Amazon Echo & Smart Devices: Considerations In Litigation And eDiscovery
In recent years, information requests from Law Enforcement have risen dramatically. Majority of these requests are either subpoenas, search warrants, or court orders. Notably the colossal increase of over 500% from 2019 to 2020, followed by the first 6 months of 2021 where there has been nearly as many information requests as there was in total in 2020.
Amazon (excluding AWS) Information Requests
- 2018: 4,408 Requests
- 2019: 4,903 Requests
- 2020: 30,769 Requests
- Jan-July 2021: 30,118 Requests
Source: https://www.amazon.com/gp/help/customer/display.html?nodeId=GYSDRGWQ2C2CRYEF
But the increase in requests for information doesn’t necessarily mean that the technology giant is going to happily comply and hand over the data. On Amazon’s Help webpage under Help & Customer Service > Security and Privacy > Law Enforcement Information Requests, it reads “Amazon does not disclose customer information in response to government demands unless we’re required to do so to comply with a legally valid and binding order” additionally they also state “We have repeatedly challenged government demands for customer information that we believed were over broad, winning decisions that have helped to set the legal standards for protecting customer speech and privacy interests” making it their stance on the issue relatively clear.
This was the case in a recent 2018 trial when courts requested Amazon hand over data from an Amazon Echo device that was at the scene of a double homicide. In response to the request, Amazon gave the above noted response citing that they were both protecting end user confidentiality and that the request was overly broad [2] [3].
This isn’t the only case where Amazon’s smart devices have being called on as central witnesses to a case so to say, a few other publicized examples can be found here and here.
Amazon has an entire line of smart products, but the Amazon Echo may be arguably the most popular and integrated into our digital lives. But what data does the Echo actually collect and retain? In the case of the Echo, a smart speaker with Amazon’s AI interface of Alexa built in, the device doesn’t actually store much information at all. The device itself has roughly 60 seconds of bandwidth available as local storage. Rather than storing data locally, the device records and transmits data into Amazon’s serves once a “wake” word is spoken.
While the device is actively listening, it is not actively recording until this “wake” word is said. For an Echo, the wake word is typically “Alexa” or “Echo”. Once activated, the device transmits recordings to the cloud which are then transcribed and indexed in order it was recorded.
A direct result of the data not being stored locally on the device means that the data can only be accessed directly from the host, which in this case is Amazons servers. It’s a bit cloudy on how long Amazon retains the logs of this data along with the actual voice recordings which only adds to the complexities of collecting and managing data from Amazon.
It also raises the issue of data proliferation at an enormous and rapidly increasing pace as a direct result of the increased adaption of smart products into our everyday lives. So while it is currently difficult for even law enforcement to compel Amazon to produce information relevant to lawsuits, we can continue to ask for transparency and push the need for access to this information in regards to forensic collection and investigation. If smart technology is not going anywhere, then it is even more important to create seamless workflows to integrate these technologies into litigation rather than putting up barriers of access.
Resources
[1] https://www.amazon.com/gp/help/customer/display.html?nodeId=GYSDRGWQ2C2CRYEF
[2] https://www.washingtonpost.com/nation/2018/11/14/police-think-alexa-may-have-witnessed-new-hampshire-double-slaying-now-they-want-amazon-turn-her-over/
[3] https://time.com/5451863/amazon-echo-stabbing/