A family in Washington claims that their Alexa device recorded audio of a private conversation and sent it out to a random contact without warning.
One minute, you’re relaxing at home discussing the merits of hardwood floors. The next, a contact is calling you and telling you you’re being hacked.
That’s how a family in Portland, Washington is describing their experience with Amazon’s Alexa after the popular voice assistant reportedly sent audio of a private conversation to one of their contacts — all without them knowing it.
The family had filled their home with Alexa devices in order to control their lights, HVAC and security system using voice commands. Then, they say that one of the father’s work contacts called to let them know that he’d received an Alexa call broadcasting audio of a private conversation about flooring — a call the family says they never asked Alexa to make.
Now, they tell the local news that their Alexa devices are left permanently unplugged.
“I felt invaded,” said Danielle, who didn’t want her last name used. “A total privacy invasion. Immediately I said, ‘I’m never plugging that device in again, because I can’t trust it.'”
Danielle says that the family got in touch with Amazon’s engineering department, who were able to confirm that audio had indeed been unintentionally broadcast.
“They said, ‘Our engineers went through your logs, and they saw exactly what you told us, they saw exactly what you said happened, and we’re sorry,'” Danielle told local news network KIRO 7 .
“He apologized like 15 times in a matter of 30 minutes and he said, ‘We really appreciate you bringing this to our attention, this is something we need to fix!'”
Amazon did not immediately respond to our attempts to verify Danielle’s claims, but the company confirmed the incident to KIRO 7, offering them the following response:
“Amazon takes privacy very seriously. We investigated what happened and determined this was an extremely rare occurrence. We are taking steps to avoid this from happening in the future.”
Danielle says that Amazon was unable to pinpoint exactly what had caused the unintentional broadcast, but there are a couple of possibilities. Users who have opted into Alexa’s calling and messaging feature can share their contacts list to let Alexa scan for any phone numbers registered to her database. Then, they can call those contacts by name using commands like, “Alexa, call Gary.”
It’s possible that one of Danielle’s Echo devices mistakenly thought that it had heard someone say, “Alexa, call [contact’s name],” as the family was speaking to each other. In that case, this is the Alexa equivalent of a butt-dial, and little more than a minor cautionary tale for the voice-activated smart home. (Though it would be fair to ask Amazon what it’s doing to make Alexa better at identifying false positive commands and disregarding them.)
Another, more alarming possibility is that something else triggered the device, or that it malfunctioned. Either one would come with problematic implications about Amazon’s ability to protect its customers’ privacy.
When we hear more from Amazon, we’ll update this story.
HomePod, Echo, Google Home: How secure are your speakers?
The best PCs for privacy-minded people: Even Mark Zuckerberg covers his webcam.
