Hacker News Reader

Comment by notlisted | Hacker News Reader

Alexa listens only to the words after the wake word. What's more it doesn't capture more than 10-12s past the wake word. If you have a device you can check this yourself (Alexa, One Mississippi, Two Mississippi…).

It's actually hard to get it to capture this much. Take a breath or pause to long and capture stops sooner.

The request of the police is nutty and indicative of not understanding the technology. Unless the murdered woman yelled out "Alexa {pause a little bit for wakeword recognition} Heeelp, my husband is killing me, call the police" or the husband asked "Alexa, how do I clean a bloody hottub", nothing material will be discovered.

I have 4 of them. After the first one I checked what was captured, what was stored, what was streamed. Nothing that mattered.

View on HN

Checking this by saying "Alexa, <long string of words>" and seeing at what point it starts doing something does not prove that it's not listening all the time, doesn't prove that it doesn't keep recording, and in general only tells you about Alexa's UX, not the underlying technology.

It stops listening. No action required. You can check in the Alexa app what is recorded (I just did). You can also check what is sent out to Amazon (which is what I did when I got the first one, using wireshark). The hardware is listening all the time, for the wake word. Nothing is sent until a wakeword is received.

But you don't know what audio data the local device itself is storing as an implementation detail.

True, it does have an 8GB flash drive, according to iFixit (4GB in the Echo Dot). For now, I'm giving it the benefit of the doubt. My cell phone is a much more useful target for the government (location, video/audio, browser history).

Or if your Alexa is turned into surveillance mode from Amazon, on police request or for nefarious reasons.

That's exactly what Amazon would like there users to think. How do you think he wake work is detected? It MUST be listening to some sort of ambient audio, wether that is recorded or kept in anyway, only Amazon would know.

Amazon doesn't use telepathy. You can inspect the network traffic on your router and the contents of its local storage.

But that won't give you the whole story. They could batch up the network traffic to send later, or push an update that changes how much they listen after your traffic monitoring is done.

>They could batch up the network traffic to send later,

I was thinking that too, but realistically, someone would eventually discover this (consider how much outbound traffic would have to go at once in order to store that much audio).

>push an update that changes how much they listen after your traffic monitoring is done.

Again, someone would eventually discover this. It wouldn't be hard to constantly monitor network traffic for noticeable discrepancies in outbound activity.

Furthermore, a discovery like this would not go overlooked by the general public. Amazon would be doing a serious disservice to their reputation by going about extracting the audio in such a mischievous manner.

I can't say I agree. How long did it take for us to figure out that certain camera's were sending photos back to china? or that other apps do things that seem malicious. Many people watch those kinds of stats, but the vast majority of them don't.

Additionally, just because they have it always recorind for one person, doesn't mean they have the same software running for everyone else.

The wake word is detected by the hardware. There's a reason why there are just 3 (Alexa, Amazon, Echo).

PS I'd love to call mine 'Computer' or 'Hal'.

Btw Amazon has refused to give a clear answer about how much is actually being recorded. Look at the top comment in this thread.

TheInformation's article includes a bit more info and this tidbit:

> As most owners probably have experienced, the microphones can often be triggered inadvertently. And those errant recordings, like ambient sound or partial conversations, are sent to Amazon’s servers just like any other.

When I use my Echo in my apartment alone I don't have a lot of false positives on the wake-word detector. This past week I've been in my family's home and very frequently when more than one person is talking Alexa has butted in (and tried its hardest to understand what we're saying, listening for the maximum time it can).

I think the hope is that if some ruckus was happening in the home, the Echo might've accidentally woken up at some point and recorded a small bit they can use to help piece together the crime.

Absolutely right. The people here gleefully, cynically dismissing this as police stupidity would be demanding the police investigate even the smallest lead to help get justice for the murder of a loved one. If there's even a small chance the always-activated audio recording device in someone's home was inadvertently activated in the commotion, why wouldn't the police investigate it as an option? Even if there's not a recording of "help amazon my husband is murdering me," what was captured may help verify other evidence or set a timeline. Hell, even being able to prove the crime had or had not taken place at a certain hour based on whether Alexa was being used for its usual purpose is potential evidence.

I'm not sure you and I have the same definition of "listening". It must listen to hear the wake word, and likewise must process incoming sounds to do so. If you know of a way to do that without storing the incoming sounds, even if just briefly in temporary memory, I'm all ears...

>"The request of the police is nutty and indicative of not understanding the technology. Unless the murdered woman yelled out "Alexa {pause a little bit for wakeword recognition} Heeelp, my husband is killing me, call the police" or the husband asked "Alexa, how do I clean a bloody hottub", nothing material will be discovered."

