Are My Echo & Home Spying on Me?

Are My Amazon Echo and Google Home Spying on Everything I Say?

by Eric Ravenscraft

In-home voice assistants like the Amazon Echo and Google Home are convenient, but are they also a secret back door for the government and corporations to spy on everything you say? No. Of course not. Reports of the Echo and Google Home’s ability to spy on you have been greatly exaggerated.

People are naturally worried about the possibility of putting a device like the Amazon Echo in their home. You’re putting a microphone in your house and telling it to listen to everything just in case you call it’s name? How weird is that? However, there are a lot of misconceptions about how this works, what Amazon does with that data, and how easy it is for a government to get access to the microphone in order to spy on you.

Your Echo Is Always Listening, But Amazon Isn’t

Let’s start by addressing how devices like the Echo and Google Home work. While Amazon and Google say that their devices are “always listening,” that doesn’t mean that they’re always recording. Both devices use local processing to listen for their wake word. This wake word detection includes a running buffer of the last few seconds of audio it picked up, though this data is never transmitted anywhere, and is deleted as new audio comes in. In practice, your Echo would never have more than the last few seconds of audio stored on it.

Once the device detects the wake word—in Amazon’s case, usually “Alexa”—it’s another story. The Echo sends everything you say after the wake word (plus a fraction of a second from before the wake word, according to Amazon) to Amazon’s servers. There, the audio is analyzed to detect your voice command, and the servers send the response back to your Echo. Amazon also stores the audio of your voice command—as well as the response—and ties this data to your account. This isn’t just for Amazon’s benefit. You can see, review, and erase your voice command history, and even confirm when Alexa gets a command right to train it better.

From a privacy standpoint, that voice history may be a concern (and we’ll address that in a bit), but it’s a heck of a lot of better than an entire audio log of everything you’ve ever said in your own home. Simply put, neither the Echo nor Google Home have the capability to record or listen to everything you say out of the box.

Of course, that just deals with their intended purpose.

It’s Still Unclear If the Government Can Demand Alexa Search Data

Even if you trust Amazon or Google with data about your shopping or search habits, it’s reasonable to worry that governments may try to force those companies to turn over data about you. This was a central issue of the 2013 Snowden leaks, wherein it was discovered that many large tech companies were compelled by law or subpoena to turn over data to the U.S. government. Naturally, if Amazon is going to store recordings of even some of the things you say in your home, you might want to know if the company is going to turn that over to the government.

As it happens, a case where this could’ve happened has already occurred. In December of 2016, prosecutors in an Arkansas murder trial demanded that Amazon turn over any audio that the defendant’s Echo may have picked up the night that a man was found dead in the defendant’s hot tub. This was a pretty broad request, since there’s no reason other than blind guessing to believe that an Echo would’ve been activated during a crime. At the time, Amazon challenged the subpoena and refused to turn over its customer data.

Despite Amazon’s resistance, the defendant eventually decided to voluntarily hand over their Echo data. Fortunately, this doesn’t mean that Amazon is legally bound to honor similar requests in the future, but it also means that we still haven’t established a legal precedent for it. In the future, if another prosecutor tries to make an overly broad demand of Amazon’s data, the company may have to put up a whole new fight to defend their customer’s data. Who knows if Amazon will win the next time?

However, regardless of whether Amazon goes to bat for you in a hypothetical future legal battle, the likelihood that your Echo will cause you headaches are slim. For starters, only a small percentage of the things you say in your home are recorded and stored, and you can choose to delete that history if you need to. It’s not impossible that a court could demand your Alexa commands as evidence, but it’s such an unlikely event that it doesn’t seem worth factoring into your buying decisions.

Your Echo Could Be Hacked, But So Could Everything Else

Furthermore, all this assumes that everyone from Amazon to law enforcement are following the rules and being honest. Governments, hackers, and shady companies break the rules all the time, though. So, is it possible that someone could secretly use your Echo to spy on you without disclosing it?

Well, yes, but it’s not so simple. Security researchers found that, with physical access to the device, an attacker could hack an Amazon Echo and capture the raw microphone input, steal Amazon authentication tokens, and more. Of course, that goes for your computers too, and your home in general (hey, if they wanted to record everything you say, they could just hide an old-fashioned microphone somewhere too). Thankfully, getting physical access to your Echo and other devices is a pretty difficult hurdle to overcome in the first place. If you want to prevent a hacker from snooping through your tech, start by screening your house guests.

Then there’s the issue of remote hacks. Sure, the FBI probably has more sophisticated techniques than the average hacker, but there’s no guarantee that an Echo would be the easiest way to snoop on you. Most of us have multiple laptops, smartphones, and other gadgets in our homes with cameras and microphones in them. A laptop running Windows (or even macOS) is generally easier to hack into and record audio, because it’s a much more complex platform and has more possible attack vectors. If you’ve had a computer-connected microphone in your home for years—like the one on your webcam, which can definitely be hacked—there’s no reason an Echo should instill a special level of fear over everything else you own.

As with most privacy issues, it comes down to your own risk assessment. If you’re paranoid about governments, hackers, or corporations listening in on you, the safest solution is always to remove any cameras or microphones from your home. All of us strike some balance between privacy and convenience, but when it comes to always-on voice assistants, they’re not much riskier than most of the other gadgets you have sitting around your house.