Recordings
A data request returned 1,700 of a stranger's Alexa recordings
In 2018 a German customer asked Amazon for his data under the GDPR. The download also held about 1,700 voice recordings from a stranger's home, including the bedroom and the shower.
In August 2018 an amazon.de customer used his right under the GDPR to ask what personal data the company held about him. A couple of months later he received a link to a 100 MB ZIP file. About 50 files concerned him, such as his searches. But there were also around 1,700 audio files and a PDF with transcripts of what the Alexa voice assistant had understood. He did not use Alexa and recognised none of the voices.
On 8 November he told customer service that the files were obviously someone else's. He got no reply, but the download link soon stopped working. He had saved the files, and turned to the German computer magazine c't. The recordings covered a whole month: a speaker at home, a device connected to the TV, a smartphone; the living room, the bedroom, even the shower. Alarms, music requests, public transport queries and smart-home commands sketched out a household's habits. From weather queries and the names spoken, c't quickly identified the owner and his girlfriend, and told them.
Amazon had not informed him. Three days after c't's inquiry it phoned both customers, called the case human error and an isolated incident, and said it had contacted the authorities as a precaution. As compensation, the man whose recordings had gone astray received a free Prime membership and two new Echo devices.
In c't's view, this could only happen because Amazon kept the recordings in the cloud indefinitely. Users could delete them by hand, but it was unclear how many knew.
What can we learn from it?
A voice recording reveals a great deal: names, routines and relationships can be heard in it, and once it sits in a provider's cloud it is part of every process the provider runs – here, answering a data request. AI transcription can still be very useful in professional work; the question is only where it happens. In Confiella the recording does not leave the computer, the transcript is made locally, and deleting a case removes everything. Whatever tool we use, it is good practice to keep recordings where we control them, and to delete them as soon as they are no longer needed.
Sources
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]