Amazon case challenges privacy standards
BENTONVILLE, Ark. — A brick house on Elm Manor Avenue is all but being called to the witness stand after a man was found floating in a backyard hot tub, dead.
James Andrew Bates, the man charged with murder in the case, maintains his innocence and has kept mostly silent. But prosecutors hope his home, with its array of internet-connected speakers and sensors, will be more forthcoming.
That story, with all its sci-fi coloration, galvanized privacy advocates after a Bentonville death investigation made national headlines on the promise of another clash between government agencies and tech giants over access to consumer data.
Those legal questions feel abstract to Kristine Collins, who lost her husband, Victor Collins, in the 2015 homicide.
“I really wish that Amazon would comply with what they’re being asked to do,” she said in her first public comments since her husband’s death.
Like her husband, Collins works in law enforcement and has just returned to her job for the first time since his death. She has sought to remain anonymous through a bombardment of interview requests, concerned for the privacy of her children. A court verdict would help her family regain its footing, she said, and she “would like for the prosecution to have all relevant information.”
Nathan Smith, Benton County prosecutor, says the warrant issued by his office for data held on Bates’ Echo smart speaker could help the death investigation, adding that it is not an unusual incursion into a private life.
When it comes to privacy protections, “there is a line that can be crossed that’s as old as the Constitution itself,” he said in an interview this past week. “And that’s through a search warrant.”
The warrant, approved in April by Circuit Judge Brad Karren, requires Amazon.com to provide law enforcement officials with “audio recordings, transcribed records or other text records” collected by Bates’ Amazon Echo smart speaker around the alleged time of the murder.
It was first reported this past week by The Information, a news site that covers the technology industry.
Smith says he doesn’t know whether data relevant to the investigation is stored on Amazon’s servers and says it doesn’t matter so long as Karren believes it could be there.
“It’s like wondering what’s behind a locked door,” he said. “I don’t know what’s behind it before I open it.”
Introduced by Amazon in 2014, the pint-size speaker can be activated at any time by a predetermined “wake word.” One of those words is “Alexa,” Amazon’s name for the digital voice that can tell jokes or recite recipes upon request. On its website, the company says the Echo streams audio to cloud-based storage when a user addresses Alexa and that it stops recording once a question or request has been processed.
In seeking the recordings, prosecutors have stoked debate about data produced by the so-called internet of things — internet-connected devices that can transmit and store a wide range of information about their owners’ lives.
Ten years ago, computer programs were able to accurately recognize human speech at a rate of 20 percent. Today, they are approaching human-quality speech perception. Between rapid advance of such technologies and falling production costs, they are expected to proliferate. Amazon says sales of Alexa devices are booming, and Ford Motor Co. just announced that it will begin installing Alexa voice-command software in new vehicles.
Take the home of James Bates. In addition to his Echo speaker, the house was outfitted with a security system, a smart water meter and a smart thermometer. A light switch that can be activated by a smartphone was sitting in the garage, waiting to be installed.
Data from those devices has already been offered as evidence by Bentonville police. Readings from the water meter show that the home’s water use jumped to its highest levels ever around the time of Collins’ death, suggesting Bates could have attempted to wash away evidence of the murder, according to a probable cause affidavit.
Because prosecutors have a warrant for the information, privacy advocates say Bates’ constitutional rights are likely not being violated. But regulators and legal advocates say the new technologies pose broader privacy questions for a society that increasingly lives online. In many cases, consumers may not fully understand what data is collected and where it is being stored, exposing them to abuse by cyber criminals and law enforcement officials.
“That there is a warrant goes a long way toward meeting the constitutional balance” between privacy and the need to gather information to prosecute crimes, said Jeffrey Mittman, director of the ACLU in Missouri. “Our laws and policies need to catch up to the new world we’re living in.”
A worker in a local store with an electronics section said no customer has ever asked him what data is recorded by the Echo speakers.
“They just ask where they are” on the shelf, he said.
Two teenage customers told a reporter they didn’t know how the technology works either.
As they perused smart speakers and video game controllers, one took a stab at the Echo’s inner workings but was interrupted by his friend:
Alexa “could be listening …”
“But then simultaneously deleting.”
Regulators are concerned that the combination of irresponsible companies and uninformed consumers can make consumer data vulnerable to bad actors online. Maneesha Mithal, associate director of privacy and identity protection for the Federal Trade Commission, says her office brought its first “internet of things” lawsuit in 2014 after consumers who bought wirelessly connected baby monitors found live video of their infants posted online.
“There continue to be serious concerns about the security of IOT devices,” she said.
A flash point came earlier this year when Apple refused the FBI’s request to crack open an iPhone used by the perpetrators of a 2015 mass shooting in San Bernardino, California.
Smith, the local county prosecutor, says there are instructive differences between that case and his office’s dispute with Amazon, especially because no warrant was issued during the earlier clash.
In that case, Apple contended that it would have to create new software in order to beat the phone’s password protections. Such technology, it said, could be used to open other phones.
By contrast, Amazon already has access to the data requested in the Bentonville case, though the information may not ultimately impact the case.
In testimony included in the warrant, a Bentonville detective said Amazon representatives told him they were “in possession of the requested data in the search warrant but needed to consult with their counsel prior to complying with the search warrant.”
Still, the company has not yet handed over the Echo’s data, according to the prosecutor.
Calls and emails to Amazon for this story did not receive a response. Kinley Pearsall, a spokeswoman for the company, told The Associated Press that it “will not release customer information without a valid and binding legal demand.” She added that Amazon objects to “over-broad or otherwise inappropriate demands as a matter of course.”
Mittman, of the ACLU, says that as more data is collected on individuals, the courts and regulators must race to define the right to privacy for the internet age.
He resists the notion that consumers are simply choosing to put more of their lives in the public sphere, suggesting that people who grow up with social media accounts also have a sense of privacy that will have to be protected by new legal standards. It may be that the line between public and private is now online — not in the four walls of a home.
“Are we putting more out there?” he asked. “No, I really don’t think we are. Has modern technology expanded where our home is? I think it has.”
Maneesha Mithal, a top federal regulator for the Division of Privacy and Identity Protection, said there are several things consumers can do to protect the data collected by internet-connected devices.
–Research online before buying one of the devices: Check to see whether the maker has a history of security breaches.
–Make your own passwords: Any default passwords should be changed immediately after purchasing the device. That makes it harder for hackers to guess their way into your account.
–Download the latest security updates. Companies continually work to shore up their products’ defenses. Put their work to use.
(c)2017 The Joplin Globe (Joplin, Mo.)
Visit The Joplin Globe (Joplin, Mo.) at www.joplinglobe.com
Distributed by Tribune Content Agency, LLC.
This content is published through a licensing agreement with Acquire Media using its NewsEdge technology.