Nest, Amazon and their IoT ilk spark privacy concerns

Companies like Google, Samsung, Microsoft and Amazon are being targeted by the Electronic Privacy Information Center, a prominent Washington, D.C., nonprofit, over the technologies present in some of their newest audio and visual sensing devices. On Friday, the group asked the U.S. Federal Trade Commission and the Department of Justice to investigate whether such devices violate federal wiretap and state privacy laws, and whether the devices deceive consumers.

In a letter sent to both agencies, the group takes aim at what it calls "always on" devices and software that listen to users and offer services based on verbal cues or commands or visual signals like movement.

Among the devices identified are the Nest Cam, which will detect activities in users' homes by monitoring background noise. The group also names Amazon's Echo, an Internet-connected device that answers users' questions when they say the word, "Alexa," the name of Amazon's voice assistant program.

The group has concerns, too, about a microphone-equipped, Wi-Fi-connected Barbie doll made by Mattel, which generated controversy earlier this year because it records children's conversations.

EPIC has been involved in previous FTC privacy cases that have led to settlements with Google and Facebook. In February, the group filed a complaint with the agency alleging that the voice recording capabilities in Samsung's new Smart TV violated laws including the Electronic Communications Privacy Act and the Children's Online Privacy Protection Act.

The group's Friday letter targets a range of devices that listen, record and transmit audio and video. The devices would include Samsung's Smart TV, Google's Chromium Web browser that listens to users so it can perform searches, and Microsoft's Kinect, a voice and motion recorder compatible with Xbox and the Windows operating system.

The group has also singled out Canary Connect, another home camera maker marketing a system that automatically records video and audio in the home based on motion.

In asking for an investigation by the FTC and the DOJ, the privacy group seeks answers to a range of questions about how the companies' devices work.

The letter asks whether the products store people's communications, and whether security measures like encryption are in place to protect the recorded data. If communications are stored, does the storage occur on the device, on a company's servers, or with third party The letter also asks whether the companies delete people's data when the device is not in use.

The privacy group sought investigations from both agencies because they have oversight over different areas of the technology. For example, the question of whether the devices' recording functions violate the federal Wiretap Act would be answered by the DOJ, while concerns over whether consumers are given adequate notice about the recording functions would be in the FTC's wheelhouse, said Julia Horwitz, director of the consumer privacy project at EPIC.

Both federal agencies declined to comment.

The FTC has already shown that privacy and security issues tied to the Internet of Things are on its radar. In January, the agency recommended a set of best practices for companies, in a 71-page report calling on companies to take steps to prevent unauthorized use of consumers' data.

At the Consumer Electronics Show in Las Vegas in January, FTC Chairwoman Edith Ramirez expressed her concerns over the risks of hacking tied to Internet connected devices.

On Friday, a spokeswoman for Nest declined to comment on EPIC's letter.

A spokeswoman for Samsung said the group's claims do not reflect the actual features of the company's Smart TV. Voice recognition, which allows users to control the TV using voice commands, is a feature that can be deactivated by the user, she said.

Google, Microsoft, Amazon and Mattel did not immediately respond to requests for comment.

A spokeswoman for home camera maker Canary Connect said the group's concerns are worth serious discussion. The company's security system has controls to let users know when recording is taking place, she said, including a privacy mode that turns off video and audio recording when users are home.

Zach Miners covers social networking, search and general technology news for IDG News Service. Follow Zach on Twitter at @zachminers. Zach's e-mail address is zach_miners@idg.com