Amazon's Idea For A Mesh Network Is Cool; Its Method Of Rolling It Out Is Not

from the c'mon-guys dept

Over the weekend there was a bit of a reasonable fuss raised after Ars Technica noted that all of the various Amazon connected devices (including Alexa, Echo, Ring, etc.) would become part of a mesh network called Amazon Sidewalk, in which the devices would be sharing a tiny tiny bit of bandwidth across the network of devices. The idea behind the mesh network is kind of cool, and there are some clear benefits to using it.

But, of course, this is Amazon we're talking about -- a giant company, and the method of rolling this out seems to have caught a ton of people by surprise: namely opting everyone into the program with a short timeline to opt-out. That seems less than ideal. Lots of privacy folks are concerned, in general, with two aspects of this: the fact that people may be suddenly sharing data with their neighbors without necessarily realizing it, and the tie-in to Amazon, which is (again) a large company that tends to collect quite a bit of data on people. To its credit, Amazon released a pretty comprehensive whitepaper exploring the privacy and security protections they've built in to Sidewalk, and my guess is that for many consumers the benefits of easier setup and better connectivity via Sidewalk will seem worth it to them.

The real issue, then, is forcing everyone into the network. Obviously, it's no surprise why this was done. A mesh network really only works if you have enough nodes on the network to make it useful. So it makes sense that Amazon would want as many of the devices to be on the network on day one as possible. However, given the company and the public scrutiny it has received of late, it seems like it should have anticipated these concerns a lot more, pushed for an opt-in setup (perhaps with incentives), rather than jumping to the "hey, we're adding this automatically" approach.

While it's possible that Amazon is betting that the concerns over this will blow over, and having so many nodes on the network will make it worthwhile to take the short-term heat, it still surprises me that the big internet companies don't take more steps to alleviate these kinds of concerns up front, including taking a more cautious approach. But, perhaps that's why I don't run a giant internet company.

Filed Under: alexa, amazon sidewalk, echo, iot, mesh network, opt-in, opt-out, privacy, ring, sharing
Companies: amazon

Once Again, GDPR Is A Potential Privacy Nightmare: Amazon Sends 1,700 Voice Recordings To The Wrong User In GDPR Request

from the privacy? dept

Back in September, we wrote about how the GDPR could actually undermine privacy, when Jean Young noted that, when someone hacked into her Spotify account, they were able to download her entire data history. And now there's another example of the privacy implications: Amazon recently responded to a GDPR data export request by sending 1,700 voice recordings... to the wrong user.

Following the passage of the European Union’s General Data Protection Regulation, or GDPR, any EU resident may demand a company send them the entirety of the data collected about them through both internet services and hardware products like an Alexa-equipped Echo smart speaker. One German user, under the alias “Martin Schneider,” did just that in August of this year. What he got back from Amazon, however, were thousands of Alexa voice recordings, which was strange considering he didn’t own an Alexa device.

Upon listening to the files, Schneider discovered they were the recordings of another Alexa user. After failing to get in contact with Amazon about the issue, the man brought the files to c’t, where reporters were able to piece together who the Alexa user was. Among the files were commands to control Spotify, the person’s home thermostat, and alarms. There were also recordings that indicated the Alexa user also owned a Fire TV, and that they had a spouse who appeared to live in the home.

There are, of course, many different ways of thinking about this. On the whole, it's a good thing that companies are giving users more access to data, and allowing them to not just see what's being held, but to download it as well (it would be nice if things were more standardized, and it would enable easier shifting between services, but... baby steps). But, it also needs to be recognized that this creates new privacy challenges.

This isn't necessarily good or bad, but is a useful reminder that, contrary to what many GDPR supporters will tell you, the GDPR itself doesn't actually do much to "protect" your privacy, and could make your data even more vulnerable. Again, there are potentially good reasons for this, but way too many people keep insisting that the GDPR is about protecting privacy, and it is important to understand where and how it fails in that regard, and how it could even make much of your data more vulnerable.

Filed Under: data, downloads, echo, gdpr, privacy, voice recordings
Companies: amazon

Judge Says Amazon Needs To Hand Over Recordings Created By Murder Victim's Echo Speaker

from the in-every-dream-home,-a-state's-witness dept

New Hampshire investigators will be deposing Alexa in the near future, according to a recent court ruling. The advent of in-home digital, voice-activated assistants has created a wealth of personal recordings law enforcement may now have access to. It's only been a couple of years since we first saw law enforcement attempt to obtain Alexa recordings from Amazon, but as Mike pointed out then, this was going to be the new normal. So the onus is on companies like Apple, Google, and Amazon to give customers more direct control of stored data and recordings.

In this case, prosecutors are seeking recordings made by a murder victim's Amazon Echo speaker. They hope the victim's device captured the attack and the removal of her body. Amazon has issued some boilerplate about "valid legal demands" in response, but it's likely the company won't interject itself into this case.

The key here -- unlike other cases we've discussed -- is that the device belongs to a crime victim, rather than the person who allegedly committed the crime. The short court order [PDF] from the New Hampshire court makes it clear no one but the prosecution is invited to this evidence-gathering party:

After reviewing the motion, the court takes it up and rules on it without waiting for a response from defense counsel, as it appears the defendant would have no standing to assent or object to the State's motion.

Pretty cut-and-dry. The alleged murderer can't object to the search of recordings made by the murder victim's device. Amazon can probably fight the order, but in a case like this, it seems unlikely it will. But maybe it should.

[T]he State's motion to search in lieu of a search warrant is granted.

Law enforcement rarely obtains a warrant to search a crime victim's residence if that's where the crime occurred. It's not that they don't need a warrant to perform this search. It's that the accused criminal usually has no possessory interest in the crime victim's residence and would not be able to challenge the evidence in court.

