Amazon Echo recorded a couple’s conversation, then sent audio to someone they know

A couple in Portland, Ore., received a nightmarish phone call two weeks ago.

“Unplug your Alexa devices right now,” the caller said. “You’re being hacked.”

Apparently, one of the Amazon.com Inc. Alexa-powered Echo devices in their home had silently sent recordings to the caller, without the couple’s permission. The caller, who happened to be an employee of the husband, was in the couple’s contact list.

“My husband and I would joke and say, ‘I’d bet these devices are listening to what we’re saying,’” a woman who identified herself only by her first name, Danielle, told KIRO 7, a local news station covering Seattle and western Washington state.

“We unplugged all of them and [the caller] proceeded to tell us that he had received audio files of recordings from inside our house,” she said. “At first, my husband was, like, ‘No you didn’t!’ And the [recipient of the message] said, ‘You sat there talking about hardwood floors.’ And we said, ‘Oh, gosh, you really did hear us.’”

Danielle said she felt invaded after listening back to her own conversations, silently captured by an eavesdropping machine. “I’m never plugging that device in again,” she said. “I can’t trust it.”

Amazon said in a statement Thursday afternoon that the Echo woke up when it heard a word that sounded like “Alexa.”

“The subsequent conversation was heard as a ‘send message’ request,” Amazon said. “At which point, Alexa said out loud ‘To whom?’ The background conversation was then interpreted as a name in the customers’ contact list.’

The company also said: “As unlikely as this string of events is, we are evaluating options to make this case even less likely.”

It was not clear what type of Echo device was involved.

Danielle told KIRO 7 that the device did not tell her that it would be sending the recorded conversations.

The couple used Amazon’s voice-activated devices throughout their home to control heat, lights and the security system, according to the news report. In 2014, Amazon introduced the line of devices, which can also stream music and order goods from Amazon via voice command. The company has been busy introducing updated versions and adding features to sell more devices than rivals such as Alphabet Inc. and Apple Inc., which are rolling out their own versions.

Voice-activated assistants such as the Echo and Google Home have gone mainstream. More than 60 million U.S. consumers will use a smart speaker at least once a month this year, with more than 40 million of them using Amazon’s devices, according to EMarketer Inc.

But Amazon’s lead in the market is slipping. The company shipped 2.5 million Echo devices globally in the first quarter, compared with 3.2 million Google devices shipped in the same period, according to research firm Canalys.

People have been willing to overlook glitches in the Echo — for example, if the device turns on accidentally or without the wake word being uttered, said Ryan Calo, an associate law professor at the University of Washington who researches how law applies to technology. This incident is more alarming because a private conversation was recorded and sent to a third party, he said.

“Think about how uncomfortable the millions of people who own these things now feel,” Calo said. “The real harm is the invasion into solitude people now experience in their homes.”

This is not the first time Amazon’s smart speaker has garnered scrutiny over potential eavesdropping. Last month, researchers discovered a flaw in the Alexa voice assistant that enabled an Echo to continue listening to a person without the person knowing. The devices are supposed to record audio only after users issue a voice command, known as a wake word. Amazon quickly fixed the vulnerability after researchers alerted the company.

Daniel Kahn Gillmor, a staff technologist for the ACLU’s speech, privacy and technology project, said that the intuitive nature of connected devices can mask their complexity and the possibility of malfunction.

“The Amazon Echo, despite being small, is a computer — it’s a computer with microphones, speakers, and it’s connected to the network,” he said. “These are potential surveillance devices, and we have invited them further and further into our lives without examining how that could go wrong. And I think we are starting to see examples of that.”

Amazon’s chief executive, Jeffrey P. Bezos, owns the Washington Post.

Shaban writes for the Washington Post. Bloomberg was used in compiling this report.

UPDATES:

4:45 p.m.: This article was updated with comments from Amazon and Daniel Kahn Gillmor and with additional background information.

This article was originally published at 1:05 p.m.