When your gadgets snitch on you
Did Timothy Verrill murder Christine Sullivan and Jenna Pellegrini in 2017? I have no idea, I suspect the Amazon Echo in Sullivan’s home probably doesn’t know either. But New Hampshire prosecutors want to interrogate the Echo anyway, just in case the voice-activated smart speaker was listening in when the murders occurred.
Echoes and other devices that connect to the “Internet of Things,” or IoT, now number in the millions. The smart thermostat in your living room, your smart TV, your intelligent light bulbs, or your Internet-connected home security cameras — all these and many more record valuable information about their users.
“These are snitches in our homes that can talk about our habits and our activities in the most sensitive setting in our lives,” said Antigone Peyton, an attorney specializing in technology litigation at Protorae Law in Tyson’s Corner, Va.
Our machines have been ratting us out ever since cars first sported fancy electronics. Nothing new there. What’s new is how many of our machines do it. If you combine the data from all of them, there’s the story of your life.
Nobody knows this better than law enforcement, which has sought access to IoT data in more cases. The Law Enforcement Cyber Center, cosponsored by the International Association of Chiefs of Police, offers a revealing infographic of the IoT devices in a typical middle-class American home that could be tapped for “digital evidence.”
Maybe you’ve got a smart electric meter. Unlike the old-school mechanical kind, these can tell when specific devices are switched on or off — such as an air conditioner, electric stove, or water heater. That’s a handy way for police to find out whether someone was at home on the night of July 15. The same goes for smart thermostats that turn themselves up or down when somebody’s home.
Your smart TV set or cable box keeps tabs on what you’ve been watching — and when. Some of the newest washers and dryers can shoot you an e-mail when your laundry’s done. And there are fitness devices that monitor our vital signs, ranging from high-end exercise machines to wearables like the Fitbit and Apple Watch.
I’m not sure how an e-mail from your washing machine could get you in trouble. But Fitbit data has factored into at least two murder cases Just last month, police in San Jose, Calif., arrested 90-year-old Anthony Aiello in connection with the death of his 67-year-old stepdaughter. The victim’s Fitbit’s heart rate monitor provided police with the exact time of death, and nearby surveillance cameras placed Aiello’s car at the home at the same time.
Even IoT-connected medical devices can squeal on us. In 2016, Ohio resident Ross Compton claimed he was sound asleep when his house caught fire. But suspicious police obtained a data readout from a digital pacemaker embedded in Compton’s chest. The data proved he was up and around when the fire began. Compton is now awaiting trial for arson.
For law enforcement, the most enticing gadgets are the ones with cameras or microphones. Hence the interest in Christine Sullivan’s Echo. Last week a judge in Strafford County Superior Court commanded Amazon to hand over any voice data captured by the device around the time of the murders.
Amazon declined to reveal its next move, but issued a rather surly statement: “Amazon will not release customer information without a valid and binding legal demand properly served on us. Amazon objects to overbroad or otherwise inappropriate demands as a matter of course.”
If the Echo works as Amazon says it does, the investigators will probably find nothing. The device is supposed to record sound only after it detects a “wake-up word,” usually the name “Alexa.” So unless the victim shouted something like, “Alexa, help!” forget about it.
Some civil libertarians worry investigators will scour every IoT device in our homes until they find something, anything. But Megan Brown, a cybercrime specialist at the law firm Wiley Rein, downplays this possibility.
One reason, ironically, is the sheer volume of IoT data. Collecting and reviewing it all is a lot of work. “I don’t think we’re going to see lots of blanket requests for lots of data, without the possibility that it’ll advance the ball,” said Brown.
In addition, recent rulings from the Supreme Court have made it much harder to get certain kinds of electronic data. Stuff like cellphone records that could once have been obtained with a simple subpoena now require a full-fledged search warrant, with a judge agreeing that the suspect has likely committed a crime. And even then, they can only search the items specified in the warrant. No fiddling with my Fitbit unless the judge said so.
Antigone Peyton, the attorney specializing in technology litigation, isn’t nearly as confident. “I am personally concerned that prosecutors will issue broad warrants and courts will just rubber stamp them,” she said. Peyton predicts years of litigation to set the limits on IoT device searches.
Of course none of this is a problem for those who only purchase dumb thermostats, ignorant TVs, and audio speakers that only speak and never listen. But if you can’t resist stuffing your home with IoT devices, remember to break the law someplace else. Otherwise your gadgets may rat you out.