that you cannot disable before they begin recording.
    - sotruetome 7y ago
      Except that I don't know what that sound means. I know what the one my device makes is, but I've never heard the others. Unless it's a human voice saying, "This conversation is now being recorded" I can't be expected to know what a random beep from a device means. It could just mean the person got a notification or something. (And even if it is a recognizable sentence, it assumes I understand the human language the device is set to.)
- ethbro 7y ago
  (IANAL, but) Not accurate in the US. Most states are either one party or two party consent states. One party = you can unilaterally record anything (not sure this includes things you're not actively involved with, e.g. spying). Two party = you must have consent of everyone in the recording. By a plain reading of two party consent statutes, people are in violation if their home speaker records a guest without obtaining consent. I'm sure Google and Amazon's lawyers would try to weasel out of compliance via claimed anonymization, but that's definitely not the spirit of the law. Old, but thorough: http://www.mwl-law.com/wp-content/uploads/2013/03/LAWS-ON-RECORDING-CONVERSATIONS-CHART.pdf http://www.mwl-law.com/wp-content/uploads/2013/03/LAWS-ON-RE... You're also going to bump up into specific wording on whether a given statute covers only telephone conversations or oral conversations, as most of these are phone wiretap laws that may or may not have been worked ambiguously. Additionally, there are federal statutes that likely also bear.
  - mgamache 7y ago
    My understanding of recording law is that in One Party states you need to be part of the conversation to record it. Speculation: This would mean that the device / owner would be in violation if the owner was not in the room?
    - ethbro 7y ago
      Ironically, if the owner were not in the room, I'd expect the device manufacturer would be more directly liable. How can a homeowner be responsible for a device for which they (a) don't control the operation of & (b) don't control the software of? At that point, whether a device captures incidental recording seems entirely under control of the manufacturer.
      - fwip 7y ago
        Sorry for the extreme analogy, but a gun owner is responsible if their nephew accesses their gun when they're not home. It is not farfetched to imagine that, to be in compliance with the law, you would need to unplug your listening devices to avoid them accidentally going off.
- pessimizer 7y ago
  I find this reasonable; you wouldn't sue the manufacturer of a recording device if someone made a secret recording with it. I do think this means that the smartphone owner is liable, and should be fined or jailed.
  - arien 7y ago
    But in this particular case, it's the company doing the recordings, not the owner of the device, so it's a slightly different situation, in my opinion. That said... The owner could be liable if for example it were necessary to explicitly inform of the existence of such devices the possibility of being recorded.
deleted 7y ago
[deleted]
notTyler 7y ago
Yeah, this was a big issue about a decade ago when police officers could sue someone for recording said officers doing something illegal in Massachusetts. So they redacted that law then had to fast track an updated version of it a few years later when someone got arrested for taking upskirt photos and then it wasn't illegal. My cousin was an aide to a state lawmaker and had to explain to his boss what it meant at the time.
Someone1234 7y ago
> And not to be anywhere near anyone else's listening devices. No assistant records all the time, not Google, Amazon, or Apple. They listen for the "Wake Word" onboard using more primitive (and lower power consumption) Speech Recognition and only utilize The Cloud after the "Wake Word" (or phase) is spoken. You can confirm this using Wireshark. You can view and listen to your recorded speech on the Google Account Dashboard.
- alias_neo 7y ago
  No, they don't, however, accidental activation is still highly likely. I've had other people's devices activate during conversations where I couldn't figure out which part of the sentence activated them, it just happens. "Ok, Go get..." "Ok, Good ..." "All except..." "Sir, I..." Then you have television shows and adverts that intentionally use language to activate these assistants. Usually the assistants are going to say something when it accidentally detects a wake word, but if you're in another room or don't hear it for some reason, it can easily capture a conversation without you knowing.
  - freehunter 7y ago
    I use the phrase “are you serious?!” a lot when I am frustrated. Almost always it wakes up Siri on at least one of my iDevices. Which makes me say “are you serious?!” again and it just spirals from there.
monkeynotes 7y ago
I think when you buy a Google Home you basically accept some terms and conditions in the app to set it up. Buried in there is probably your consent to analytics etc.
- inetknght 7y ago
  > Buried in there is probably your consent to analytics etc. That's certainly not informed consent.
mherdeg 7y ago
These laws vary state-by-state. I'm kind of surprised that Massachusetts's very strong laws about wiretapping permit storage of training data from Amazon Echo/Google Assistant/Apple Siri/Microsoft Cortana/Xbox, given that by their nature they naturally sometimes record incidental conversations of people who didn't intentionally trigger them. It's a fairly mainstream view that MA wiretapping law requires written consent from every participant in a conversation for the recording of their conversation in a non-public place and does not permit implicit agreement (there isn't any kind of common-sense carveout for "you should have known you were being recorded in the background by the Echo at your neighbor's house"). See MGL chapter 272 section 99 (https://malegislature.gov/laws/generallaws/partiv/titlei/chapter272/section99 https://malegislature.gov/laws/generallaws/partiv/titlei/cha... , sample writeup https://www.masslive.com/news/2014/06/massachusetts_wiretap_law_expl.html https://www.masslive.com/news/2014/06/massachusetts_wiretap_... ) Now, MA has a bunch of laws on the books that no one actually enforces. There is a law against jaywalking which provides a $1 fine and tickets are never issued. Or for a bigger example, there is a law that requires you get a temporary permit from the Alcoholic Beverages Control Commission before importing any quantity of alcohol into the state, including for example buying beer at a NH liquor store or flying home from Europe with a bottle of wine. Last time I looked I think that law provides for a $2500 fine or 6 month jail time if violated, although it was hard to tell. ABCC will absolutely insist that this is a real requirement if you ask, and will even provide a copy of all such permits they have issued for the year under freedom-of-information rules -- I once asked and was given a copy of 46 permits issued in 2015, many to a single person who reviews wine and stubbornly files a permit for every shipment he orders from out of state apparently to protest the requirement, causing so much administrative overhead that the ABCC tried to issue him a special blanket approval to get him to go away, which he refused to accept. To the extent that wiretapping laws are similarly not really enforced against the technology companies who make, retain, and distribute the recordings, this seems like an unknowably large regulatory risk a lot of companies are taking. Sure, the state loves its big local employers (IIRC Alexa development is in Cambridge?), and wouldn't want to lose their tax revenue, but what if the political winds change?
iamnotacrook 7y ago
"Isn't there a law in some US states that there needs to be consent before recording someone?" I doubt it - there would have been a test case involving one of the millions of people who have mobile phones capable of recording video/audio. If you're in a public place you should have no expectation of (that sort of) privacy.

