Hacker News Reader

Comment by Despegar | Hacker News Reader

Well what a coincidence

https://twitter.com/matthewstoller/status/111599165366219571...

I don't work for Amazon or Google, but I agree with them in this case.

I read through the full text of the bill (http://www.ilga.gov/legislation/fulltext.asp?DocName=&Sessio...) and it seems like it sounds like the companies can be sued if one user agrees to a written policy, but then is used by another user (e.g. a spouse or sibling or friend), which makes smart speakers basically impossible to exist. (User identification isn't good enough, and even if it were, mistakes can happen)

> No private entity may turn on or enable, cause to be turned on or enabled, or otherwise use a digital device's microphone to listen for or collect information, including spoken words or other audible or inaudible sounds, unless a user first agrees to a written policy informing the user[..]

> which makes smart speakers basically impossible to exist.

Then perhaps in their current form, they shouldn't exist. It's already illegal to record people without their consent in many states. We shouldn't give up this right to privacy for a bit of convenience.

By that logic, any device with a microphone and potential to record should not exist.

Smart speakers are not telephone calls, and even if they were, federal law only requires consent of one party to record (11 states require all-party consent).

In public spaces, you generally lose any right to consent to recording. If you're in someone else's home and they record you with their smart speaker device, then your beef is with that person whose private property you're being recorded on. Same as if they were recording you with their phone's camera in their private residence, vs recording you in a public space.

The telephone is only relevant in some jurisdictions. For instance in Illlinois (an all-party state), you cannot record a private conversation. There's no mention of a phone or telecoms, and you should expect to get sued if you're in a conference room recording folks without their consent.

Precisely - the person who owns the conference room and placed the device there should expect to get sued. The person who manufactured the device shouldn't since they didn't use the device to break the law. The owner of the private property did.

It's the same with phone and security cameras - the manufacturers are not the ones at fault when the devices are incorrectly used by owners in states with specific legal laws regarding recording.

Imagine how long the devices would stay on the market if owners started being held liable for what the device does.

I'm not suggesting the device be made illegal, but I do think a ton of common applications should be... and without those applications, the device loses viability.

I imagine they will face the same market consequences that smart phones, security cameras, and other devices that have the potential to be used to record people in private places currently face. Customers with a low tolerance for being recorded simply just won't buy.

Security cameras often explicitly lack audio because of these laws. The other devices you mentioned all have primary functionality that doesn't depend of recording nearby audio arbitrarily. The possible exception is Siri and Google's assistant, which fall into the category of services/devices being questioned in this instance.

Tape recorders are still on the market.

All of those toget devices you mention are activated manually by the user. Smart speakers activate automatically.

They activate on very specific commands. It's no different then adding a trigger phrase to start recording with those devices. Whether it's a VUI, physical button UI, or even motion-sensor triggered is splitting hairs, since the device is still owned and operated by the person who put it there.

It's very different when the trigger is locally a not-so-great guess followed by shipping the audio to a remote service that can make a slightly more informed guess.

> The person who manufactured the device shouldn't since they didn't use the device to break the law.

The issue at hand is that if the manufacturer is the one who turns on the device, then yes, it is 100% them breaking the law.

If my phone is hacked and the microphone is remotely enabled to record a conversation and ends up violating the law, I'm not at fault, the hacker is.

So how is it different if the "hacker" is just the manufacturer using a private channel that they built for themselves?

> By that logic, any device with a microphone and potential to record should not exist.

Not at all, it's how you use it. Cars can run over people but cars can exist; driving over someone is a crime committed by the operator. A machine with a microphone need not be, of itself, illegal.

There is an issue of a secret microphone, as with Google's camera that secretly included microphones. That seems fraudulent because the user is not able to knowledgable decide if she can trust the device.

I understand the distinction you're drawing with regards to the company secretly recording without anyone's consent, but in the imagined scenario discussed in this thread where a spouse or whoever gets recorded after a different user agrees to the terms and conditions wouldn't your reasoning place the blame on the original user who misused the tool, not on the company who supplied the tool? There are scenarios where a user might want to have an always-on microphone in a certain section of their house without violating anybody else's privacy.

No its the responsibility of the device creator. This is more like an analogy where a self driving car killed someone as the company made the device activate under certain commands with no failsafe to prevent users who didn't agree to terms. Company was greedy to get the recordings.

Certainly, as long as the device does not trivialize the violation of those rights. If a car designed for road use by a human driver did not have a windshield to see out of, I'd say it is designed in a way to violate the rights of others.

Are Alexa and others designed to reasonably ensure only consenting users are being recorded?

I mean, that is technically impossible? You have to record a voice to be able to analyze it to determine if the voice is of a person that consented.

This basically would outlaw ANY device that is voice activated, because it has to constantly be 'recording' to be able to be activated.

No, it's not. We can use facial recognition, we can use voice signatures. It doesn't even have to be recorded, as the device setup can record those signatures of consenting users and refuse to transmit or save any data that does not match those signatures.

Tell me, which of these do Alexa and the like perform?

Would it be more difficult? Yes! This is the reality for any company where rights and laws actually matter. If you can't abide, you can't release. Very simple.

Ok, you are using a different definition of recording than me. I would say your definition is "recorded and stored"

I was thinking that in order to fingerprint a voice, you have to "record" it to a digital format that you can process to determine if it is the user who has consented. Even if it is deleted after processing, it was still "recorded" for a few milliseconds at least.

Does the law as written make that distinction? Would recording locally to check a fingerprint not still break the law?

the law on "copying" was abused by the music industry to try to get royalties on the buffering in dismal music devices and computers. The law eventually caught up and now there is no copyright violation in transient cacheing and buffering. I imagine the same will eventually happen for de minimums "recording" used to figure out if you may record or not (e.g. face recognition, voice printing and the like).

