{"id":25624,"date":"2022-06-28T12:28:18","date_gmt":"2022-06-28T20:28:18","guid":{"rendered":"https:\/\/www.spokeo.com\/compass\/?p=25624"},"modified":"2022-07-19T13:43:41","modified_gmt":"2022-07-19T21:43:41","slug":"is-alexa-spying-on-you","status":"publish","type":"post","link":"https:\/\/www.spokeo.com\/compass\/is-alexa-spying-on-you\/","title":{"rendered":"Is Alexa Spying on You? What You Need To Know"},"content":{"rendered":"\n

Many of the things we take for granted in our daily lives would have been straight-up science fiction not so long ago.  Wristwatch-based communications<\/a>?  Check.  Rockets that come back to earth and land?  You betcha.  Even fundamental technologies like cellular phones<\/a> and touch-screen tablets<\/a> and phones exist in the real world because fans were inspired by seeing similar devices on \u201cStar Trek.\u201d  <\/p>\n\n\n\n

Another innovation that would have seemed outlandish and nearly magical a few short years ago is voice assistant technology like Apple\u2019s Siri and Amazon\u2019s Alexa.  Having an electronic valet to do your bidding is still new enough to feel slightly surreal.  Of course, novelty can also feel threatening, and new technologies often have legitimate downsides.  You might have heard or read stories of Alexa spying or eavesdropping on users, for example.  So should you be worried? <\/p>\n\n\n\n

Is Alexa Spying?<\/h2>\n\n\n\n

If you\u2019re a fan of old movies, you\u2019ve probably seen conspirators shush each other with the muttered caution that \u201cthe walls have ears.\u201d  That kind of paranoia about eavesdropping would have been rather theatrical in a day when snoops had to resort to literally pressing their ears to a wall or door, but it\u2019s decidedly less so when you deliberately bring a (potential) surveillance device into your living room. <\/p>\n\n\n\n

Like your phone<\/a>, your Amazon Echo devices are equipped with a microphone, and it\u2019s always listening in case you ask it to do something (that\u2019s what it\u2019s for, after all).  If you have an Echo Show device, those contain a camera as well and could theoretically be co-opted to watch you or even record you. <\/p>\n\n\n\n

You don\u2019t need a degree in marketing to know that these concerns could rapidly torpedo a product like Alexa unless it was secured very well indeed.  Amazon, accordingly, employs a lot of smart people to do just that.  So spying shouldn\u2019t be a major worry for you if you love your Alexa device. But there are a few specific things you need to be aware of. <\/p>\n\n\n\n

Amazon\u2019s Quality Assurance Program<\/h2>\n\n\n\n

Amazon draws on its machine-learning AI to process the commands you give to your Alexa device, and they\u2019re pretty good at this.  Even the best AI needs to be verified, though, and to do that Amazon culls random, anonymized interactions between Alexa devices and their users.  Those audio clips are assessed by live humans, who rate how well the software actually interpreted the users\u2019 wishes. <\/p>\n\n\n\n

That\u2019s an important and legitimate part of what makes Alexa work so well, but if you\u2019re privacy-minded it might rub you the wrong way.  Amazon allows for this, so you can opt out in your device settings if you wish (we\u2019ll come back to that shortly). <\/p>\n\n\n\n

You Can Accidentally Trigger Alexa<\/h2>\n\n\n\n

Voice assistants are always listening for their audio trigger or wake word<\/em>, which in Amazon\u2019s case is simply \u201cAlexa\u201d (and \u201cecho\u201d as well, on Echo devices).  If you\u2019ve installed additional apps, or skills as Amazon calls them, those will usually have their own wake words.  It\u2019s entirely possible, and in fact common<\/a>, to accidentally trigger your device when you say something that sounds like your wake word. <\/p>\n\n\n\n

Use of that word in conversation (\u201cSo her little girl says, \u2018Hey, Alexa, order me some chocolate ice cream\u2019…\u201d) will do it, and even a mention of Alexa<\/a> on the news can activate your device.  The more skills you install, the greater the number of words (and soundalikes) will bring it to life. <\/p>\n\n\n\n

In one freak example<\/a>, an Alexa device accidentally activated in this way recorded a couple\u2019s conversation and sent the file to a contact of theirs.  It\u2019s unlikely, and it\u2019s certainly not a case of Alexa spying, but it was still a significant privacy breach. <\/p>\n\n\n\n

You Might Install a Malicious Skill<\/h2>\n\n\n\n

You may have seen headlines about malicious apps that find their way into the App Store and Play Store, despite Apple and Google\u2019s best efforts, and then steal personal information from their unwitting users.  In 2021, security researchers in the U.S. and Germany successfully demonstrated that it was possible to infect Alexa devices with malicious skills<\/a> in similar ways. <\/p>\n\n\n\n

Once installed, skill-based malware might be able to capture personal information from your settings or designate the same wake word as another popular, widely used skill (\u201cskill-squatting\u201d), so you\u2019ll activate the bogus skill along with the real one.  A malicious skill could hypothetically make Alexa spy on you by recording audio or video, though it\u2019s more likely any ill-intentioned criminals would be out to steal your identity instead (personal information<\/a> is more immediately, and reliably, marketable). <\/p>\n\n\n\n

Amazon vets its skills aggressively, and the specific vulnerabilities uncovered by these researchers have long since been plugged (and the researchers pointed out that there was no evidence of them being exploited \u201cin the wild\u201d), but the rapid rise in smart speakers\u2019 popularity makes them a high-value target.   It\u2019s reasonable and prudent to expect that attackers will occasionally get through. <\/p>\n\n\n\n

