As we leave more digital tracks, Amazon Echo factors in murder investigation

Amazon's personal assistant device called Echo was one of the most popular gifts this Christmas. But this week, the device grabbed headlines for another reason: Police in Arkansas are trying to use its data in a murder investigation.

What we know from court documents is that in November 2015, a man in Arkansas had some friends over at his house to watch a football game and in the morning, one of the friends was found dead in a hot tub in the backyard. Police later charged the man who lived in the house, James Bates, with murder. He has pleaded not guilty.

As the police were investigating the crime, they found a number of digital devices in the suspect's house, including an Amazon Echo device that was in the kitchen. They have since seized the device and have apparently gotten some information from it, but what they want to check is what — if anything — the device may have recorded around the time of the murder.

Here's how the device works: Echo is always listening for the wake, or trigger, word, which is usually "Alexa." But experts say the storage capacity on the actual device is pretty minimal, so only a tiny amount is written and then overwritten as the device listens for the wake word.

When the wake word is said — and the blue light ring lights up — all the spoken queries get recorded and transmitted to Amazon servers. "To be clear, Echo is only streaming audio to the cloud when the blue light is on," says Amazon spokeswoman Kinley Pearsall.

But a number of Echo users have reported a creepy experience of the device turning on and starting to talk without being prompted by the wake word "Alexa" — perhaps mis-hearing or misinterpreting conversations in the room. So in the Arkansas murder case, which was first reported by tech industry news site The Information, the police may be counting on such an accidental recording or something more. They served a search warrant to Amazon for data covering two days around the time of the murder.

Amazon has satisfied a portion of the request. According to court documents, the company has provided "account holder information for James Bates and purchase history."

However, Amazon declined to share information from its servers. The company has not commented on the specific case, but issued a statement:

"Amazon will not release customer information without a valid and binding legal demand properly served on us. Amazon objects to overbroad or otherwise inappropriate demands as a matter of course."

All this may remind you of the Apple-FBI standoff over access to a locked iPhone in the San Bernardino shooting investigation. This isn't exactly the same kind of case, but it's another example of law enforcement turning to a tech company for access to personal data. Privacy advocates have long predicted a wave of these kinds of cases — as we connect more and more things to the Internet and swarm our homes with digital devices, they will become involved in more crime investigations.

Interestingly, even in the Arkansas case, investigators are also using information from a smart water meter, alleging that an increase in water use in the middle of the night suggests a possible cleanup around the crime scene.

And that's going to be a more common occurrence — when the data, otherwise seemingly innocuous, could be used to draw inferences or guesses about habits and activities, says Nuala O'Connor, president and CEO of the Center for Democracy & Technology.

"It's not just one device, it's putting together a whole bunch of different devices to make a case that is, some would argue possibly circumstantial, some would argue is incredibly compelling. And so the question is going to be, how much data is going to be enough to make a foolproof case?" she says.

This has prompted calls for new policies and reviews of legal standards for how tech companies should comply with law enforcement and other government requests.

Particularly, privacy experts say new focus will fall on how much and how long private data is kept by the companies that create so-called Internet-of-things devices as they become targets of not just investigators, but also hackers and spy agencies.

"We live in the world where we really haven't settled the law or the standard of care for companies that provide in-home devices like that," O'Connor says. "The standards of care — as companies have more and more really specific information about what goes on inside the home — has got to be higher and higher."

And the law, guidelines and standards are far from settled. Besides, there's also a big difference between data ending up in the hands of the company you know you're doing business with and ending up in the hands of the government, she says. Plus — at least this case is actually following proper court procedure.

"A much larger concern I think for the country is ... how much is the government asking for this behind closed doors" — including for investigations into people who haven't been charged with any crimes. Copyright 2019 NPR. To see more, visit https://www.npr.org.