Amazon sent 1,700 voice recordings captured by their Alexa in-home device to a random person. An individual in Germany requested copies of all of his data on Amazon’s files as part of the EU General Data Protection Regulation. As part of their compliance, however, Amazon included 1,700 voice recordings from another individual. With Amazon not responding to his inquiries, the individual in Germany contacted journalists, who were able to quickly identify and track down the individual who’s data had been leaked.
“The shocking part of the story is how quickly the investigative reporters were able to identify the victim. From the recordings, which cover the entire month of May 2018, they were able to determine that he has a Fire TV and an Echo box, and that he uses Alexa to control a smart home thermostat as well as his phone. A female voice speaking to Alexa indicates that he has also a female companion. They were also able to hear the man in the shower while he was issuing certain commands. There were also alarms, Spotify commands, public transport and weather inquiries. ‘We were able to navigate around a complete stranger’s private life without his knowledge, and the immoral, almost voyeuristic nature of what we were doing got our hair standing on end,’ the investigators noted in their report, published on Thursday. They were further able to identify and track down the victim via Twitter. ‘Using these files, it was fairly easy to identify the person involved and his female companion; weather queries, first names, and even someone’s last name enabled us to quickly zero in on his circle of friends,’ according to the report. ‘Public data from Facebook and Twitter rounded out the picture.’”
