Big tech lobbying gutted a bill that would ban recording without consent(motherboard.vice.com)
motherboard.vice.com
Big tech lobbying gutted a bill that would ban recording without consent
https://motherboard.vice.com/en_us/article/ywyzm5/big-tech-lobbying-gutted-a-bill-that-would-ban-recording-you-without-consent
63 comments
I'm against laws prohibiting recording without consent. Recording is a way for the weak to defend themselves against the powerful. If someone calls me, or comes up to talk to me, I should be able to document electronically whatever is said to me.
I agree with you. But that’s called one party consent and this isn’t that.
This is a ban on zero party consent, where the manufacturer of a device records remotely without proper notification. That’s another thing entirely.
This is a ban on zero party consent, where the manufacturer of a device records remotely without proper notification. That’s another thing entirely.
Illinois already required two party consent. What would this law have blocked that isn’t already illegal?
Wouldn't that just degenerate to one party consent with the manufacturer as the consenting party?
I'm perfectly fine with a ban on companies and institutions recording individuals. They are very rarely, if ever, the 'weak'.
What if they are journalists? That's the slippery slope here.
you must understand that authority will selectively use evidence as well. Especially considering deepfakes, I don't see a path towards the use of non-approved devices with secure digital evidence possession chains as evidence in court.
The article makes this out to be about digital devices like Echo and Google home. I agree that these devices should allow for choice in what gets sent back to the companies.
More broadly, I believe that being able to secretly record conversations you participate in is probably for the best. This varies state to state. For example, in New York 1 party consent is legal but in California it is illegal, from my understanding.
Though I haven't had a need to secretly record anything, it feels like a backstop against fraud from bad actors. You hear about so many horror stories from telephone customer service, law enforcement etc, that may have had a recourse if only there was a recording.
More broadly, I believe that being able to secretly record conversations you participate in is probably for the best. This varies state to state. For example, in New York 1 party consent is legal but in California it is illegal, from my understanding.
Though I haven't had a need to secretly record anything, it feels like a backstop against fraud from bad actors. You hear about so many horror stories from telephone customer service, law enforcement etc, that may have had a recourse if only there was a recording.
I live in a state that requires 2 party consent to record audio. Does this mean I can report a crime every time I say something near a Alexa?
Strictly speaking (and I am not a lawyer, this isn't legal advice etc), if you set up alexa, you presumably consented to the TOS, but others who might use it might not have consented.
That said, good luck getting a prosecutor to go after Amazon for it. You'd be better off speaking to an attorney about some sort of class action lawsuit, presuming that your ability to sue them isn't governed by some other agreement with the company.
Alternatively, the rules for keeping information on those 13 and under might be implicated.
That said, good luck getting a prosecutor to go after Amazon for it. You'd be better off speaking to an attorney about some sort of class action lawsuit, presuming that your ability to sue them isn't governed by some other agreement with the company.
Alternatively, the rules for keeping information on those 13 and under might be implicated.
Isn't the person who installed the device the one who is liable? Just like the law applies to regular cameras and microphones?
I honestly don't know, not a lawyer though I enjoy reading about legal issues from time to time.
I imagine that if the recording wasn't made legally, you could at least get a court to order them to delete it, even if they weren't liable for damages or something.
I imagine that if the recording wasn't made legally, you could at least get a court to order them to delete it, even if they weren't liable for damages or something.
In some sense, the whole purpose of Alexa is to record what you're saying; I think it would be hard to argue that it's recording without consent if you set it up in your own home, or interacted with it in somebody else's home, or in public (where you wouldn't have an expectation of privacy anyhow).
It's hard for me to think of interjecting "Alexa!", or whatever it is you have to say, as anything but explicit consent to be recorded, and for that recording to be accessible to Amazon employees and contractors under some reasonable non-disclosure terms.
It's hard for me to think of interjecting "Alexa!", or whatever it is you have to say, as anything but explicit consent to be recorded, and for that recording to be accessible to Amazon employees and contractors under some reasonable non-disclosure terms.
>> In some sense, the whole purpose of Alexa is to record what you're saying
No. Just no. When voice recognition is done locally there is no reason to record you and certainly no reason to send those recordings to the cloud. Most Alexa users didn't know it was recording them until stories broke about it. If recording is "the whole purpose" of the device I think the public has been terribly lied to.
No. Just no. When voice recognition is done locally there is no reason to record you and certainly no reason to send those recordings to the cloud. Most Alexa users didn't know it was recording them until stories broke about it. If recording is "the whole purpose" of the device I think the public has been terribly lied to.
