And the FTC gave another wrist slap
You might have concerns about the security of two of Amazon’s most popular IoT products, Ring and Alexa, but they weren’t enough worries after all. A recent investigation by the US FTC has revealed some pretty chilling facts about Amazon’s handling of the recordings it makes and the complete lack of security protocols Amazon supposedly follows.
Instead, it appears that unencrypted recordings of the ring on Amazon’s servers were treated like YouTube videos and shared among employees. Anyone using Ring can access the saved videos to watch or share with employees. This undoubtedly includes recording from inside the user’s home as well as the doorbell. Even when some employees reported some rather gruesome videos being exchanged, management informed them that it was perfectly acceptable behavior and that appropriate support should be provided.
As for Alexa, we store everything you say, even recording your kids. There was no retention policy in place to delete recordings after a period of time, and recordings were also used to train Alexa to improve her language recognition skills without thinking about the content. Parents can contact Amazon to specifically request that their child’s recordings be deleted, but the FTC states that after a request is made, the recordings will only be deleted from certain databases and will still be stored in others. I found many examples.
The Register said the fines totaled US$30.8 million, less than one day’s worth of Amazon’s profits. Amazon, too, has denied wrongdoing, but happily dumped change into the FTC to settle complaints.