It\u2019s Not Alexa Spying, but Someone You Trust<\/h2>\n\n\n\n

Ultimately any voice assistant does what it\u2019s told to, so the likeliest reason for Alexa spying is that it\u2019s been told to by someone with access to your device:  a friend, a family member, your significant other or perhaps even just a contact.  Even this isn\u2019t necessarily easy or effective, but it\u2019s much more feasible for an insider.  The key feature that\u2019s open to misuse is what Amazon calls its \u201cDrop In\u201d capability. <\/p>\n\n\n\n

Drop Ins are impromptu virtual \u201cvisits\u201d with your contacts, by audio on standard Echo devices or in full video on Echo Show speakers, with their screens and video cameras.  Your visitors choose to Drop In on you from their own device or Alexa app, and you can visit with them just as if they\u2019d stopped by your house unannounced. <\/p>\n\n\n\n

The potential for this to be misused is pretty clear.  Alexa gives you audible and visible alerts when someone asks to Drop In, and you\u2019ll have an opportunity to reject them.  If you\u2019re not in the room at the time, though, and don\u2019t reject the call, that contact could eavesdrop or even capture video without you noticing.  This kind of thing is catnip for jealous, controlling partners especially, so it\u2019s something to be aware of if you\u2019re in a problematic relationship. <\/p>\n\n\n\n

Securing Your Alexa Device<\/h2>\n\n\n\n

In short, the chances of Alexa spying on you are minimal, but not zero.  As with any similar device (including your phone), there are a few things you can do to reduce any potential vulnerabilities.

These include: <\/p>\n\n\n\n

Opting Out of Amazon\u2019s Human-Review Process<\/h3>\n\n\n\n

In your Alexa settings<\/a> (on the app, Amazon\u2019s website or on a touch-screen device) look for a header called Help Improve Alexa.  You\u2019ll see a line that says \u201cUse of Voice Recordings,\u201d with a toggle next to it.  Slide that to \u201cOff.\u201d<\/p>\n\n\n\n

Limiting Skills\u2019 Permissions<\/h3>\n\n\n\n

Look under Settings for \u201cAlexa Privacy\u201d and then \u201cManage Skill Permissions.\u201d  Go through the list and see which permissions skills have been requested, and turn off any that seem unnecessary (a smart-thermostat skill shouldn\u2019t need access to your contacts, for example). <\/p>\n\n\n\n

Limiting the Drop In Feature<\/h3>\n\n\n\n

There are several ways to limit use of the Drop In feature.  You can go into Settings and disable it outright, or use the Do Not Disturb option to temporarily suspend it.  You can also grant or deny access to your contacts individually, so only your closest friends and family can use it. <\/p>\n\n\n\n

Limiting Your Contacts<\/h3>\n\n\n\n

When you set up your Alexa device, it will ask for access to your full contacts list.  It\u2019s convenient if you want the option of making calls directly to all of your contacts, but otherwise, you\u2019re better off manually choosing which contacts you actually want or need to have on your Alexa device. <\/p>\n\n\n\n

Being Aware of Your Alexa Device<\/h3>\n\n\n\n

A big step in reducing your risk is simply being more aware of the Alexa device.  Your Echo lights up the microphone button when the mic is \u201clive,\u201d for example.  You can also deliberately mute the mic yourself when the device isn\u2019t in use, and slide the privacy shutter over the camera on an Echo Show.  Turn up the volume, so if Alexa is triggered accidentally, you\u2019ll hear it confirm your command. <\/p>\n\n\n\n

Reviewing and Deleting Voice Recordings<\/h3>\n\n\n\n

Your Alexa device will record audio after it hears its wake word, so it can quickly communicate with Amazon\u2019s servers and make sure it understands what you\u2019re asking.  Under the Alexa Privacy menu you can choose \u201cReview Voice History\u201d to listen to those recordings and delete them by dragging individual recordings to the trash can or choosing \u201cDelete All\u201d or \u201cDelete Last Seven Days.\u201d <\/p>\n\n\n\n

Alternatively, you can tell Alexa to delete everything you\u2019ve ever said and then make it a part of your bedtime routine to say, \u201cAlexa, delete everything I\u2019ve said today.\u201d<\/p>\n\n\n\n

Reset Your Alexa Device Before Selling It <\/h3>\n\n\n\n

Nobody needs to spy on you if you unwittingly give them your information, and that can happen too.  Security researchers at Northeastern University<\/a> bought a batch of used Amazon devices to test, and found that the previous owners sold 60% of them without first performing a factory reset<\/a>.  That\u2019s a really bad idea<\/em>. <\/p>\n\n\n\n

When you set up an Alexa device, it stores a ton of information, including your Wi-Fi passwords, your router\u2019s address and your Amazon credentials, so you\u2019re essentially giving away access to your Amazon account and home network.  Your Amazon credentials, in turn, give access to your name and home address, your purchase history, the addresses of friends and family you\u2019ve bought stuff for, and \u2014 the kicker \u2014 your payment information. <\/p>\n\n\n\n

So yeah, reset your device before you resell it (or even return it to the store for a refund).  Skillful hackers could still theoretically extract information from a reset device, but without a reset, just about anybody could steal your money or your identity<\/a>. <\/p>\n\n\n\n

The Bottom Line?  Just Be Prudent<\/h2>\n\n\n\n

When all is said and done, the likelihood of Alexa actively spying on you is pretty minimal.  It can theoretically happen, but it\u2019s not an especially big risk.  As with any other connected device, it\u2019s mostly a question of familiarizing yourself with the potential vulnerabilities and managing them. <\/p>\n\n\n\n

If you make a point of getting to know your security settings, and actively managing them, you can enjoy the conveniences offered by your Alexa device without having much to worry about. <\/p>\n\n\n\n

References<\/h3>\n\n\n\n