Amazon Alexa-Powered Device Recorded and Shared User's Conversation Without Permission

By Laura Stevens 

Amazon.com Inc. said that one of its Echo home speakers mistakenly recorded a private conversation and sent it to a person in the owners' contact list, an incident that raises questions about the security of such voice-operated devices.

Confirming a report by a local television station in Seattle, Amazon on Thursday said that the Echo device misunderstood pieces of a conversation as commands, causing it to think it was being instructed to send the message.

"As unlikely as this string of events is, we are evaluating options to make this case even less likely," a spokeswoman added in a statement.

The incident was first reported by KIRO 7, which aired an interview with a Portland, Ore., user identified only as Danielle. The user said that one of her husband's employees had received a recording sent from inside her house. The couple verified it was real and determined that it originated with one of their Echo devices.

Attempts to reach the woman for comment weren't immediately successful.

The Echo and other devices from Amazon powered by its artificial-intelligence bot Alexa have sold quickly since hitting the market in 2014, and have been followed by similar gadgets including Alphabet Inc.'s Google Home and Apple Inc.'s HomePod. Proponents envision them eventually helping to handle a wide array of personal tasks, from operating smart-home devices to paying for gas from consumers' cars. Amazon last year enabled the Echo to be used for calling and messaging, too.

The growing popularity of such devices in homes and vehicles has triggered new privacy concerns from some consumers and analysts who fear the combination of internet-connected microphones and AI-powered automation could lead to mishaps or intentional misuse.

The devices are intended to remain offline unless they hear a specific term known as the wake word -- in Amazon's case, the default is "Alexa." In effect, though, that means the microphones are on by default whenever the devices have power.

The Echo, for example, continuously records small pieces of audio on the device that it is supposed to automatically erase unless it is activated. Only after the device hears its wake word is it supposed to be able send anything to the cloud or elsewhere on the network. Amazon has previously said that its devices are extremely unlikely to be hacked, and the Echo and its sister devices include a mute button that disconnects the device internally as an extra safety feature.

It isn't uncommon for Alexa or other voice-activated bots to mishear their wake words when users utter similar words or phrases in their presence.

Amazon said the Portland incident involved a series of such misunderstandings. It said the Echo woke "due to a word in background conversation sounding like 'Alexa.' Then, the subsequent conversation was heard as a 'send message' request. At which point, Alexa said out loud 'To whom?' At which point, the background conversation was interpreted as a name in the customers contact list." Amazon said Alexa then asked for confirmation and interpreted further background conversation as giving it.

Amazon also recently said it was adding a fix for Alexa-powered devices after users reported the machines started laughing for no reason. The company also attributed that to the software misunderstanding what it heard.

"The privacy side has not been fully fleshed out with digital assistants, " said Gene Munster, managing partner at Loup Ventures, a venture-capital firm specializing in tech research. Digital assistants still need more training to interpret commands and language more perfectly, he said, something that consumers should consider with the devices in their homes. "Eventually we're going to get it figured out" but it's not there yet, he said.

Write to Laura Stevens at [e-mail]

(END) Dow Jones Newswires

May 24, 2018 19:22 ET (23:22 GMT)

Copyright (c) 2018 Dow Jones & Company, Inc.