You don't need to record it, or at least you only need to record locally the part being spoken while you're doing the analysis; if they've consented you upload the recorded section and then realtime info; if they aren't one that consented you discard the cached snippet and stop recording that person.

Right, but that is still recording, even if it is only temporary and local.

I have practically no doubt that Alexa and others are malevolently spying on their users, I hate to argue their case but I would like to be able to buy one if I wanted to.

Should I be allowed to buy a vehicle without a clear view of my surroundings if I only intend to use it on private land? Should I be allowed to buy a recording device with no privacy features if I intend to use it only in private? Does the potential harm produced by the availability of tools without bells and whistles for public safety outweigh the desires of users who would gladly pay for the bare-bones version and use it private?

I don't believe Alexa and others are malevolently spying, but if the data exists, you should expect nothing less than it to be public at some point, or at least be accessed by someone you'd not expect to share your life with.

You _should_ absolutely be allowed to buy a non-street legal vehicle to operate on private land. You _should_ be able to buy a recording device that has no privacy features. You should _not_ be able to sell a recording device that by default is streaming all audio all the time for common consumers without a big label saying "everything this device is within hearing distance of is now public data and you agree you are in violation of the law, where applicable, for using it".

We are no longer in the days where consumers can be expected to know what their devices are even capable of, let alone what rights are being trampled.

I don’t agree. In your example, being in someone else’s home doesn’t put you in a public space for purposes of recording consent.

A dumb recording device can’t do something illegal without its owner’s/user’s affirmative action. If the homeowner uses the recording thing illegally they’re liable for that use.

In contrast, Alexa and similar devices operate on rules built-in by their builders. They do what their builders intend, not what applicable law or their owners require. Liability should rest with the builders.

Right - being in someone else's home is their private residence. If they break the law using devices there then they are liable, not the device manufacturer. Maybe I didn't specify that enough.

Minor correction, you said:

> private property

When you actually meant:

> personal property

Ultimately what that boils down to is that if I don't want to be recorded, I should stay in my own home and not even visit anywhere, because only at home I can expect privacy.

That's not privacy.

Wait, you can just not give this up by not buying one and not hanging out with your friends who have these.

Why do you want to impose this on the rest of us? Why can't I just let people give me this useful service in my own home?

I think all it means is everyone with a smart speaker should have a sign on their front door informing all who enter that “conversations may be monitored”.

Realistically though don’t a lot of stores have cameras and mics lawfully recording for security purposes? Are they all legally obligated to post warnings?

> Realistically though don’t a lot of stores have cameras and mics lawfully recording for security purposes? Are they all legally obligated to post warnings?

Yes, at least here in the UK.

In the US there is the concept of "Expectation of Privacy" [0] so it depends.

[0] https://en.wikipedia.org/wiki/Expectation_of_privacy

The link elaborates that this concept is enshrined in the US Constitution Bill of Rights (4th amendment), so it covers government surveillance. It is not directly applicable to private entities using recording devices.

I am not an attorney but this guy is https://attorney-myers.com/2013/11/surveillance_cameras_reas...

So? Just because a billionaire tech company is inconvenienced by privacy laws doesn't mean they should be able to ignore them.

> inaudible sounds

What?

Humans have a fairly limited frequency range in which they can hear, typically said to be 20 Hz to 20 kHz, but usually worse than that for most people. There's all kinds of sound in the world that is inaudible to humans.

TV ads emit inaudible (to humans) sounds to track which ads are being viewed.

https://arstechnica.com/tech-policy/2015/11/beware-of-ads-th...

Can average TV speakers emit sounds outside the frequency of human hearing? I didn't think they could.

Yes, most speakers are 20Hz-20kHz or better. Here's a pair of $10 headphones that do just that[0]. Most humans have range inside that band. Those both are really the limits of human hearing and as you get older it dramatically decreases. I remember there were those ringtones (IIRC called cricket?) that used high frequencies so teachers wouldn't hear it go off. Some malls also used high frequency sounds so teens wouldn't loiter outside their stores. Most of these were even below 18kHz.

tldr: yes

[0]https://smile.amazon.com/Earphones-Earbuds-Headphones-Premiu...

The Google speech API supports Speaker Diarization and Android supports voice unlock so they are getting to a point where they are able to ID voices and should be able to tell which voice has consented to being recorded.

But doesn't it have to record the voice to be able to identify it? Once the sound waves are converted to a format that the machine can process, it has been recorded.

To my knowledge, we've generally recognized a difference between recording and immediate processing. Does a voice changer "record" you, if it adjusts the audio on the fly and doesn't store anything? VoIP phones arguably "record" the audio from your microphone and transfer it over the line to output to another party, but we don't call that recording either.

I think the biggest issue here is how smart speakers work: They record your audio and then send it to be permanently stored on Google, Amazon, or Apple's servers, rather than being processed locally and discarded, which we have the technology to do just fine today.

The only reason we're retaining voice recordings is to provide valuable data to the companies in question.

Recording implies storage. It's possible to do voice ID on device and discard any non-matched data.

You can't discard data that is not stored.

Are you really trying to argue over the definition of the term?

Indeed you can discard unstored data.

I write data pipelines for a living. We often use "discard" as a term for parts of data on which no further processing is performed and are not stored.

It's an extremely common usage of the term. See [1] for example.

[1] https://bash.cyberciti.biz/guide//dev/null_discards_unwanted...

>which makes smart speakers basically impossible to exist

Aha! Exactly. However, you could make a smart speaker that doesn't transmit the audio to a server.

Reply on news.ycombinator.com