How the “Internet of Things” Could Become a Liability

January 4, 2017 Brent Marshall Criminal Defense Social Share

James Bates of Bentonville, Arkansas claims he woke up on November 22, 2015 to find his friend, Victor Collins, dead in his hot tub.[1]  At about 9:30 AM Bates called 911 to report that he found the body after a night of heavy drinking with Collins and another friend.

[2]  Bates claims to have no memory of what occurred, but the state of Arkansas contends that there is evidence of a struggle and a cover-up of the ensuing murder.[3]  This seems like a standard case for a criminal defense attorney, collecting evidence to prove Bates’ side of the story.  This case has morphed into one that is far from ordinary, with the potential introduction of evidence from smart devices around Bates’ home.[4]  Investigators analyzed Bates’ water heater in order to conclude it used far too much water in the early hours of the morning when the cleanup would have occurred.

[5]  Further, headlines exploded around the country when Amazon was served with a warrant for recordings from Bates’ Amazon Echo device.[6]  Digital voice-based assistants such as Amazon Echo and Google Home are designed to always be listening for a “wake word” an then proceed to record what is said afterwards.[7]  They by-design record what happens after the wake word, and then analyze the statements in order to learn how to more effectively control smart devices, navigate tasks, and query for information in the future.  These recordings are what state prosecutors hope to use in the case against Bates, and have sought to recover via a warrant served to Amazon.

[8]  Meanwhile defense attorneys, working on behalf of Bates have discredited the potential use of this data, citing the Amazon user agreement, and Amazon’s assertion that it cannot guarantee the “functionality or content … is accurate, reliable, or complete.”

[9]  The defense attorneys have claimed that the use in court would be “crazy” with this disclaimer in place, and have gone on to state that “There’s nothing on the Amazon Echo that will hurt us . . . We’re not fearful of anything being provided if Amazon does indeed respond.”[10]  The potential use of these devices has understandably scary implications, their current structure only records audio after the

The potential use of these devices has understandably scary implications, their current structure only records audio after the wake word has been said, but there are fears this could change with simple programming tweaks.  Devices such as these comprise of the “internet of things,” a term used to describe the networking of standard everyday devices so that they are able to send and receive data. [11] 

Privacy issues with devices such as these are not a new topic of concern.  The Chromium browser is the open-source basis for Google Chrome,[12] the most widely used browser in the world.

[13]  Developers found that the browser was installing code that would listen for and share audio based on “an audio transmission triggered by . . . an unknown and unverifiable set of conditions” and potentially “without [the users’] consent or knowledge.”

[14]  Concerns with “always on” recording and the legal status of this data have extended to Samsung, Mattel, Microsoft, and others.[15]  Data collected by these devices have until now not been a concern for criminal defense attorney’s facing litigation though.  “Alexa,” Amazon’s always on software which is the heart of the Bates’ case is the first that has been addressed from a criminal evidentiary standpoint.[16] 

The software is designed to collect recordings of audio upon hearing the wake word, and relay that data to Amazon’s cloud-based servers, and “Amazon has not disclosed the extent to which the company will have access to the data collected by these third party devices.”

[17]  To further compound the privacy concerns, Amazon allows developers to create “skills” (third-party programs to create a specific functionality) and capabilities for the Alexa service.[18]  These skills could allow extra data to be recorded, data which Amazon has not explained any kind of standard for safeguarding.  The Electronic Privacy Information Center has argued during lobbying efforts that it is “unreasonable to expect consumers to monitor every word said in front of home electronics” and has gone as far as stating that the general practice of adding “always on” listening “is also genuinely creepy.”

The Electronic Privacy Information Center has argued during lobbying efforts that it is “unreasonable to expect consumers to monitor every word said in front of home electronics” and has gone as far as stating that the general practice of adding “always on” listening “is also genuinely creepy.”

[19] The practice of adding “always on” features being labelled “creepy” and invading the privacy of those users will not help criminal defense attorneys such as those in the Bates’ case however.  Any information Amazon discloses will likely be admissible in court, as long as it is relevant,[20] as statements made by a party opponent are generally not considered hearsay.

[21]  The inclusion of this evidence is going to be up to Amazon, and any court rulings regarding the warrant served to them.[22]  At this time, Amazon has only stated that it “will not release customer information without a valid and binding legal demand properly served” and that “Amazon objects to overbroad or otherwise inappropriate demands as a matter of course.”

[23]  What this means for the future of Bates’ case is unknown.  This case could have far reaching implications though, as these “always on” devices and the data they collect could theoretically be used in a myriad of cases, not just criminal.  Whether or not this will be technically or legally feasible just remains to be decided.

  Social Share