Amazon (AMZN) gets sued all the time, but this one should get your attention. Are the plaintiff's lawyers preying on technophobia, willfully ignorant, or is there something here?

Today's essay asks if there is a significant difference between a child using Alexa, or using a smartphone or tablet. Willful ignorance is dangerous – but not understanding the difference between data privacy and digital identity is way more dangerous.

The lawsuit filed against Amazon’s Alexa Voice Services this past Tuesday fascinates me. It alleges that Amazon is recording children who use Alexa without parental consent. Excuse me? Mom or Dad bought the Echo, put it in the house, and taught the kids to talk to it. How much more parental consent do you need?

Perhaps this lawsuit is about terms and conditions. That would be fine. Amazon is a big company, and it has a duty to properly educate consumers about how its products work and how the data it collects will be used. (If only the lawyers who filed this suit were Amazon suppliers, they’d know just how safe, secure, and unattainable that data actually is. But that is a story for another day.)

Perhaps this case is just a matter of a bunch of technologically inept lawyers trying to make some quick settlement money by scaring the hell out of everybody. That would be okay, too. It would take time, but the case would yield a good outcome as a teachable moment in tech history.

On the other hand, maybe these lawyers believe that there actually is someone listening or reading the commands, and that the data collection methodology is somehow different from giving a 10-year-old a smartphone or tablet and letting the child play a game on it. Willful ignorance is dangerous – but not understanding the difference between data privacy and digital identity is way more dangerous.

How Does My Echo Device Work?

Amazon says Echo devices do not store recordings; they use automatic speech recognition (ASR) to determine what has been said, analyze the text with a natural language understanding AI, and do their best to act on the input, and then the text is stored in your Alexa app’s history stack. As Amazon describes it, when you speak to Alexa, Amazon sends “a recording of what you asked Alexa … to Amazon’s cloud where we process your request and other information to respond to you.”

Amazon designed all Echo devices to detect your wake word (i.e., “Alexa,” “Echo,” “Amazon,” or “Computer,” for Star Trek fans) by “identifying acoustic patterns that match the wake word.” Amazon insists that no audio is sent or saved to the cloud unless your Echo hears the wake word.

(You can use Alexa Guard to detect and act on other specific sounds, like smoke alarms, glass breaking, and more.)

Who Else Is Listening?

Earlier this year, Bloomberg broke the news that (human) Amazon employees were listening to what you were saying to Alexa and transcribing your speech to help make the service better. While Amazon gives you the option to disable the use of your recordings to help develop new features, Amazon has said, “People who opt out of that program might still have their recordings analyzed by hand over the regular course of the review process.” Even opting out isn’t enough to keep your recordings truly private.

The bigger takeaway from this story: Amazon says that no audio is stored unless Echo hears its wake word, but Amazon employees said they’d routinely hear and transcribe audio recorded by Alexa “without any prompt at all.” One employee who spoke to Bloomberg said auditors “each transcribe as many as 100 recordings a day when Alexa receives no wake command or is triggered by accident.”

Listening (and Storing) without a Wake Word

Last month, Amazon filed a patent that would allow your Echo to listen (and record) your audio, even without hearing a wake word: “According to the patent, it would allow users to more naturally communicate with their devices, saying phrases like ‘Play some music, Alexa’ rather than starting each command with ‘Alexa.’”

Amazon used to publicize that it only stored 60 seconds of audio on local storage, which would be replaced by the next minute of audio if it didn’t hear a wake word. Though Amazon no longer explicitly says it locally stores audio prior to hearing a wake word, this patent makes it clear that such a storage feature would be in effect. And

• so does Amazon’s wording of how it transmits your request to the cloud: “the audio stream [transmitted to the Amazon Cloud] includes a fraction of a second of audio before the wake word, and closes once your request has been processed.” If it was not storing your audio locally, how could it transmit anything (even that “fraction of a second of audio”) before hearing the wake word?
• so does Follow-Up Mode, which allows you to enable Alexa to respond to a series of requests without repeating the wake word. If it was not storing your audio locally, how could it respond to or answer your requests?
• so does Local Voice Control, which “supports certain requests (such as controlling compatible lights, switches and plugs) when an Echo device with a built-in smart home hub is not connected to the Internet.” It is technically possible to offer this feature without storing your audio locally. But you still have the “transmitting audio from fraction of a second in advance of the wake word” issue mentioned above.

What’s the Real Issue?

The problem is not data privacy. The problem is digital identity. Amazon says its voice profiles “can automatically recognize the voices of users in your household over time to improve personalization of certain Alexa features,” so that Alexa can call you by name and personalize your experience. Amazon says if it doesn’t hear a user’s voice in three years, the acoustic model for that user is deleted.

Ultimately, voice recognition and digital identification of the user is a “must have” feature. Sadly, as anyone who’s spent enough time with Alexa knows, Amazon is not there yet.

The Heart of the Lawsuit

But as the lawsuit says, since the Alexa system can (if at the moment inadequately) identify individual speakers based on their voices, Amazon could ask any new user speaking to the Echo for consent. “But Alexa does not do this,” the lawsuit claims. “At no point does Amazon warn unregistered users that it is creating persistent voice recordings of their Alexa interactions, let alone obtain their consent to do so.”

The lawsuit takes things one step further, though, stating concern “that Amazon is developing voiceprints for millions of children that could allow the company (and potentially governments) to track a child’s use of Alexa-enabled devices in multiple locations and match those uses with a vast level of detail about the child’s life, ranging from private questions they have asked Alexa to the products they have used in their home.” This last bit sounds like the plaintiff’s lawyers have watched one too many episodes of Black Mirror.

The Analog Hole

Voice-enabled technology requires some special security features (a secondary system) because voices can be recorded. If a human being can hear something, so can an audio recording device. This is known as the “analog hole.” There have been plenty of FUD-mongering stories about people walking up to houses with smartlocks and entering by just saying, “Alexa, unlock the front door.” Kind of a modern “open sesame” fairy tale. To my knowledge, this has not happened yet. In practice, the Door Lock API requires the user to opt in and speak the PIN code. However, current systems do not access Amazon’s voice identification system, so anyone who knows your PIN code can say it (or record it and play it back) to enter your home. In practice, the analog hole makes any audio-only system vulnerable. All you need is a high quality voice-activated recording device (which can be purchased for under $200) hidden near the smartlock. Hit the playback button to open the door. (BTW, you saw that trick in the original movie War Games. The trick still works.)

Digital Identity Will Solve Most of These Issues

Digital identity will solve most of these issues as voice identification technology matures. Of course, the nature of innovation and continuous improvement is that there are known unknowns. “Alexa. Could there be a future configuration problem or hack or simple mistake at Alexa Voice Services that has a significantly negative impact?” Not surprisingly, it responded, “I can’t help you with that one.”