Ok but there's a distinction to be made. Right now on the front page of HN is a thread about LEO using Google data.
Most people probably think the data they're handing over to big tech is just used for an immediate, apparent purpose. Not stored and shared.
Most people probably think the data they're handing over to big tech is just used for an immediate, apparent purpose. Not stored and shared.
Maybe these companies have some responsibility to push awareness in the faces of the customers, that the only way to offer these services reliably is to study actual user stimulus.
I don't understand why people have so little restraint though. If you don't like these devices (I don't like them, and don't want one in my own home), then you can't complain when the things you don't like about them come to bite you in the ass.
I can understand being upset at being subtly betrayed by some ubiquitous and inescapable tool, some might argue that social media sites are becoming an effective privately-owned public square, deserving of some of the protections that offers (as established by the norms of the courts); but in this case you have absolutely every right and convenience not to buy personal assistant terminals and fit them in your homes.
I don't trust smartphones, so I don't use them as phones; there are certain banks here in Canada I won't do business with because of bad reputations. It's all well and good to be concerned about a product, but if you're not willing to walk away from a luxury good which is not essential in your life, even though it violates your basic principles of good living, you have nobody to blame but yourself.
If you won't take the most basic, simple, and convenient steps to uphold your principles, do you really have any?
I don't understand why people have so little restraint though. If you don't like these devices (I don't like them, and don't want one in my own home), then you can't complain when the things you don't like about them come to bite you in the ass.
I can understand being upset at being subtly betrayed by some ubiquitous and inescapable tool, some might argue that social media sites are becoming an effective privately-owned public square, deserving of some of the protections that offers (as established by the norms of the courts); but in this case you have absolutely every right and convenience not to buy personal assistant terminals and fit them in your homes.
I don't trust smartphones, so I don't use them as phones; there are certain banks here in Canada I won't do business with because of bad reputations. It's all well and good to be concerned about a product, but if you're not willing to walk away from a luxury good which is not essential in your life, even though it violates your basic principles of good living, you have nobody to blame but yourself.
If you won't take the most basic, simple, and convenient steps to uphold your principles, do you really have any?
I refuse to have one of these in my house, but that doesn't mean I can reasonably escape being recorded without my consent - a large percentage of the people I know have these things.
The reasonable thing to do is to make it so that these don't transmit recordings, or at the very least, that there are hard promises made to not store the recordings.
If the companies need training data, they can go spend the money to hire people to provide samples.
The reasonable thing to do is to make it so that these don't transmit recordings, or at the very least, that there are hard promises made to not store the recordings.
If the companies need training data, they can go spend the money to hire people to provide samples.
>It's hard for me to think of interjecting "Alexa!", or whatever it is you have to say, as anything but explicit consent to be recorded, and for that recording to be accessible to Amazon employees and contractors under some reasonable non-disclosure terms.
Utter hogwash. The voice activation is a form of user input, nothing more. By that same logic, you could argue that use of a keyboard is explicit consent to have all keystrokes recorded, and for that keylog to be accessible to the manufacturer of the keyboard, their employees, and their contractors.
Utter hogwash. The voice activation is a form of user input, nothing more. By that same logic, you could argue that use of a keyboard is explicit consent to have all keystrokes recorded, and for that keylog to be accessible to the manufacturer of the keyboard, their employees, and their contractors.
> Utter hogwash. The voice activation is a form of user input, nothing more. By that same logic, you could argue that use of a keyboard is explicit consent to have all keystrokes recorded
It's like typing in to a search engine, which these days means live streaming results. Seems you are empowering them to analyze those search inputs just the same.
It's like typing in to a search engine, which these days means live streaming results. Seems you are empowering them to analyze those search inputs just the same.
The type and amount of data transmitted, and the type and amount of data preserved depend on what is being done. Exceeding the minimum amount of data transmitted/preserved is a violation of privacy.
- Case 1: local action, such as playing music, making a calendar event, setting an alarm. These have no need to be sent to
- Case 2: remote action, such as performing a search. The audio can be parsed locally, with the search terms then sent externally to get the results.
In neither case is it necessary to send the raw audio anywhere. In neither case is it necessary to record the audio for future use.
- Case 1: local action, such as playing music, making a calendar event, setting an alarm. These have no need to be sent to
- Case 2: remote action, such as performing a search. The audio can be parsed locally, with the search terms then sent externally to get the results.
In neither case is it necessary to send the raw audio anywhere. In neither case is it necessary to record the audio for future use.
