Practical Pieces & Perspectives
On November 5, 2018, Judge Steven M. Houran of Strafford County, New Hampshire ordered Amazon to provide authorities with audio recordings from an Amazon Echo device in the investigation of the stabbing of two women in January 2017.[1] Judge Houran wrote the Echo device may possess recordings that give insight into the murders given the device’s location in the home where the women were found.[2] Currently, Amazon is objecting to the legality of this order and has yet to hand over the recordings, stating they will not release the information “without a valid and binding legal demand properly served on us.”[3] While this dispute is in the early stages; this clash over privacy rights between the government and Amazon is not the first of its kind.[4]
On February 22, 2016, in Benton County, Arkansas, prosecutors charged James Bates with the murder of Victor Collins.[5] After the Chief Medical Examiner ruled Collins’s death a murder, law enforcement obtained a search warrant for Bates’s home where they seized an Amazon Echo device under the assumption that through use of this device Amazon possessed audio recordings that could help solve the murder in question.[6] Prosecutors surmised the Amazon Echo inadvertently recorded audio from the night of November 21, 2015 given the device played music on the night of the alleged murder and could have inadvertently recorded evidence of the murder.[7] Ultimately, Amazon dropped their objection to releasing the recordings when James Bates voluntarily consented to their release on March 3, 2017.[8] These cases highlight the question of what level of protection home smart devices receive under one’s right to privacy. This article will explore how the current laws protect smart home device users under the Fourth Amendment.
Smart devices are electronic devices defined by their ability to connect to other devices or networks through connections such as Bluetooth and Wi-Fi.[9] Smart devices include any items that connect to the internet, including devices such as cellphones, thermostats, lights, speakers, and even appliances.[10]
Amazon’s Echo is a type of smart device that connects to a user’s Internet connection.[11] Amazon’s Echo, commonly referred to as “Alexa,” is an artificial intelligence personal assistant that performs various tasks such as playing music, checking the weather or even buying goods from Amazon.com.[12] For Alexa to perform a task, the user must ask the device to do something such as play a song by saying the device’s “wake word” and then asking the device to perform a task.[13] For example, to play a song, a user may say, “Alexa, play Today’s Hits on Pandora.”
While turned on and connected to the Internet, Alexa is always listening to her surroundings for a “wake word”, which is usually “Alexa” or another word chosen by the user.[14] Although Alexa is always listening to her surroundings, that does not mean the device is always recording and storing that data.[15] Any kind of audio stated without a wake word is not sent to be stored on a server.[16] It is only when Alexa hears a wake word that audio from the fraction of the second before the wake word is spoken is recorded and sent to Amazon’s cloud to be processed.[17] After the audio with the wake word is sent and processed by Amazon’s cloud, Alexa responds appropriately to the user’s task, question or command.[18] Both the user’s command and Alexa’s response are archived in Amazon’s cloud.[19] In the example above, Amazon would process and then store the user’s command to play music on Pandora and then play the song on the device.
Google’s device is similar to Amazon’s Echo in that the device answers factual questions, plays music and the radio, makes phone calls to others, and controls other electronic devices.[20] The Google Home device functions in a similar way to Amazon’s Echo device in that they listen for a wake word and begin recording from the very moment before that wake word is said.[21] This information is then stored in the Google cloud.[22]
To ascertain the extent home smart device user data is protected, it is necessary to examine of the scope of the Fourth Amendment, which protects individuals against unreasonable searches and seizures.[23] Although many exceptions apply, in general, when the Fourth Amendment applies a warrant supported by probable cause is necessary to complete a search or seizure.[24] Thus, in order for the Fourth Amendment and its protection to apply, there needs to be a search or seizure.[25]
In the past, the Supreme Court narrowly interpreted what constituted a search and seizure, thereby limiting the scope and protection under the Fourth Amendment.[26] In 1928, in Olmstead v. United States, the Court held the Fourth Amendment is not implicated unless there has been an official search and seizure of person, papers, material effects or home.[27] In the Court’s view in Olmstead, wiretapping a phone conversation did not amount to search or seizure because it did not amount to a physical search.[28] An official search that would implicate the protections of the Fourth Amendment must be one where there is a trespass to one’s home, body or their personal property.[29] This physical interpretation of a search does not account for any kind of breach of digital privacy.[30]
However, in more recent years, the Court has updated their view on what constitutes a search or a seizure updating their jurisprudence with the expansion of technology.[31] In 1967, in Katz v. United States, the Supreme Court overruled Olmstead holding that searches and seizures under the Fourth Amendment apply to tangible items as well as audio recordings taken without any trespass defined under state law.[32] This case significantly altered the way in the Supreme Court construed a search and seizure that implicated the protections under the Fourth Amendment.[33] After Katz, physical intrusion was no longer the standard to determine whether there was a search and seizure.[34] Katz paved the way of modern day digital privacy by recognizing a search does not need to be a literal physical intrusion like once was required.[35]
