Arkansas Murder Investigation Involving Amazon Echo Raises Privacy Concerns

The case stems from November 2015 when Bentonville police found Victor Collins dead at the home of James Bates, who was subsequently charged with murder. As part of the investigation, police noticed an Echo on the kitchen counter and sought to get the audio recorded on the device. The police issued a search warrant to Amazon, which has resisted the request.

A spokeswoman emailed that the company "will not release customer information without a valid and binding legal demand properly served on us. Amazon objects to overbroad or otherwise inappropriate demands as a matter of course." But Nathan Smith, the prosecuting attorney for Benton County, Arkansas, emailed that "it is incumbent on law enforcement officers to examine this data to determine if it has any relevance to the crime" since the murder occurred in the defendant's house.

"While many privacy advocates have expressed interest due to the technology involved, this case is really about seeking justice for the victim," emailed Smith. "Obtaining a search warrant from a judge based on probable cause is the constitutionally authorized means for law enforcement to conduct searches of homes, property or computer devices like the Amazon Echo." He said police have followed "constitutionally mandated procedures" to get a warrant and he's "hopeful" the company will comply.

Amazon may not have complied with the warrant, said Chris Calabrese, vice president-policy for the Center for Democracy & Technology, because the company may think Echo is covered by the Wiretap Act, which covers voice communications. If that's the case, he said police would need more than a warrant to listen to, for instance, a phone call or an audio recording from an Echo device. He said authorities may need to get a court order under the Wiretap Act that imposes more requirements than just probable cause and which also shows that they have "exhausted other investigative techniques" before gaining access the communications, which Amazon may think the police haven't done. CDT Policy Counsel Joe Jerome wrote a Jan. 4 blog post about the case, explaining how the Wiretap Act and Stored Communications Act fit in.

Calabrese said the information collected through this device is very sensitive and needs a high level of protection. "We should have that zone of privacy protection in our house," he said. He said the case highlights that people may not have thought of all the implications of this new technology, and it's important to have Fourth Amendment protections. If authorities go to a higher court to force Amazon to provide this information it could set a precedent, he added.

Lynn Terwoerds, who co-founded the Voice Privacy Alliance, an initiative of the Executive Women's Forum (EWF), said neither she nor privacy experts her group has talked with are aware of any case law related to voice-enabled IoT. "We'll see more of this," she said. She said it's important to understand not all voice-enabled IoT devices are the same or always listening. Some like the Hello Barbie doll and smart TVs need to be manually activated, while baby monitors and Alphabet/Google's Nest security cameras are always on, she said. Devices like Echo are typically activated through a "wake word" or "phoneme" like "Alexa," which are unique words that don't sound like any others, she explained.

When a person utters "Alexa," the device records a few seconds before that word and what the individual says afterward, which then is stored in Amazon servers, said Terwoerds, who is EWF's executive director. "I'm real interested in the fact that somebody thinks the data ... something that's ephemeral, is actually going to yield something that can be used legally. I don't know. I'm not an attorney," she said. "Common sense leads me to believe that unless I'm placing orders for ... strangulation devices from the Amazon marketplace, I'm not sure what these guys are going to get." She said customers also have the ability to selectively or completely delete recording history.

“A lot of this is kind of an overreaction you see whenever anything this new and [the] first time something happens and people kind of get up in arms about things and then they go away," said Information Technology and Innovation Foundation Vice President Daniel Castro. "The government is within its rights and responsibilities to access that information. We are talking about a murder case." He said people will be fine with this kind of access as long as government doesn't abuse its authority. "That's always the question that's out there: Is government exercising restraint where it should’ve, not co-opting technology to make it something that could be used for surveillance?" he said.

For technology companies, Castro said, the question is how much information should they retain on their customers and provide or should only their customers have access to it. Those decisions will have implications for policy that need further discussion, he added. "There’ll be more requests for data like this," he said. Castro said he didn't think the Echo device in the Arkansas investigation would yield anything relevant, but in the future such information could help solve a murder or find someone innocent.