Amazon Echo Murder Case Is No Apple-FBI Encryption Battle

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Daniel R. Stoller

A recent law enforcement request to Amazon.com Inc. for data from an Echo web-connected electronic personal assistant tied to a murder suspect may not be as intrusive as it first sounds.

At first glance, the Arkansas prosecutor’s request to Amazon for Echo data may cause some to flash back to the early 2016 dispute between the Federal Bureau of Investigation and Apple Inc. over access to an encrypted iPhone used by the San Bernardino, Calif. terror attack shooter. However, the perceived Amazon Echo controversy is underpinned by different technological and evidentiary issues, analysts said.

Companies that store personal data in the cloud are used to receiving law enforcement requests for data and in general are willing to comply with a narrowly-tailored warrant, but here the request may have been too broad, they said. Unlike the Apple case, law enforcement isn’t asking Amazon to unlock a device or assist in decrypting information.

A discovery hearing in the case is scheduled for March 17 ( State v. Bates , Ark. Cir. Ct., No. 04CR-16-370, discovery hearing scheduled 3/17/17 ).

Alexa, I Have a Question

The Echo—which uses Amazon’s Alexa software which is similar to Apple Inc.'s Siri—has been controversial for privacy advocates because it continually listens to consumers and stores conversations and other noises to the cloud after a wake word is spoken. The user in most situations is able to delete the data by using a mobile application.

Although how the device stores and collects consumer data and whether that information may be used in a murder trial is a complex issue, companies that create internet of things (IoT) devices may be closely watching the case to see if similar data on their devices could be used against potential customers.

Warren Stramiello, of counsel at defense-side litigation firm Gallo LLP in San Rafael, Calif., told Bloomberg BNA Jan. 4 that the Apple-FBI encryption battle “is fundamentally different from the present issue.” In that case the FBI wanted Apple to change their security model by providing a backdoor to their encryption systems, he said.

The present case is more of a “legal issue and less of a technical one,” Stramiello, who is assisting the defense as an expert, said.

Jonathan Thompson, executive director of the National Sheriff’s Association, told Bloomberg BNA Jan. 6 that the prosecutor’s attempt to retrieve the Amazon Echo data was done in a “permissible and constitutional” manner.

Balancing law enforcement requests with consumer privacy is “obviously complex and needs to be discussed” but it is up to the judge to ultimately decide these issues, Thompson said. There has to be “trust in the independent judicial system until it's found not independent,” he said.

Evidence Issues

Although concerns over consumer privacy have been the most outward controversy in the Amazon Echo case, the larger issues may be evidentiary and not simply data privacy issues.

The case involves charges against James Andrew Bates after Victor Collins was found dead in his hot tub, court records show. Bates was charged with murdering Collins, but maintains his innocence. Months after his arrest an Arkansas state judge signed a search warrant for the Echo and its contents. When the police seized the device they discovered that most of the data from the Echo are stored in Amazon’s cloud.

Benton County prosecutor Nathan Smith told Bloomberg BNA Jan. 4 that his office sought the warrant using probable cause which is the “constitutionally authorized means for law enforcement to conduct searches.” Although, “privacy advocates have expressed interest due to the technology involved, this case is really about seeking justice for the victim, who was a husband and a father,” he said.

Amazon has turned over some information to the prosecution, but it contends that not all of the customer information stored on the Echo was requested in the proper manner.

An Amazon spokesman told Bloomberg BNA Jan. 4 that the online retail giant won’t “release customer information without a valid and binding legal demand properly served” and that it “objects to overbroad or otherwise inappropriate demands as a matter of course.” The Amazon spokesman’s comments weren’t tied to specific litigation.

Bates’ defense attorney Kimberly R. Weber, of counsel at Matthews, Campbell, Rhoads, McClure and Thompson PA in Fayetteville, Ark., told Bloomberg BNA Jan. 4 that the biggest reason why Amazon shouldn’t turn over the data is because the warrant served on the company was vague.

If Amazon receives “a legally binding order” that has the requisite “particularity and specificity” than the defense wouldn’t object, Weber said. It really comes down to a Fourth Amendment search and seizure controversy, she said.

Craig Ball, discovery law professor at the University of Texas at Austin Law School, recently told Bloomberg BNA’s Big Law Business that he agreed with Weber’s conclusions. Under the proper protocols, the Amazon Echo data “would be available in criminal and civil cases,” he said.

But, it may not be easy for the prosecutor’s office to obtain the stored Echo data, Ball said. Amazon has protections under the Stored Communications Act that “may protect them from having to release it,” he said. “We’ll just have to wait and see,” he said.

Privacy Concerns

Even if evidence and other technical concerns are really at issue in this case, privacy concerns still underpin some of the larger issues.

Esha Bhandari, staff attorney for the American Civil Liberties Union (ACLU), told Bloomberg BNA Jan. 5 that a warrant is essential to obtain stored data. The biggest privacy concern isn’t law enforcement accessing the stored data, but whether the defendant has received notice that there was a search, she said.

“Transparency is the biggest issue and people need to be more aware of what information and intimate detail is being recorded and available to the government,” Bhandari said.

Other privacy concerns may have been eradicated if Amazon had more thought out privacy policies, privacy advocates said.

Stramiello said that Amazon bears most of the fault for the privacy issues raised thus far. “Amazon should have seen these dangers before releasing the device onto consumers,” he said.

Going forward, Amazon “should bake security and privacy into the technology from the very start,” Stramiello said. If Amazon anonymized and encrypted the data, much like Apple does with it’s Siri software, then much of the current controversy wouldn’t exist, he said.

By not doing so and “keeping access to the conversations and keeping the conversations linked to the customers, Amazon has exposed these private moments to both civil discovery and to law enforcement,” Stramiello said.

Bhandari agreed that if Amazon had a clear “retention plan that doesn’t let them store information longer than necessary,” then there wouldn’t have been a huge privacy concern in this case.

With assistance from Gabe Friedman in New York

To contact the reporter on this story: Daniel R. Stoller in Washington at dstoller@bna.com

To contact the editor responsible for this story: Donald Aplin at daplin@bna.com

For More Information

The docket in the case, with links to the filings, is available at http://src.bna.com/leR.

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law Privacy and Data Security