In his concurring opinion in Katz, Justice Harlan theorized the reasonable expectation of privacy doctrine.[36] Justice Harlan reasoned that a man or woman had a reasonable expectation of privacy in a place where one is alone such as a telephone booth but does not have this same expectation in a location such as an open field because there is the possibility that others are around in that kind of space.[37] He explained that one has an expectation of privacy when speaking in their home, but not when they are speaking in public.[38] However, the mere fact that something is open to the public does not make one’s expectation of privacy unreasonable.[39] A telephone booth is private because one shuts the door behind.[40] This assumes the call cannot be heard by the public. Thus, the test for determining whether or not a search is reasonable is that of a totality of the circumstances, with no one factor being dispositive.[41]
When determining whether or not one has a reasonable expectation of privacy, the Court has consistently held the home deserves the utmost protection under the Fourth Amendment.[42] In Silverman v. United States, the Court stated, “At the very core stands the right of a man to retreat into his own home and there be free from unreasonable governmental intrusion.”[43] Recently, in 2001, the Court reemphasized that notion in Kyllo v. United States, Justice Scalia writing for the majority stated, “[w]ith few exceptions, the question whether a warrantless search of a home is reasonable and hence constitutional must be answered no.”[44]
The notion that the home is to receive the utmost protection under the Fourth Amendment seems to conflict with the Court’s third party doctrine, which holds that it is unreasonable to have an expectation of privacy in something when a third party has access to that information or thing.[45] In Smith v. Maryland in 1979, the Supreme Court held that the warrantless use of a pen register did not violate one’s Fourth Amendment rights.[46] In Smith, police installed a pen register to record what numbers the petitioner dialed on his home phone.[47] The court reasoned the petitioner did not have a reasonable expectation of privacy while dialing phone numbers in his own home because the phone company has access to the telephone numbers one dials.[48] Thus, because the petitioner voluntarily used the phone service and knew they had access to the numbers of the phone calls he made, it was unreasonable for him to have an expectation of privacy in which phone calls he made.[49] Here, even though the petitioner made phone calls in his home, it was still unreasonable to expect privacy, which seems to constrain or even go against the holding in Katz.[50]
While the Court decided the petitioner in Smith did not have a reasonable expectation of privacy in the phone numbers he called, the Court indicated that privacy was not an all or nothing principle.[51] Quoting Justice Marshall’s dissent from an earlier case, Cal. Bankers Association v. Shultz, the majority opinion in Smith stated, “Privacy is not a discrete commodity, possessed absolutely or not at all. Those who disclose certain facts to a bank or phone company for a limited business purpose need not assume that this information will be released to other persons for other purposes.”[52] Hence, merely because someone gives up their right to privacy by disclosing their phone number, it does not mean the communications of that phone are not private. In the context of smart home devices, this means that simply because users consent to Amazon and Google having access to their location, it does not mean they give up their right to privacy in what music they listen to or what information they ask their devices. However, it does mean that by storing information on servers, users would seem to forfeit their right to privacy with what is on those servers. For Amazon users and their devices, this means that whatever commands they ask of their device, as well as their device’s responses, are not private.
This summer, the Court limited the scope of the third-party doctrine holding that it does not apply in the context of cellphones.[53] Carpenter v. United States involved a Fourth Amendment challenge to the federal government’s acquisition of the defendant’s cell phone location information over 127 days from wireless carriers without a warrant.[54] Traditionally, under the Third Party Doctrine, obtaining this cell phone location is not considered a search under the Fourth Amendment because a third party, wireless carriers, have access to this information.[55] However, the Court modified this doctrine holding that a warrant is required “where a suspect has a legitimate privacy interest in records held by a third party.”[56] While the Court did not define what constituted a legitimate privacy interest, the Court did find the acquisition of the cell phone location to represent a search because of the unique nature of cell phone location data.[57] Mapping a cell phone’s location over the course of 127 days provides an all-encompassing record of the holder’s whereabouts. As with GPS information, the time-stamped data provides an intimate window into a person’s life, revealing not only his particular movements, but through them his ‘familial, political, professional, religious, and sexual associations.’[58]
However, in holding a warrant supported by probable cause was necessary to obtain the location data, the Court indicated they were only limiting the Third-Party Doctrine in the area of cell phone location.[59]
As the analysis above suggests, smart home device users are not protected by the Fourth Amendment under current case law because access to the information they possess is not considered a traditional search or seizure, and does not implicate the protections of the Fourth Amendment. While the Fourth Amendment traditionally provided the utmost protection for the home, given the Third-Party Doctrine, is unclear whether it is reasonable to expect privacy when using smart devices in one’s home given third parties have access to this information per the terms of agreement users accept when using home smart devices. In Carpenter, the Court held the Third-Party doctrine did not apply because cell phone location data is able to provide a complete profile on someone including not only their whereabouts but also whom they associate with.[60] Like cell phone location data, smart home device data also contains this kind of deeply personal information such as what music one listens to and what books and articles they read. Given the similarities between the data, smart home device information should be afforded the same protection as cell phone location data and the Third-Party Doctrine should also not apply in the case of smart home devices.