Your Home is Your…Snitch?

The Marshal Project – by Daniel Zwerdling

Police records in Bentonville, Arkansas show that James Bates called 911 on Sunday morning just before Thanksgiving 2015, and reported chilling news: he’d just opened his back door and found one of his buddies floating face down in the hot tub, dead. When police showed up, Bates said he had no idea how it happened.

He also said they could search his home, according to police. And they found his house and yard were equipped with smart gadgets that might have served as digital eyes and ears. One was a smart utilities meter, which tracks far more details about water consumption than old-fashioned meters do. Another was an Amazon Echo on the kitchen counter—a smart speaker connected to the voice-controlled digital assistant service called Alexa—as in, “Hey Alexa, play me Drake/book a hotel/call an Uber.” As the police looked around, Bates probably had no inkling that he was entering a national debate: When do police have legal access to the trove of personal information that our smart homes collect?

Two developments coming soon could affect the answer. The Supreme Court will rule on a case concerning privacy and digital records, and new regulations in Europe will tighten access to people’s digital information there.

Back in Bentonville, police went after data from Bates’ smart home with zeal. A manager at the utilities department told them that Bates’ smart meter showed he’d used far more water between 1–3 a.m. than he’d ever used during the same period before. Police surmised that Bates had hosed the back patio to erase signs of a struggle. They charged him with murder.

Prosecutors also ordered Amazon to turn over the recordings that Bates’ digital assistant made before and after he said he found the body. Amazon records your vocal commands, and sometimes background talk, and stores the audio on distant servers. Amazon resisted, the prosecutors started fighting the company in court—and Bates gave up the recordings voluntarily. Prosecutors dropped the case late last year, saying they couldn’t prove he was guilty. Apparently, Alexa still awaits her court debut. But the case gave the nation a glimpse of what’s in store as our homes keep getting smarter: law enforcement will treat your appliances as potential witnesses.

It seems new smart gadgets are introduced every week. There are smart TVs, which suggest the programs they think you’ll like. Smart refrigerators are equipped with interior cameras and UPC scanners that keep track of the items you stock in your refrigerator, and then reorder them as they run out. One brand of smart mattress “tracks over 15 factors about your sleep and health, including deep sleep, heart rate and respiratory rate,” according to its website.

“From a law enforcement or intelligence perspective, these are very valuable tools that can let them monitor or listen to individuals,” says Dale Watson, the FBI’s former executive assistant director, now a consultant.

“Smart devices are also kind of frightening,” Watson says. “What are the legal ramifications? The technology is moving so fast that the laws and courts haven’t caught up with it.”

One reason there aren’t clear legal guidelines has to do with the way smart homes work, which, some analysts contend, means they’re not protected by the Fourth Amendment. “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated,” the Amendment declares. Courts have ruled that means police can’t search your home, except in emergencies, without convincing a judge to sign a search warrant on the grounds that there’s “probable cause” they will find evidence of a crime.

But the Supreme Court and other courts have established a broad exception, called the “third party doctrine.” The government does not need a search warrant in most cases to get personal information that you’ve already shared voluntarily with somebody else, like a bank or internet provider or utility.

Well, smart devices in your home are constantly sharing your personal information with somebody else. This “internet of things” sends details about your food orders and sleep cycles and conversations with Alexa through your router and over the internet, usually to the manufacturer or a contractor. So some government officials argue that the third party doctrine applies and they can get that information just by asking for it. When “third party” companies balk, police in some states get the information by issuing a subpoena, no judge’s approval needed.

For instance, San Diego Gas & Electric Company disclosed recently that government agencies subpoenaed data generated by smart meters at 480 homes and businesses last year. A company spokesperson would not disclose which agencies, but the company has given meter data before to the FBI and Immigration and Customs Enforcement, among others.

The Supreme Court hasn’t ruled yet on issues raised specifically by smart homes, but it is about to decide another case that could have a bearing on the issue. The question in Carpenter v. United States is, can the government get historical cell phone location data from your phone company without a warrant? If so, how far back into your history can it go? In resolving those questions, the justices might hint how strictly they want to protect other data generated by your smart meter and refrigerator.

And on May 25, the European Union will enact sweeping new rules that remind America how much its own laws on digital privacy are lagging. The policy has an uninspiring name—the General Data Protection Regulation—but it does something dramatic, at least on paper: it requires companies to clearly tell consumers what kind of data they want to collect, and gives consumers an easy way to say, “No!”

European officials have tended to protect privacy more fiercely than their U.S. counterparts. Consider the saga of My Friend Cayla, the talking doll.

Back in 2016, American advocacy groups, including Consumers Union and the Electronic Privacy Information Center (EPIC), asked the Federal Trade Commission to ban the 18-inch doll on the grounds that it can spy on children and their parents. When children talk to Cayla through a tiny embedded mike, software converts their speech into text, then searches the internet for appropriate responses, and finally turns them back into Cayla’s own voice. Miraculous, perhaps, but critics pointed out that the company that makes Cayla’s voice recognition software, Nuance Communications, also helps law enforcement and intelligence agencies identify bad guys by searching “millions of audio files” in its data banks, according to the Nuance website. What if they mistakenly identified your child as a terrorist? “It’s beyond creepy,” says Sam Lester, EPIC’s main privacy attorney.

The FTC didn’t budge. But German officials banned the dolls last year for being an “illegal espionage apparatus.” A German government spokesman called on the public to destroy the dolls, or at least disable their digital wizardry.

So far, these creepy concerns seem mainly hypothetical. But the torrent of personal information generated by smart homes gets the ACLU’s Nathan Wessler contemplating troubling scenarios.

Suppose police suspect a man of organizing a political protest that turned violent, muses Wessler, who argued the Carpenter case for the ACLU before the Supreme Court. The suspect’s smart meter and thermostat confirm that a handful of people showed up at his home and stayed there the two nights before the demonstration; the suspect’s smart refrigerator ordered a bunch of soda and snack food on those days, which was all consumed; after someone asked Alexa to play some music in his living room, a voice in the background said, “Tomorrow, we’re going to really show them”; and that night, the suspect’s smart mattress recorded him sleeping fitfully and his heart beating faster than normal. The police arrest the man on conspiracy and other charges. He eventually proves he’s innocent – some old friends visited from out of town, and planned a day of sightseeing—but not before a legal nightmare turns his life upside down.

“There’s not a person among us who doesn’t have private aspects of their life that could create difficulty for them if they were exposed,” Wessler says. “And misinterpreted.”

Daniel Zwerdling, formerly a senior investigative correspondent with NPR, is an independent journalist. The Marshall Project’s daily email newsletter, Opening Statement, is available as a flash briefing on Alexa devices.

https://www.themarshallproject.org/2018/05/24/your-home-is-your-snitch