Alexa, Can You Keep a Secret? Your internet-connected ‘things’ could bite you.

Monday, April 10, 2017 - 13:35

In a day and age where internet of things (IoT) devices, such as Amazon’s Echo, are integrated into many aspects of our lives, how much privacy can one expect? And can the lack of privacy come back to bite you?

These are some of the questions that were raised by a murder case dating back to February 2015. Arkansas prosecutors are attempting to collect any information that may have been stored or recorded, including any queries that may have been run through the suspect’s Echo device. For those unfamiliar with the technology, Amazon describes it this way: “Amazon Echo is a hands-free speaker you control with your voice. Echo connects to the Alexa voice service to play music, provide information, news, sports scores, weather and more – instantly. All you have to do is ask.”

The suspect, James Bates, is accused of killing his friend Victor Collins, a former police officer, after a night of drinking. Bates says that he went to bed at around 1:00 a.m. and awoke the next morning to find Collins dead in his hot tub. Bates’ attorney, Kathleen Zellner, is calling the whole ordeal a horrible accident, while the prosecution is claiming murder. Investigators believe that data from Bates’ Echo could provide further information on what truly happened. The police have served Amazon with search warrants to obtain this data. However, Amazon initially declined to accommodate the request, citing privacy concerns.

Now, this may sound familiar to you. In December 2015, in San Bernardino, California, FBI agents approached Apple and demanded that the company assist them by unlocking the San Bernardino shooters’ iPhones. As you will recall, the San Bernardino tragedy occurred on Dec. 2, 2015, when Syed Farook and his wife, Tashfeen Malik, pledged loyalty to ISIS and then proceeded to mow down 14 co-workers before dying in a gun battle with the police. Just as Amazon has done, Apple resisted the FBI’s many attempts to force it to help unlock the killers’ iPhone. In that situation, the FBI paid an unnamed outside group over $1 million to unlock the phone and gain access to Farook’s data.

While we applaud Amazon and Apple for fighting back and trying to keep some facet of our lives private, we believe that it’s only a matter of time until companies won’t have a choice and will be forced into releasing whatever the government is asking for. We have already seen collections of people’s computers, social media sites, mobile phones and even automobiles equipped with an EDR (event data recorder). There’s almost nothing that can’t be used against us nowadays. And we doubt that the general public is aware of just how many sources record what we do and when we do it.

In the story about murder suspect James Bates, the prosecutor has even sought to use information collected from another smart device, the water heater, against him. Investigators point to the amount of water that was used that night, describing it as “an exorbitant amount,” while Bates’ attorney argues that the amount is unremarkable. It’s scary to think that even something as trivial as a smart water heater can be used against you. What if the amount of water used wasn’t out of the norm for that particular situation, or he used the water for something else? This information raises several questions about data and context that the legal field will have to answer in the coming years.

James Bates’ case is still evolving. After a lengthy battle in court, Bates’ attorney filed a motion in March saying that her client was willing to voluntarily hand over the recordings. She responded to questions by simply tweeting: “We agreed to release the recordings – my client James Bates is innocent.” Once the investigators receive the data from Amazon, there will undoubtedly be a lengthy period of processing and determining context. This case is certainly one of the cornerstones of “smart device” legality, and could set a precedent for how evidence from IoT devices are handled in the future.

What Does This Mean for E-Discovery?

Clearly, these cases are aberrations. Most of us will not have to worry about the possibility that our devices will turn state’s evidence against us. But IoT devices are becoming increasingly common in homes and businesses. Devices that connect everyday objects to the internet, such as the Echo or Nest’s thermostats and cameras, arguably make our lives easier. For example, how many times have you wondered if you left your garage door open or locked your door? Now you can close your garage door or check the lock on your home from far away.

But can this technology also make our lives more complicated? We now live in a time where Big Brother is not only watching, we have invited him in and thanked him for his services. IoT devices certainly made Mr. Bates’ life more complicated, and additionally created a newer set of obstacles for his legal team.

In the coming years, internet-connected devices will likely transform the field of discovery. As we continue to buy more and more connected devices, we are creating multitudes of discoverable data. How the discovery field handles this data is most likely going to evolve the same way that IoT technology has.

The future of discovery may simply lie in the “divide and conquer” strategy. Corporations, law firms and government agencies can seek resources through legal process outsourcing (LPOs), where discovery, document review and project management can be wrapped into one service – thus allowing the primary legal team to focus the client’s strategy rather than digging through Alexa’s endless data.

We are clearly embarking on a new frontier of technology, and the laws that govern that technology. We will be interested to continue following how IoT data is used in legal discovery. However, we doubt the potential complications will deter us from future purchases of IoT devices. Personally, the benefits – the ability to order a pizza with just the sound of our voices – outweigh the risk that our device will be used against us. We do, however, want to leave you with this warning: Be careful what you say around Alexa. You never know who could wind up listening.

Danny Lee is a project manager at Inventus. He has worked in the managed discovery field for 10 years in a variety of capacities, from traditional services to shift manager of the hosting team. Most recently, he has been part of the dedicated project management team for one of the firm’s largest corporate clients and provides consultation on early case assessment and complex e-discovery solutions. He can be reached at dlee@inventus.com.

 

Ashley Byer joined Inventus as the director of marketing in November 2016. She previously worked in consulting, supporting marketing and communications with commercial, government and higher education clients. She has over five years of experience in technology and almost 10 years of experience in marketing. She can be reached at abyer@inventus.com.