The way Alexa & Google Home should work, is that they listen for a specific trigger word, after which they start sending data to their servers.

However, there have been some court cases, in which Alexa recordings have been used as evidence.

Since the smart speaker only starts sending data, once the trigger word is detected, can or has it been tested, with something like wireshark?

Would the absence of traffic be proof, that the smart speakers are not sending everything to the cloud, if not triggered by the key phrase?

Or would there be some sneaky way, in which the data can be collected all the time, but only send to the cloud after the key phrase, in order to obfuscate the spying?

If for example law enforcement had a warrant for a wiretap, and they somehow forced Google to record everything, how would they actually implement it, without a savvy user finding out?

I am really tempted to get one of these things, but I can't stomach the bad feeling, that I am basically installing an eavesdropping device voluntarily in my home, which at some point could come back to hurt me (for example by a major data leak at Google or Amazon).

My concern is probably misplaced, since I use an android phone and an android TV, both of which could be listening to me all the time anyway, but still.

How thoroughly have these devices been tested for this by independent security analysts and what steps could I take to decrease the chance of blanked recording?

I was thinking of somehow monitoring its traffic and having a sound play, each time it sends more than X amount of data or something like that.

  • I would wager money that it does not do this, but I would not be willing to bet that it will not do so automatically in the future via an update, or that it can't be remotely enabled even now. – forest Apr 6 at 7:35

If you have a device in your room which can record data and which from time to time sends data to some server on the internet there don't need to be any kind of relationship when the device records data and when it communicates with the internet. It is perfectly possible that the device records data and only transmits these data later, maybe even only when receiving a command from outside.

The only way to be sure that this is not the case is to analyze the currently running software on the device and make sure that the software never gets replaced (or analyze it again then). But since these are proprietary closed source products which from what I believe have not received any independent and deep enough analysis and can also be easily updated by the vendor to a different firmware you just have to trust the word of the vendor who will likely assure you don't have to worry about anything.

  • I was thinking, that the file size would give it away, regardless of the upload timing, but I guess with enough compression, it would be hard to tell. – user1721135 Apr 5 at 20:49
  • @user1721135: yes, audio can be very good compressed. And you will probably not see the difference between sending a 10 seconds audio snippet compressed with 128kbit/s and 60 seconds audio compressed with 16kbit/s (which is easily possible with speech). Apart from that you don't know what else is send apart from the expected audio so you don't know if the other data you see is actually audio or not. – Steffen Ullrich Apr 6 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.