January 17, 2017

Fight Over Amazon Echo Access in Murder Case Raises Internet of Things Privacy Concerns

Christina Liu – January 17, 2017

A recent legal fight about possible evidence involving Amazon Echo, the Internet-connected digital assistant marketed as “Alexa,” has raised serious privacy implications relating to the Internet of things (IoT). This could be a test case for how evidence rules apply to connected devices in the home, including smart appliances to smart security systems, thermostats, and lighting systems.

The issue arises from the death of Victor Collins, who was found dead in the hot tub of Collins’s friend, James Andrew Bates, in Bentonville, Arkansas on November 22, 2015. Bates was later charged with murder. The two had been hanging out, watching football, and drinking with two other friends at Bates’s home. One of the friends left but Collins and another stayed after Bates told them they could sleep on the couch and extra bed. Bates allegedly went to sleep and at some point in the night Collins died in the hot tub. The cause of death was strangulation and drowning as a secondary cause.

Prosecutors the Bates case issued a search warrant in August 2016 for all “electronic dates in the form of audio recordings, transcribed records, or other text records related to communications and transactions between an Amazon Echo device” from Bates’s Amazon Echo. This request appears to be part of the prosecutor’s due diligence. The prosecutor had no specific indication if there was any recorded statements or other evidence on the device. Amazon has objected to the warrant as overbroad as a matter of practice and has stated to media that it will not  release customer information without a valid and binding legal demand properly served on it. Amazon did give prosecutors information about Bates’ account and purchase history.

Logistically, the Echo keeps less than 60 seconds of recorded audio in its storage buffer. As new audio is recorded, the old is erased. Only when the Echo hears its wake-up word does it begin sending a stream of audio to the cloud to be converted into text that the program can understand and act on. The requests are saved, though Amazon allows users to erase their voice recordings. It is also possible to turn the Echo’s microphones off to keep it from listening.

The court is tasked with balancing the amount of useful audio data prosecutors may be able to recover versus individual privacy rights at issue. Commentators have observed there may be very limited material evidence kept by the Echo, and given a balancing test, may not overcome Bates’s right to privacy.

More broadly, users of IoT should be aware that all IoT devices have the possibility of being implicated as sources of evidence in criminal investigations. Since no clear legal standards have been established for access to IoT data, consumers and their counsel should be on alert for law enforcement and criminal hacker attempts to obtain access. Stay tuned for the various legal battles to come.

Christina Liu is a senior associate at Cole Sadkin, LLC, in Chicago, Illinois.

Christina Liu – January 17, 2017