The mute button on the top of an Amazon Echo of a certain vintage is supposed to disconnect the microphone. A small icon of a crossed-out microphone sits next to the button, and pressing it turns on a red LED that confirms the disconnection. Software controls this button, which means the microphone remains electronically capable of capturing audio after the LED turns red, and the only thing preventing that capture is a line of code in the firmware. Security researchers have documented the capability and the manufacturers have acknowledged it. Whether the capability was ever exercised in practice is a separate question that the user pressing the button cannot answer from the front of the device. Bloomberg reported in April 2019 that Amazon employed thousands of workers worldwide whose job was to listen to Alexa recordings, and similar contractor review programs were acknowledged by Apple and Google for Siri and Assistant later that year. Subsequent Echo models added a hardware microphone disconnect that physically interrupts the microphone circuit when the mute button is pressed. Press the mute button on a smart speaker without that hardware disconnect and you are pressing the third kind of button in this series.

Continue reading → The Dishonest Button