When voices listen in
By: Noemi Zarb
Tags: Smart Home, Covid 19, Privacy, Digital Assistant, Electronics

When voices listen in

Serpstat on Pixels

While contact tracing apps are igniting a furious debate about the loss of personal freedom and succumbing to an all-seeing, all watching Big Brother, perhaps not that many people realise that they already have a can of worms inside their homes as their digital assistants listening in and record the most mundane of daily conversations as well as work-related exchanges now that working from home is intrinsic to the ‘new normal’ and likely to mushroom despite the easing of lockdown measures in certain parts of the world while the coronavirus is still raging or rearing its lethal head in others.

Digital assistants (a.k.a. voice assistant or virtual assistants) comprise voice-activated software that can carry out a range of tasks based on the user’s command. For example, to turn the lights on or off. This kind of software is very common in smartphones (think Siri) and in home-based devices (think Alexa). They obey instructions by being activated to listen with the user’s consent. They also record the clips to be converted into text and further online searches — for instance when wanting to know the latest weather reports or traffic news. This enables the storage of common requests while gaining a fuller understanding of the user’s manner of speech. In line with the principle of practice makes perfect, the more they are used, the better they perform.

Although regarded as handy and helpful, these services raise data protection concerns that should not be taken lightly either by their producers or their users. As digital assistants evolve from a must-have, trendy gadget to becoming part of 21stcentury furniture, consumers need to be alert and understand the implications of using them.

Unsurprisingly concerns about privacy infringement have been rising. Yet unlike the helplessness most employees are now feeling when bosses compel them to download certain apps on their mobile phones, smart speaker owners have both the right and the responsibility of knowing the risks when using their virtual assistants.

Legally speaking, these issues cannot be dealt with in a universal manner since privacy laws differ from jurisdiction to jurisdiction. For instance, the General Data Protection Regulation 2016/679 holds sway in the EU Member States and the European Economic Area. This regulation also addresses the transfer of personal data outside the EU and EEA areas.

Although GDPR does not explicitly spell out the use of voice-activated assistants or smart speakers, it defines personal data as data attached to a person that enables either direct or indirect identification of a natural person’s unique physical or physiological attributes. This leads to biometrics. The EU’s GDPR defines biometric data as: “personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person”. Given that biometrics incorporate voice biometrics, a voiceprint becomes a means of identification which is regarded as sensitive personal information.

This is important to keep in mind because the dizzying pace of technological advances may lead to digital assistants as identification tools so that the issue of sensitive personal information cannot be avoided. Talk of the ‘new normal’ actually means that the Covid-19 pandemic is turbocharging AI in every sphere of our working and private lives — the boundaries of which have continued to blur while teleworking. As consumers and employees, are we simply willing to go with the flow? And even if we are not apathetic, do we really know what we are letting ourselves into when we ‘invest’ in such devices?

As things currently stand, the least we can do when using digital assistants is to come to grips with who is listening and what is happening to our data. This point of take-off leads to three crucial questions that cannot be overlooked, namely:

w Do we know our rights and understand them?

w Is the device developer transparent on the collection and use of data?

w Do we understand the kind of consent we give for our data to be recorded and transmitted?

It is therefore up to us to know our rights and what we are purchasing rather than allow ourselves to be bamboozled with sales talk. We need to watch out for developer compliance according to the jurisdiction we live in and read the relevant policies. Moreover, we need to understand the implications of giving our explicit user consent while being fully aware of which part of the device records and logs our data. We cannot be complacent about how smart technology works and what we agree to when using it, especially since legislation cannot keep up with the pace of technology.

More so now that we are living in the Covid-19 age which accelerated an overnight worldwide transition of millions of employees from working from the office to working from home with little time for data security personnel to plan let alone implement appropriate security measures. The result? Thousands of hacking victims on a daily basis across the globe.

While utilising information that is accessible to activated digital assistants in private residences is legal since users have given their consent in this regard, it does not immediately follow that companies have authorised the access, recording, analysing, and mining of company data by its employees when teleworking. Nor does a company policy prohibiting the use of digital assistants in the workplace automatically cover a similar ban for working from home, which in turn is difficult to monitor in the first place.

As companies have been frantically catching up with preventing and addressing cybersecurity issues, clear thinking goes a long way in warding off unintentional yet easily slipped work-related conversations and/or leaks of confidential company information by staff working from home via their digital assistants which are likely to be turned on 24/7. Employees do not need to wait for the formulation of company policy regarding the use of digital assistants when working from home that is bound to become the norm anyway.

Once upon a time eavesdropping was regarding as rude and a bad habit. Good manners have, however, long gone by the wayside. Where does this leave us? In a place where we must remember to turn off our Alexa or Siri when we are on the job in our own house. Sounds simple, but it is amazing how many of us are ceasing to be smart when using smart technology.