Alexa A Hostile Witness In Murder Investigation

How reliable a witness is Amazon's Alexa? The voice-controlled assistant, star of the Echo smart speaker but increasingly spreading to other connected devices, has become the unexpected informant in an Arkansas murder investigation set to go to trial come 2017. According to police, and freshly-unearthed warrants filed by investigators, the always-listening Echo could hold crucial evidence in the case.

Defendant James Andrew Bates, who has pleaded not guilt to the murder of Victor Collins on November 22, 2015, had a house full of smart home tech when police responded to reports of a body in the hot tub. In addition to an Echo, found in the kitchen, there was a Nest learning thermostat, a connected Honeywell alarm system, and a weather monitoring system. Bates, it seemed, had even more ambitions for his Internet of Things installation, too, with Belkin WeMo devices yet to be taken from their packaging discovered in the garage.

That connected home tech has become a new source of potential evidence for the Bentonville, AR, investigators. According to affidavits for search warrants filed by one of the detective corporals on the case, dug up by Zack Whittaker, personal experience and tech training meant he quickly flagged the Echo as a gadget of interest. Amazon's Alexa service, he writes, could have overheard things on the night of the murder:

"The Amazon Echo device is constantly listening for the "wake" command of "Alexa" or "Amazon," and records any command, inquiry, or verbal gesture given after that point, or possibly at all times without the "wake word" being issues, which is uploaded to Amazon.com's servers at a remote location. It is believed that these records are retained by Amazon.com and that they are evidence related to the case under investigation" Affidavit for search warrant (335167614)

Although the concept of an Alexa wake-word is true, there's more to how Echo operates. In fact, although the seven-microphone array is always listening out for one of the two trigger words, that data is stored locally and temporarily for onboard processing in the smart speaker to analyze. If the wake-word is recognized, then audio is recorded and sent to Amazon's servers for processing.

Confusing matters somewhat, that audio recording does, in fact, include some of the local cache too. Amazon grabs a short – described as "a fraction of a second" – period of audio before the wake-word was recognized, in the hopes of better understanding what request has been made. All recordings are kept by default so as to improve the algorithm; they can be rated for accuracy of recognition, or deleted manually, in the Alexa companion app for iOS and Android.

The Bentonville investigators submitted a warrant to Amazon for those recordings, in addition to a long list of user data including any physical or email addresses that Bates used, purchases on the account, services subscribed to, and more. An extension to the warrant was filed in early 2016, "due to Amazon not complying with our search warrant in its entirety" Detective Corporal Josh Woodhams wrote on April 18. In a subsequent statement, Woodhams wrote that Amazon refused to give audio recordings of data sent from the Echo to its servers:

"After being served with the second search warrant, Amazon did not comply with providing all of the requested information listed in the search warrant, specifically any information that the Echo device could have transmitted to their servers. This agency maintains custody of the Echo device and it has since been learned that the device contains hardware capable of storing data, to potentially include time stamps, audio files, or other data. It is believed that the device may contain evidence related to this investigation and a search of the device itself will yield additional data pertinent to this case." Affidavit for search warrant (335167572)

The Echo contains 4GB of flash storage, though it's unclear how that is used. According to the company's own privacy policy for Echo and Alexa, recordings of users' spoken requests are kept in the cloud, with no mention of a local cache.

Amazon has declined to comment on the specific case, though points out that the "always listening" interpretation of Alexa functionality is inaccurate. A spokesperson said, more generally, that it "objects to overbroad or otherwise inappropriate demands as a matter of course." The company "will not release customer information without a valid and binding legal demand properly served on us" the spokesperson said.

In addition to the Echo, police seized two cellphones. One, an LK E980, gave up its cache of texts, photos, and other data with no problems. The other, however – a Google Nexus 6P – was encrypted, and has apparently resisted efforts to extract what information is stored. Those efforts, as of documents filed in August 2016, are ongoing.