> The audio can be parsed locally
Speech recognition doesn't work like that, there's no yacc/lex for you to just "run locally". Device-local recognition is limited, and not very agile. It often takes years for it to recognize new words, and it usually has extreme bias toward a handful of urban centres.
I don't like sending my data away, and I choose not to, but it is simply not realistic to expect Google-quality or Amazon-quality continuous real time speech recognition and nlp to happen entirely on-device.
Speech recognition doesn't work like that, there's no yacc/lex for you to just "run locally". Device-local recognition is limited, and not very agile. It often takes years for it to recognize new words, and it usually has extreme bias toward a handful of urban centres.
I don't like sending my data away, and I choose not to, but it is simply not realistic to expect Google-quality or Amazon-quality continuous real time speech recognition and nlp to happen entirely on-device.
You can already run an offline google translate that will not only recognize your words but translate it to a foreign language.
On my Mac, I can download the Apple speech recognition software and it accurately recognizes all of my speech. I’m not from an urban area and it does a great job recognizing new words. It takes under 10 gigabytes of storage, if I remember correctly. So I don’t know what you’re on about.
Of course you can run it locally. The model / dictionary vector files you need are measured in the 10s of MB. Unless you're Apple and still consider a 128GB SSD an acceptable base storage size, you can and should have room for multiple dictionaries and models.
[deleted]
> Speech recognition doesn't work like that, there's no yacc/lex for you to just "run locally"
Why not? It _could_:
> In our recent paper, "Streaming End-to-End Speech Recognition for Mobile Devices", we present a model trained using RNN transducer (RNN-T) technology that is compact enough to reside on a phone. This means no more network latency or spottiness — the new recognizer is always available, even when you are offline. [...]
> The RNN-T we trained offers the same accuracy as the traditional server-based models
https://ai.googleblog.com/2019/03/an-all-neural-on-device-sp...
Why not? It _could_:
> In our recent paper, "Streaming End-to-End Speech Recognition for Mobile Devices", we present a model trained using RNN transducer (RNN-T) technology that is compact enough to reside on a phone. This means no more network latency or spottiness — the new recognizer is always available, even when you are offline. [...]
> The RNN-T we trained offers the same accuracy as the traditional server-based models
https://ai.googleblog.com/2019/03/an-all-neural-on-device-sp...
> Why not? It _could_:
It did. Anyone remembers the good ol' Microsoft Speech API of ~Windows 2000/XP era?
It did. Anyone remembers the good ol' Microsoft Speech API of ~Windows 2000/XP era?
This is really cool!
Totally agree. The raw audio shouldn't be sent back or at a minimum not stored.
The speech recognition is running remotely, only wakeword recognition is local on most of the devices.
Which is really a problem that needs to be solved. Just because it's cheaper to do something in the cloud, doesn't mean it should be done in the cloud.
IMO, it's cheaper and (importantly) better to do it in the cloud. Better in there's steady improvement to customer experience with zero customer interaction, a cleaner developer "apps" marketplace, and each local device can be smaller, cheaper, and lower power.
Not if it implies violating customer privacy. As a company you either have a customer or an employee - you can't have it both ways. There is one way it is ethical: when you have the informed consent of volunteers. That works for charities because there is no money being exchanged to corrupt the interaction.
IMO the only appropriate context for gaining training data is when you're explicitly paying people for that.
Informed consent does not mix with volunteering to make money for a private company. That people are ignorant does not justify abusing them.
IMO the only appropriate context for gaining training data is when you're explicitly paying people for that.
Informed consent does not mix with volunteering to make money for a private company. That people are ignorant does not justify abusing them.
Except that fully local tasks now cannot be done fully locally, more data than needed for the task is leaked to the service provider, and the whole thing becomes a centralized ordeal. It turns into a single service what should be a product giving access to mulitple services. It offers degraded user experience due to latency (reason #1 I don't use voice assistants, #2 being not much useful to be done with them if I can't trivially write code gluing them with stuff I have in my house), stops working completely when there's not Internet connection (Internet isn't and can never be as reliable as power), and I'm doubtful of how significant power benefits are once you account for the power that's used by various routers to transmit your voice to the cloud and get the results back.
Power and cost benefits from the perspective of the end user. I have a device that draws under 10W that is (as far as I'm concerned) capable of world-class and ever-improving voice recognition and interaction. That a service provider or set of service providers are providing me temporary use of kilowatts of computing computing power that I don't ever see a bill for is irrelevant from the perspective of "is it worth me paying $40 and $5 of electricity per year to have a tiny voice assistant?" vs "is it worth me paying $500 and $75/year in power for a fully local, larger, and inferior solution?"
