SUBSCRIBE NOW!

Vol. 31 No. 2 — March 2017

Police soon began to question the story. After a search of the residence, information began to turn up that cast doubt, including signs of a struggle, such as blood spots around the tub, broken bottles, and another bottle found across the yard. Within a few days, the coroner determined that Collins’ death was the result of a homicide, and a search warrant was obtained for Bates’ house. The search of the house found other evidence of a struggle, including additional blood spots, and a further search of the hot tub found a broken pair of eyeglasses and a broken shot glass.

‘Search and Seizure of Electronic Devices’

With Bates as the prime suspect, a second search warrant was issued for his residence, specifically, “for the search and seizure of electronic devices capable of storing and transmitting any form of data that could be related to this investigation.” It turns out that Bates had extensive technology throughout his home—multiple smartphones, computers and tablets, a Nest thermometer, WEMO devices in the garage, a wireless weather monitoring system, and an Amazon Echo. The Echo and other portable devices were seized pursuant to the search warrant, and about 2 months later, investigators had enough evidence to arrest Bates for the murder of Collins.

While the police had enough evidence to constitute probable cause, they did not yet know all of the information that might be available through the Echo. They issued a search warrant to Amazon for the data from it, but as of this writing, Amazon has declined to comply with the warrant, indicating in a statement that a “valid and binding legal demand” that is not “overbroad or otherwise inappropriate” is needed before the company will release customer data.

Right to Privacy

The case has raised new and provocative questions about privacy in an era that goes beyond smartphones to offer smart cars, smart appliances, smart homes, and other objects that transmit information. Does the right to privacy, which is recognized most strongly in a person’s home, continue when devices in that home are recording data and sending it to third parties?

The right to privacy is not absolute. When a government body is seeking normally private information, the Fourth Amendment becomes the most significant factor. The amendment states, “The right of people to be secure in their persons, houses, papers and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue but upon probable cause. …”

Expectation of Privacy

Court decisions interpreting the amendment have focused on the word “unreasonable,” which creates the implication that some searches are actually “reasonable,” and therefore no warrant is required. The Supreme Court drew the distinction by focusing on the expectation of privacy a person has with regard to the information being sought. If the person has an actual and recognized expectation of privacy, a warrant is required. If, however, there is no such expectation, a warrant is not required.

Other court decisions have held that information shared with a third party may not have any expectation of privacy by reason of it being known by another. This applies even when the information is a necessary or unavoidable part of a transaction. Information about subscriptions to services has been held to be accessible without a warrant; however, you generally need a valid search warrant to access the content of emails, messages, browser histories, and other electronic communications.

It appears at first glance that a warrant will be required to obtain data from an Echo or another smart device. The other question is what information can be gleaned from an Echo. It is reported to be listening constantly for its “wake word” (either “Alexa” or “Amazon”). Although it is always listening, it does not retain any information unless or until it hears the wake word. At that point, it is actively recording not only the specific request, e.g., “Alexa, play my Springsteen playlist,” but also any ambient or background noise. The request is transmitted to Amazon servers, analyzed, and executed. The Echo continues to record until the request is completed, wherein it stops recording.

Amazon holds the recordings in cloud-based servers. Echo users can log in to their accounts and delete those recordings, but until they do, the information would be vulnerable to a warrant. The possibility also exists that the device could activate upon hearing something that sounds similar to the wake word and simply record and transmit background noise for a period of several seconds or more.

Recording a Murder

Could it record a murder? While in theory anything is possible, the more likely concern is that an Echo or a similar device will record information that could be, along with other information, evidence of a crime. But it could also provide other private information that could unexpectedly be recorded and subject to access. So could other smart devices, and therein is the challenge. As the Internet of Things—connected cars, refrigerators, thermostats, coffee makers, watches, etc.—becomes a more ubiquitous part of our lives, we’ll need to be cognizant of the privacy impact of its devices, up to and including criminal liability.

This article originally appeared as "Killer App" in the March 2017 issue of Information Today.