Nov 19 – As a Virginia lawmaker, Ibraheem Samirah has studied Internet protection issues and discussed how to regulate the collection of personal data by technology companies. Still, he was shocked to learn the full details of the information Amazon.com Inc has gathered about him.
The e-commerce giant had more than 1,000 contacts from its phone. It had records of exactly what part of the Qur’an that Samirah, who had grown up as a Muslim, had listened to on December 17 last year. The company knew every single search he had made on his platform, including one after another books on “progressive community organization” and other sensitive health-related queries he thought were private.
“Do they sell products, or do they spy on ordinary people?” asked Samirah, a Democratic member of the Virginia House of Delegates.
Samirah was among the few Virginia lawmakers to oppose an industry-friendly, Amazon-draft state privacy bill passed earlier this year. At Reuters’ request, Samirah asked Amazon to disclose the data it collected about him as a consumer.
The company collects a wide range of information about its U.S. customers, and it began making this data available to anyone upon request early last year, after trying and failing to defeat a 2018 California measure that requires such disclosures. (U.S. Amazon customers can get their data by filling out a form on Amazon.com.)
Seven Reuters reporters also got their Amazon files. The data reveals the company’s ability to compile strikingly intimate portraits of individual consumers.
Amazon collects data about consumers through its Alexa voice assistant, e-commerce marketplace, Kindle e-readers, Audible audiobooks, video and music platforms, home security cameras and fitness trackers. Alexa-enabled devices make recordings inside people’s homes, and Ring security cameras capture every visitor.
Such information can reveal a person’s height, weight and health; their ethnicity (via clues contained in voice data) and political attitudes; their reading and buying habits; their whereabouts on a given day, and sometimes who they have met.
A reporter’s dossier revealed that Amazon had collected more than 90,000 Alexa footage of family members between December 2017 and June 2021 – an average of about 70 daily. The footage contained details such as the names of the reporter’s young children and their favorite songs.
Amazon caught the kids and asked how they could convince their parents to let them “play”, and got detailed instructions from Alexa on how they could persuade their parents to buy video games for them. Be fully prepared, Alexa advised the children, to refute common parental arguments such as “too violent”, “too expensive” and “you are not doing well enough in school.” The information came from a third-party program used by Alexa called “wikiHow,” which provides advice from more than 180,000 articles, according to Amazon’s website.
Amazon said it does not own wikiHow, but that Alexa sometimes responds to requests with information from websites.
Some recordings involved conversations between family members who used Alexa devices to communicate across different parts of the house. Several footage captured children apologizing to their parents after being disciplined. Others picked up the children aged 7, 9 and 12 and asked Alexa questions about expressions such as “pansexual”.
In one recording, a child asks, “Alexa, what’s a vagina?” In another: “Alexa, what does bondage mean?”
The reporter was not aware that Amazon kept the footage until the company revealed the data it tracked on the family.
Amazon says their Alexa products are designed to record as little as possible, starting with the trigger word “Alexa” and stopping when the user’s command ends. However, the footage of the reporter’s family sometimes captured longer conversations.
In a statement, Amazon said it has scientists and engineers working to improve the technology and avoid fake triggers asking for inclusion. The company said it warns customers that footage is saved when they create Alexa accounts.
Amazon said it collects personal data to improve products and services and customize them for individuals. Asked about the recordings of Samirah listening to the Quran on Amazon’s audiobook service, Amazon said such data allows customers to continue where they left off from a previous session.
The only way for customers to delete much of this personal data is to close their account, Amazon said. The company said it retains some information, such as purchase history, after closing the account to comply with legal obligations.
Amazon said it allows customers to adjust their settings on voice assistants and other services to limit the amount of data collected. For example, Alexa users can prevent Amazon from saving their recordings or have them deleted automatically at regular intervals. And they can disconnect their contacts or calendars from their smart speaker devices if they do not want to use Alexa’s calling or scheduling features.
A customer may opt out of having their Alexa recordings examined, but they will have to navigate through a series of menus and two warnings that say, “If you turn this off, voice recognition and new features may not work well for you.” Asked about the warnings, Amazon said that consumers who restrict data collection may not be able to customize some features, such as music playback.
Samirah, 30, got an Amazon Alexa-enabled smart speaker during last year’s holiday season. He said he only used it for three days before returning it after realizing that it totaled footage. “It really outlined me,” he said.
The device had already gathered all his phone contacts, part of a feature that allows users to make calls through the device. Amazon said Alexa users should give permission for the company to access phone contacts. Customers need to disable access to phone contacts, not just delete the Alexa app, to delete the records from their Amazon account.
Samirah said he was also nervous that Amazon had detailed records of his audiobook and Kindle reading sessions. Finding information about his listening to the Koran revealed in his Amazon file, he said, made Samirah think of the story of U.S. police and intelligence services that monitored Muslims for suspected terrorist links following the September 11, 2001 attacks.
“Why do they need to know?” he asked. Samirah’s term ends in January, after he lost a re-election bid earlier this year.
At times, law enforcement agencies seek data about customers from technology companies. Amazon reveals that it complies with search warrants and other lawful searches that seek data that the company holds in an account while objecting to “excessive or otherwise inappropriate requests.”
Amazon data for the three years ending June 2020, the latest available, shows that the company at least partially complied with 75 percent of lawsuits, search warrants and other court orders seeking data about U.S. customers. The company fully complied with 38 percent of these requests.
Amazon stopped revealing how often it complies with such requests last year. Asked why Amazon said it expanded the scope of the U.S. report to make it global and “streamlined” the information from each country on law enforcement inquiries.
The company said it is required to comply with “valid and binding orders” but that its goal is to release “the minimum” required by law.
That information can become quite personal. For example, Amazon’s Kindle e-readers accurately track a user’s reading habits, another journalist’s Amazon data file showed. The revelation included records of more than 3,700 reading sessions since 2017, including time-stamped logs – to milliseconds – of books read. Amazon also tracks words highlighted or looked up, flipped pages and campaigns viewed.
It showed, for example, that a family member read “The Mitchell Sisters: A Complete Romance Series” on August 8, 2020 from 6 p.m. 16.52 to kl. 19.36 and flipped 428 pages.
Florian Schaub, a privacy researcher at the University of Michigan, said companies are not always transparent about what they do with users’ data. “We need to trust that Amazon is doing the right thing,” he said, “instead of making sure the data cannot be misused.”