The police often check search histories in murder investigations. Do you also suppose that is only useful if the victim googled "Help, my husband is murdering me!" ?

Maybe you should leave the policing to the police.

> Alexa listens only to the words after the wake word.

It only records after hearing the wake-word. It listens all the time.

> After the first one I checked what was captured, what was stored, what was streamed.

How did you MitM the SSL?

Alexa is the service in the cloud - Alexa doesn't get the words that are spoken before the device (the Echo / Dot) detects the wake word.*

This sounds like a small distinction, but it is critical to a clear discussion of what's going on.

If you review the interaction history in the Alexa app or on Amazon's web site, you won't see those utterances that did not result in detection of the wake word, because that audio was not streamed to the cloud.

* Technically, there is a very short buffer of audio that is captured on a rolling basis in order to detect and stream the front of the wake word sound.

Looked at connections/durations (ie not content).

I think the thing they are hoping for is accidental invocations, I've had instances in the past where something on the TV has 'awoken' the echo, even without saying 'Alexa'

Sure, maybe they don't understand the technology, but why not just hand it over so they can determine for themselves that there's no data pertaining to the investigation. They're essentially obstructing justice. They're trying to act like the good guy, but they're really just being assholes.

Of course there's the possibility that they have something to hide and are actually collecting more data than we all think they are.

How are they obstructing justice by simply asking for a warrant? Should they simply divulge private recordings to any random cops that ask for it? Is that how you wish companies treat your data?

They were given a warrant. Did you not read the article?

>Bentonville issued a warrant for Amazon to hand over any audio or records from an Echo belonging to James Andrew Bates.

If Amazon handed out my data to third party, that would be being an asshole

The request is not nutty, perhaps the victim was aware enough to ask "Alexa, Call the Police!". FWIW This could be a great replacement to those fallen and I can't get up buttons for the elderly.

> Unless the murdered woman yelled out...

The victim is named Victor Collins; probably not a woman.

It doesn't matter, people will still tinfoil hat that the thing is listening and uploading everything they say.

I had this exact same conversation with a number of people when the news came out about the Echo being in the Wynn Hotel in Vegas.

Given Stuxnet, your position seems dangerously naive.

There is really only one question: can this device be remotely modified to passively monitor a specific device in a way that is relatively undetectable to the end user?

If the answer is no, then fine. If the answer is yes, then what guarantee do you have that the ratchet of tyranny will not eventually deploy those capabilities? "I'm not hiding anything" is a poor response.

People have discovered how to at least gain access locally. https://github.com/echohacking/wiki/wiki

https://www.reddit.com/r/netsec/comments/4inesj/rooting_the_...

Am I saying people shouldn't be skeptical? No. But I'm saying people are focusing on a subset of devices when they've had cordless phones, cell phones, and PCs in their homes for decades.

I just get tired of the constant fear-mongering, if we have evidence of a problem, call out Amazon and have them fix it.

The cops in this story are banking mostly on the fact that it was accidentally triggered and they have some kind of audio, that's legit. Yet this article was written as if Amazon might magically expose some recording capability.

PCs, cell phones, and cordless phones have all previously been tapped or hacked on behalf of law enforcement and other actors, so people generally know and understand what they're getting into there.

These microphone devices are new. People, even HNers, mistakenly think that these devices are not listening until a magic word is uttered (full stop). Many people will not realize that the connection to the internet is bidirectional for data AND code (updates). That's really bad - it means that people don't understand the capabilities of the device they've brought into their homes.

There is a problem here and the evidence is plain: (a) wide spread ignorance about how these things work, and (b) the hot mic combined with the network connection imply a capability, even if currently unexpressed. Device manufactures are not adequately informing the public of the possible side effects of these products.

Therefore, I believe that LE should gain access to these devices with a warrant under the Third Party Doctrine, and that these warrants should be published on sites like HN so that people may become aware just as they are aware of taps on phones.

I think the previous posters point is that the risk incurred by an Amazon Echo is the exact same as any modern smartphone. That iPhones and Android devices have supported Ok Google and Hey Siri for a while now, are also already always listening, and already get OTA updates.

Your claim that "these microphone devices are new" seems to imply you're excluding almost every smart phone we already have in our pocket, with the exact same network attached hot mic concerns.

I don't care if it is or isn't listening; it can, listen, if its owners want it to, because they control the software it runs. I can't do anything to control that save refuse to own one, so that's what I'll continue to do.

Reply on news.ycombinator.com