When it's a murder case, the victim is obviously in no position to challenge the search. But there's a lot of criminal activity that doesn't result in a dead person, so searching someone's house without a warrant just because they were robbed or assaulted still implicates the privacy granted to them by the Fourth Amendment. The judge here is allowing a warrantless search because there's no one to object to the search, not because it's necessarily completely legal to perform a warrantless search in this sort of situation. This paper [PDF] from the Federal Law Enforcement Training Center points out the US Supreme Court has rejected a "murder scene" warrant exception three times over the last 40 years, and yet many in law enforcement believe such an exception exists.

[T]he courts have outlined a number of “established and well-delineated” exceptions to the warrant requirement of the Fourth Amendment, including, but certainly not limited to, consent searches; searches of vehicles; searches incident to arrest; and inventory searches. However, one exception to the warrant requirement which the Supreme Court has expressly and repeatedly refused to recognize is a general “murder scene” exception. Even so, in speaking with numerous Federal law enforcement officers, many of whom have a state or local law enforcement background, it appears that a misconception regarding this point continues to exist. Most of those with whom I have spoken believe that such an exception is alive and well, and that in the course of investigating a homicide, no warrant is required to “process” the crime scene.

If Amazon wants to challenge it based on those grounds, it can try. But it also may not have the standing to challenge the warrantless search of this customer's device since it would have little possessory interest in recordings created by customers. But it's worth a shot, if only to remind law enforcement (and this judge) that there's no warrant exception for murder scenes.

Filed Under: 4th amendment, amazon echo, crime victim, echo, new hampshire, recordings
Companies: amazon

...And Here Come The Device-Restricted Music Subscriptions

from the oh-good dept

In the last episode of the Techdirt Podcast, we discussed the DRM implications of Apple's decision to remove the analog headphone jack from the iPhone -- specifically, the idea that in the future we may see music services that can only be played through specific output devices, such as a headphone-only subscription. We're not quite there yet, but now Amazon is blazing the trail with the first major music subscription offering with a strict one-device limitation:

Would you pay a few extra bucks a month to turn your smart home speaker into an intelligent, unlimited jukebox? Amazon is betting people will.

The company on Wednesday is launching a new subscription music service, Amazon Music Unlimited, that starts at $3.99 a month for a library of tens of millions of songs. That’s less than half the cost of Apple Music, Spotify Premium and other competing music services.

Here’s the catch: At that lower price, you can only use the new service on a single Amazon Echo device: an Echo, Echo Dot or Amazon Tap

And so we enter a world with yet another means of fragmenting digital music services and making them way, way less appealing. At least they were decent enough to drop the price -- but now that the floodgates are open, it's entirely possible such heavily limited subscriptions will eventually become the new baseline, and truly open subscriptions that can be played anywhere (one of the biggest advantages of digital music) will morph into an expensive luxury. The key difference between this and our speculation about Apple limited output devices is that the restriction happens further upstream, with the subscription only being piped to one specific device -- and if that device is an Echo Dot, there's even still an analog jack so it can be plugged into just about anything else. But the next step -- a subscription on a general purpose device like a phone with music that is artificially limited to only be output through certain devices, thanks to the DRM capabilities of digital-only connectors -- feels slightly and worryingly closer to reality. And what will this accomplish? Nothing more than ensuring legal digital music continues to suck in unnecessary ways.

The grand, omnipresent and incorrect assumption about music piracy is that it's primarily motivated by price, and the desire to get content without paying. It's not and it never has been: it's motivated by restrictions, and the desire to easily access a wide variety of content how, when and where you choose. It's about music being free, but not free as in beer.

And so, naturally, the legacy music industry has sought out almost every opportunity to add restrictions and limitations to their digital offerings. Disruptive innovators like Spotify and Pandora fight an ongoing uphill battle to secure the necessary rights to offer something more open and appealing, and the massive digital retailers -- Apple, Google and Amazon -- drift around in between: aware and capable of the type of technological innovation necessary to make digital music services appealing, and armed with the money and clout to secure better licensing deals from rightsholders, but also prone (to varying degrees) to following in those rightsholders' restrictive footsteps in order to fulfill their own dreams of total control and a captive audience. Amazon isn't banking on people who are out searching for a digital music service deciding to go with the absurdly limited $4 option -- it's targeting existing Echo customers who might see it as a cheap add-on for some extra music around the house. It wants to upgrade those Echo users into Prime subscribers if they aren't already (for even more music, since the services are weirdly fragmented from each other), and eventually turn new Echo-only music subscribers into fully dedicated Amazon Music customers. Instead of making it really, really easy to sign up for a music subscription that gives you everything you want on every device you own, it's ensuring there are plenty of different ways for people to pay up for a tiny slice of that experience.

To some degree, this might work -- it almost certainly won't be the only such experiment, especially with Apple laying the groundwork for even more granular control. But in the long run it won't fix anything, least of all piracy. It relies on people being trapped in a top-to-bottom walled garden, where they are happy getting all their devices and content from the same company on that company's terms, which works to an extent when the gardens are pretty enough, but leaves all the real advantages of digital out in the cold, and the users end up suffering even if they don't all know it. Even after all these years, the music industry has failed to truly offer the one thing that has obviously been the end-game and true promise of digital ever since the first MP3: a one-stop-shop for all the music in the world, delivered as digital data with all the freedom and flexibility that implies. Piracy has offered it since day one, and when it comes to competing with it, the only success stories are those services like Spotify that have fought hard to just offer a real taste of the same comprehensiveness and convenience. Amazon's latest move is a step in the opposite direction.

Filed Under: drm, echo, echo dot, limited, locked down, music services, music streaming
Companies: amazon