dalbasal 7y ago

...and this is before you get to hacked/compromised devices. This is just devices working as specified.

checktheorder 7y ago

Whenever I'm in the home of a friend who's enthralled with their smart speaker gadget, I like to make red-flag-raising requests to their gadget. Asking for good sniper vantage points in Washington DC, a safe rohypnol dosage for 10-year-olds, the soonest flight to a non-extradition country, those sorts of things.

deleted 7y ago
[deleted]

monkeynotes 7y ago

Not to mention all the crap you type into your search bar, Gmail, images I upload, basically anything with any sort of machine learning backed enhancement. Any of that stuff could be sampled and reviewed by humans. Admittedly anonymised, but it's still potentially personal stuff just as the voice print data is.

baxtr 7y ago

Yes that’s true. But: with another device like a phone it is optional to turn a voice assistant on. Not so with a device with the sole purpose of being a voice assistant.

danmaz74 7y ago

When I give a voice command, I know that my voice could be recorded. What I'm actually concerned about is devices which are always listening, even when I'm not giving a voice command, and recordings from when I'm not interacting with the device potentially falling in the wrong hands.

dmix 7y ago

Twilio (and their customers) listens to phone calls too no doubt.

qwertox 7y ago

Any time I'm on a phone call and say "Ok, good", Google Assistant kicks in, which concerns me a lot. I really don't understand how they don't allow setting a custom hotword.