Tech That Spies On You

"Please Say a Command…"

Genesis Toys, which makes robotic toys that verbally interact with children, and its subcontractor, Nuance Communications, are in trouble with privacy advocates. According to a complaint filed with the Federal Trade Commission, the two companies violate the Children’s Online Privacy Protection Act of 1998 by recording what kids say to two interactive toys without adequate disclosure and consent of their parents, and engage in practices deemed unfair and deceptive, e. g., playing “hide the opt-out button.”

The toys are “My Friend Cayla” and the I-Que Intelligent Robot. They’re basically the same device with different outer shells. Both use voice recognition tech to listen to what children say to them. They connect via Bluetooth to an app on a smartphone (presumably owned by a parent) and from there, via the Internet, to a crude form of artificial intelligence that answers kids’ questions. The AI tech is hosted on Nuance’s servers.

Does the name Nuance sound familiar? You might recognize them as the same company that sells the popular Dragon dictation software. So they know a thing or two about speech-to-text translation.

Of course, children say all kinds of things to their toys, including personal info that parents may not want to be recorded and stored by Nuance. The complaint alleges that Genesis and Nuance do not adequately inform parents that their children’s words will be recorded and stored; do not give parents an obvious opportunity to opt out; and do not encrypt children’s communications in transit or on Nuance’s servers.

This controversy is just the latest in a long series of concerns that arise every time new interactive tech comes to the market. Whether Genesis and Nuance are in violation of COPPA remains to be seen. But this case raises the question, “What other things are spying on their owners?”

What Else is Listening?

Smart TVs get smarter by getting to know their viewers. Necessarily, that involves tracking what shows are watched at what times, and storing that info somewhere. That may be OK, but what about selling data about your viewing habits to advertisers so they can target you with exactly what you’re most likely to buy, or selling it to data brokers who add your TV viewing habits to the ever-growing dossier they keep on you? VIZIO has been caught doing that, and it’s safe to assume that other smart TV makers do likewise.

Certain Samsung smart TVs are voice-controlled. According to the company’s privacy notice, the products "capture voice commands and associated texts so that we can provide you with Voice Recognition features and evaluate and improve the features." OK, that’s reasonable. But then the policy goes on:

"Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition."

So arguments with your spouse, a teenager’s tearful pregnancy announcement, or an overheard phone call with a business associate may end up in the hands of an unknown “third party?” Yes, but Samsung assures us that the third party only looks for voice commands and ignores the rest.

But then we learn that Samsung doesn’t bother to encrypt the data it collects. If it’s intercepted, an unauthorized third party may learn much more than we want it to learn. That’s a problem.

What does Nuance do with the recordings it receives from dolls and TVs? The company’s terms of service, which are easily missed during setup of the devices, claim the right to use all of the data it receives to fine-tune its service and develop new features. That seems to imply that the private utterances of children and adults are being stored indefinitely.

Some smart TVs have cameras built into the bezels of their displays, like the Webcam built into a laptop computer. The cameras are provided for users who like to Skype on the big screen. But the camera can be activated remotely, to undetectably video-record everything within its range. Way back in 2013, security researchers demonstrated how easily a hacker could exploit this capability on a high-end Samsung smart TV. Samsung soon issued a software update that closed this hole.

Always Listening...

In 2015, rumors flew that Google’s Chrome browser was surreptitiously recording the voices of users and transmitting that data to Google. In fact, the “OK, Google” voice-command feature was being activated only by one open-source Linux variation (Debian), and not by Google. Google eventually pulled the “OK, Google” feature out of Chrome and Chromium (its browser-based operating system) and made it an optional Chrome extension.

Today, exactly the same eavesdropping rumors that have plagued smart TVs, dolls, and browsers are flying about Amazon Echo, Google Home and other voice-controlled digital assistants. Is that black cylinder recording everything that it hears and storing the data in Amazon’s immense storage cloud?

Amazon explains that Echo is always listening, but only for the “wake word” that signals the beginning of a voice command. (The wake word is “Alexa” by default.) All of the voice-recognition processing necessary to identify the wake word is done locally, without sending any data to Amazon. Only when the wake word is recognized does Echo begin streaming data to Amazon for processing of the command that follows it. Data transmission stops when the command has been processed. You can press the mute button on the top of the Echo to turn off the microphone, if desired.

Google offers a Voice and Audio Activity page, where you can control what is saved, see the voice commands you've sent, delete your voice history, or turn the feature off. I wasn't able to find a similar option for those who use Siri on the iPhone.

Most privacy concerns arise because users have little understanding of how new-fangled devices and software work, and little reason to trust the makers of their tech gizmos. If companies did a better job of explaining their new tech at the time it is released, they would spend a lot less effort refuting FTC complaints and rumors that may persist for years.

Consumers should assume that anything they say within "earshot" of a voice-enabled device might be sent somewhere, stored for some period of time, and possibly analyzed by a third party for advertising or other purposes. Users also need to be aware that for every new gadget that accepts voice commands, they should be looking for the privacy policy, and the opt-out option.

Your thoughts on this topic are welcome. Do you have any voice-enabled gadgets? Post your comment or question below...