Remember when earlier this month we told you how thousands of Amazon employees around the world listened to the voice recordings created when you asked Alexa for something? Well, if that wasn’t scary enough, it turns out some of those employees have access to your home address.
Sure, Amazon passed that off as an attempt to make the company’s virtual assistant Alexa better respond to voice commands. While most of the work was described as “mundane,” employees have listened to more private recordings, such as a woman singing in a shower, or a child screaming for help.
Amazon employees share some recordings in an internal chat room, if they need help in understanding a word, or when an “amusing recording” is found.
A new Bloomberg report says employees on the team have have access to location data and can “easily find a customer’s home address” by typing geographic coordinates into third-party mapping software.
This new bit of information was shared with Bloomberg by five anonymous Amazon employees.
Team members with access to Alexa users’ geographic coordinates can easily type them into third-party mapping software and find home residences, according to the employees, who signed nondisclosure agreements barring them from speaking publicly about the program.
While there’s no indication Amazon employees with access to the data have attempted to track down individual users, two members of the Alexa team expressed concern to Bloomberg that Amazon was granting unnecessarily broad access to customer data that would make it easy to identify a device’s owner.
Bloomberg then observed as an Amazon team member pasted a user’s location coordinates (which are stored as latitude and longitude) into Google Maps. The address for the user linked to a particular recording was found in less than a minute.
While it isn’t known exactly how many Amazon employees can access that system, two of the Amazon employees claimed that the “vast majority” of the workers in the Alexa Data Services group had access to the software.
“Anytime someone is collecting where you are, that means it could go to someone else who could find you when you don’t want to be found,” said Lindsey Barrett, a staff attorney and teaching fellow at Georgetown Law’s Communications and Technology Clinic. “Widespread access to location data associated with Alexa user recordings “would set up a big red flag for me.”
In an April 10 statement Amazon said “employees do not have direct access to information that can identify the person or account as part of this workflow.”
In a new statement responding to today’s Bloomberg report, Amazon said “access to internal tools is highly controlled, and is only granted to a limited number of employees who require these tools to train and improve the service by processing an extremely small sample of interactions. Our policies strictly prohibit employee access to or use of customer data for any other reason, and we have a zero tolerance policy for abuse of our systems. We regularly audit employee access to internal tools and limit access whenever and wherever possible.”
Bloomberg reports that Amazon does appear to be restricting the access that employees have to sensitive customer data, and in the wake of the original story that some of the workers that listen to recordings lost their access to software tools they had previously used.
Kind of makes you wonder what else Amazon employees have access to, doesn’t it. Or is that just me?
(UPDATE: 4/26/2019) – We have updated the headline of this article, and have received a quote from an Amazon spokesperson about the access an Amazon employee might have to a customer’s address info:
On background, a limited number of employees have access to location information of a device. This information is used to help improve location-specific commands made by customers. For example, improving the accuracy of requests like “Alexa, where is the closest coffee shop?” We use mobile devices’ geolocation, provided by the customer, for relevant responses (e.g., weather, traffic, restaurant recommendations) and to enable certain features (such as location-based Reminders and Routines). Customers can control location permissions in their mobile device settings.
