IoT Device Playing Central Roll in Criminal Investigation

All the evidence currently public points towards a guilty verdict for James Andrew Bates of Bentonville, Arkansas, but an unexpected witness could overturn the case — or confirm it. Police in the area have issued a warrant to Amazon, demanding data from the Amazon Echo installed in the suspect’s home. The case raises serious questions for IoT app developers and consumers alike, blurring the line between public and private.

Let’s get the technical side out of the way first: it’s unclear in this case whether or not recordings of the time surrounding the event are even available, as Echos theoretically only listen in when cued by a “trigger command.” That said, Amazon has stated in the past that users can shut off passive listening by the device via the bundled remote. This begs the question: are conversations recorded to the cloud if the device is turned off? And if so, how long are those conversations kept? Are they analyzed for data or even mined for advertising purposes?

The answers are unclear, but chances are consumers and NYC app developers will finally get a few of them as the details of this case play out. To date, Amazon has refused to turn over data, and suggested that the request from local police is not serious enough for them to compromise a customer’s personal data.

Further complicating the case is data available from other smart IoT devices within the house, including a Nest thermostat and a smart water device. Overall, the case has prompted everyone in the IoT community to consider how always-on mobile apps affect the privacy and security of those who use them. In some cases, for the worse. In others, as in cases like this where crimes have been committed, they could play the savior. Finding the line between the two is tricky. Cases that bring the debate into the public eye, while tragic, will help to clarify what is and isn’t appropriate for app developers creating IoT interfaces.