It's unsurprising to me that the market evolved towards the former as the latter would almost surely be a commercial failure.
It's unsurprising to me that the market evolved towards the former as the latter would almost surely be a commercial failure.
I'm not surprised by the way the market evolved either, but I consider it a bug, not a feature. I'm a firm believer that if something is to be done, it deserves at least an attempt at doing it right. The product version would be a commercial failure only because it has to compete with the service version; the story would be different if the service version wasn't allowed to exist in the first place.
Also let's not overestimate the involvement of the cloud in the actual voice recognition. With ML models, it's the training of a model that's expensive, not the actual use of that model. I don't see a reason why voice models, once trained, couldn't be run on the device, at a slightly increased cost of compute (of which phones have plenty). It would be fair and good engineering to provide models in exchange for payment.
And no, I don't buy "it's not that simple", because I've worked with MS Speech API over a decade ago, on much slower hardware and on a shitty microphone I soldered myself from parts, and it did work well enough in "fixed grammar" mode after a bit of training with various sources of background noise (read: very loud music). I don't believe there's any technical obstacle; the decision to run this in a cloud is a purely business one, and like many modern business models, this one is geared towards extracting value from purported customers, not giving value to them.
Also let's not overestimate the involvement of the cloud in the actual voice recognition. With ML models, it's the training of a model that's expensive, not the actual use of that model. I don't see a reason why voice models, once trained, couldn't be run on the device, at a slightly increased cost of compute (of which phones have plenty). It would be fair and good engineering to provide models in exchange for payment.
And no, I don't buy "it's not that simple", because I've worked with MS Speech API over a decade ago, on much slower hardware and on a shitty microphone I soldered myself from parts, and it did work well enough in "fixed grammar" mode after a bit of training with various sources of background noise (read: very loud music). I don't believe there's any technical obstacle; the decision to run this in a cloud is a purely business one, and like many modern business models, this one is geared towards extracting value from purported customers, not giving value to them.
Gboard has an agreement similar to that.
Wow. Here I thought I was following the logic to something that would universal be agreed upon as being absurd. I wonder if that would be a new variation of Poe's Law: "There is no invasion of privacy so great that Google will not have a product utilizing it."
A friend of mine is named Alexa. Is this consent?
>It's hard for me to think of interjecting "Alexa!", or whatever it is you have to say, as anything but explicit consent to be recorded, and for that recording to be accessible to Amazon employees and contractors under some reasonable non-disclosure terms.
That assumes everyone knows all the words which trigger a recording device and that those devices actually remotely record sound. Including a 90 year who hasn't use anything beyond a rotary telephone.
That assumes everyone knows all the words which trigger a recording device and that those devices actually remotely record sound. Including a 90 year who hasn't use anything beyond a rotary telephone.
How about when it mistakenly decides the trigger word was uttered? Or when someone on the television or a YouTube video says the trigger word?
For someone to be criminally liable you have to show that they knowingly recorded somebody without their consent. An accidental trigger would definitely not qualify. For them to be liable civilly you'd have to show that you suffered some harm from the accidental recording and that they were negligent in allowing it to happen, and I have a very hard time believing that there are many situations where that's possible.
Are you specifically referring to these laws in each state? Becase negligence can lead to criminal liability without intent depending on the statute.
I am referring to the laws specifically.
California's law specifically states that a beep is sufficient to establish recording notification, so that one is out; Florida's law requires intention; as do Illinois, Maryland, Massachusetts, New Hampshire, and Pennsylvania.
Washington is the only state where it isn't totally 100% clear, and the law seems to read that a tone would be sufficient to establish consent.
California's law specifically states that a beep is sufficient to establish recording notification, so that one is out; Florida's law requires intention; as do Illinois, Maryland, Massachusetts, New Hampshire, and Pennsylvania.
Washington is the only state where it isn't totally 100% clear, and the law seems to read that a tone would be sufficient to establish consent.
> It's hard for me to think of interjecting "Alexa!", or whatever it is you have to say, as anything but explicit consent to be recorded,
Alexa is the name of my friend's one-year-old daughter. It's short for Alexandra, but that's what we call her. So yes I've said that name a lot in a variety of different places, and never expected to be recorded.
Alexa is the name of my friend's one-year-old daughter. It's short for Alexandra, but that's what we call her. So yes I've said that name a lot in a variety of different places, and never expected to be recorded.
> It's hard for me to think of interjecting "Alexa!", or whatever it is you have to say, as anything but explicit consent to be recorded,
There is a certain spectrum of possibilities for how Alexa can handle this audio, all plausible and not equally worthy of consent: from immediate offline processing after explicit activation (never even record a whole command, just as much as is needed and never start processing unless a trigger word was said) to uploading everything to Amazon (including things that may or may not have been trigger words) and having employees listen in on private conversations.
Non-IT-people won't be able to know exactly what they're supposedly consenting to, nor whether what Amazon and Google are doing is actually necessary for their gadget to function.
There is a certain spectrum of possibilities for how Alexa can handle this audio, all plausible and not equally worthy of consent: from immediate offline processing after explicit activation (never even record a whole command, just as much as is needed and never start processing unless a trigger word was said) to uploading everything to Amazon (including things that may or may not have been trigger words) and having employees listen in on private conversations.
Non-IT-people won't be able to know exactly what they're supposedly consenting to, nor whether what Amazon and Google are doing is actually necessary for their gadget to function.
I think what you mean to say is that you live in an "all party consent" jurisdiction. "Two party consent" would imply that if there are more than two parties then only the consent of two of them is needed.
This is not correct. For example,
> Germany is a two-party consent state—telephone recording without the consent of the two or, when applicable, more, parties is a criminal offence according to Sec. 201 of the German Criminal Code—violation of the confidentiality of the spoken word.
https://en.m.wikipedia.org/wiki/Telephone_call_recording_law...
This is similar to how the word "assault", to the layperson, implies a physical element, but to the law it does not.
> Germany is a two-party consent state—telephone recording without the consent of the two or, when applicable, more, parties is a criminal offence according to Sec. 201 of the German Criminal Code—violation of the confidentiality of the spoken word.
https://en.m.wikipedia.org/wiki/Telephone_call_recording_law...
This is similar to how the word "assault", to the layperson, implies a physical element, but to the law it does not.
In the first case the term "two party" is describing a defence (consent). Defences may vary from jurisdiction to jurisdiction, so the term might be useful in highlighting those differences.
In the second case the term ("assault") is the offence itself. It is not a term that is being used to highlight differences in elements or defences amongst jurisdictions.
Being accurate in the first case makes sense, regardless of the audience.
In the second case the term ("assault") is the offence itself. It is not a term that is being used to highlight differences in elements or defences amongst jurisdictions.
Being accurate in the first case makes sense, regardless of the audience.
This would be a good bill. Devices like Alexa should never transmit conversations back to Amazon's servers but all processing should be done locally. They should learn to train their system without real user data.
They can use real user data if they ask[1] for it first. Let users browse their poor-quality/failed interpretations, recent commands, etc, and submit the data they want. If you're clever with the UI, you might even get them to attach the desired/correct interpretation if they really want a particular error fixed. Alternatively, use the Nielsen method of simply paying people for their data.
[1] in the "informed consent" sense, not the usual open ended "you agreed to give us whatever we want in our contract of adhesion" dark pattern.
[1] in the "informed consent" sense, not the usual open ended "you agreed to give us whatever we want in our contract of adhesion" dark pattern.
Yeah, I'd actually prefer that. If system guesses mis-recognition, ask me if you got what I said right, and if not, ask if you can use this as a training example. Have me enter on the phone the text that corresponds to what I was saying, and explicitly approve it for training. Better yet, if this creates an adaptation of the general model specifically for me.
But what if the user asks Alexa about some topic on e.g. Wikipedia? Should Alexa store the entire web upfront? At some point it might need to send a request of some sort to a server.
Why would this use-case require to call to Amazon? Going to Wikipedia should suffice.
If I ask a machine for the Wikipedia article about “such-and-such”, then I fully expect “such-and-such” to go over the network. If I ask for my lights to turn off, the cloud has no legitimate need to know about it.
(The best counterargument I can think of is that the speech recognizer might be too computationally expensive to run on cheap hardware.)
(The best counterargument I can think of is that the speech recognizer might be too computationally expensive to run on cheap hardware.)
Wikipedia is not a good example. It is freely licensed, available to download in its entirety and easily fits on a 30$ memory card.
In other cases those personal assistants could first ask permission to query an API or search engine.
In other cases those personal assistants could first ask permission to query an API or search engine.
A $30 memory card is the entire cost of an Echo device -- that's a 100% increase in cost just to cache Wikipedia locally.
That's a non-trivial modification, even before talking about the processor upgrades required to actually utilize that information and do local processing.
Your suggestion would drive the cost of an Echo from $30 to $300.
That's a non-trivial modification, even before talking about the processor upgrades required to actually utilize that information and do local processing.
Your suggestion would drive the cost of an Echo from $30 to $300.