PhD candidate Esther Görnemann held an advanced training session for the Austrian Data Protection Authority on the Market, Functioning and user’s privacy concerns regarding Amazon Alexa. The training documentation was shared among the European Data Protection Board and is now available on the Privacy lab website. 

The presentation covers a broad spectrum of issues around the technology behind voice assistants. It gives a comprehensive but understandable overview of the functioning of Wake-word Detection, speech recognition, Language Understanding and Language Generation. The author conducted a qualitative research study focusing on the interactions between users and the Amazon Alexa voice assistant and uncovered a number of specific privacy and security concerns users expressed. In the given presentation, these user concerns will be addressed one by one with the goal of identifying how legitimate and realistic they are. For this effort, published research, hacking attempts, submitted patents, public statements, media coverage and user experiences are efficiently analyzed and combined to reach satisfactory conclusions.

Core findings

• The wake word detection module balances out precision and latency, causing false positives: the wake word is often recognized although it was not said by the user. 

• Recent research points to discrepancies between transmitted recordings and recordings accessibly stored in the user’s profile.

• Recent patent submissions suggest that voice recordings can be used to infer detailed and intimate knowledge about the user, especially in combination with other available information.

• Privacy policies, Product information and Terms of Use are formulated vaguely and do not provide exhaustive information

• The lack of access control and user authentication causes specific privacy and security issues

Amazon Alexa – Market, Functioning, user’s privacy concerns

About the author

PhD candidate Esther Görnemann works at the Institute of Information Systems and Society at Vienna University of Economics and Business, supervised by Prof. Sarah Spiekermann-Hoff.

The documentation has been developed for a professional training held April 24, 2019 at the Austrian Data Protection Authority in Vienna.

As part of the ITN Privacy&Us, this research project received funding from the European Union’s Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No 675730.

Despite considerable efforts, hate speech remains a highly present online phenomenon. This is in no small part because hate speech is so difficult to identify. Hate speech is intersubjective construct, which makes it difficult to scientifically capture and measure. Both from a legal and societal perspectives, the understandings of what constitutes hate speech are widely different. Yet the impacts of hate speech are very real. It has spread throughout public discourse and has real world consequences for the people affected by it. Saying that it is hard to measure and therefore nothing can be done about it, is to abdicate responsibility for a deeply problematic societal phenomenon and to surrender public space to hatred.

In order to respond to this challenge, the Privacy and Sustainable Computing Lab at Vienna University of Economics have partnered with der STANDARD, an Austrian newspaper with one of the largest German-language online communities in the world. In the coming months we will be working closely together with der STANDARD to develop a design-based approach which changes the way the forum works in order to reduce the amount of hate speech in the forums. These design changes focus on strengthening the power of community within der Standard Forums and will be developed in close collaboration with the Forum users themselves.

While we do not believe that this project – or indeed any other technical system – can ‘solve’ or ‘fix’ hate speech, we hope that it may be able to make its appearance less frequent on der STANDARD forums. Also, as there are considerable difficulties in measuring hate speech, we intend to measure different legal, societal and practical aspects of hate speech, while acknowledging that these proxies for hate speech may differ. We also hope that this design-based approach will reduce the reliance on filtering techniques. Such techniques currently constitute one of the main responses to hate speech and are far from ideal. Not only do they frequently catch the wrong types of content, they are also frequently not very effective in preventing the appearance of hate speech more broadly.

At a time when numerous newspapers have decided to shut down their discussion forums, we believe that this project can contribute to strengthening the public sphere online. If we want to prevent this public space from shrinking further, we need better responses to hate speech than content removal. We believe that a design-based approach can contribute to reducing the prevalence of hate speech online by strengthening the power of community.

We are delighted to inform you that Privacy and Sustainable Computing Lab in collaboration with the Institute of Information Systems and New Media (WU Wien) has started the interdisciplinary research project EXPEDiTE. The full title of the project is “EXPloring opportunities and challenges for Emerging personal DaTa Ecosystems: Empowering humans in the age of the GDPR – A Roadmap for Austria“. The Linked Data Lab of the Vienna University of Technology and the NGO OwnYourData are our partners in this project which is funded by the Austrian Research Promotion Agency (FFG). Soheil Human and Dr. Ben Wagner are project leads for EXPEDiTE. Prof. Axel Polleres, Prof. Sarah Spiekermann, and Prof. Gustaf Neumann shape the advisory board of the project. Here is a short description of the project:

In our increasingly digital societies, data is perceived as a key resource for economic growth. Among the highest-valued corporations today, many have business models that are essentially based on data of or about their users. This development has raised serious concerns about individuals’ right to privacy and their ability to exercise control over their own data, as well as about the broader shifts of power between data subjects and data controllers that this development entails. Consequently, European policy makers have passed the General Data Protection Regulation (GDPR), which has imposed stricter regulations on personal data handling practices within the EU.

In parallel, a movement – often associated with the term “MyData” – has emerged in the civil society with the goal to put individuals in control of their personal data. One of the major adoption barriers for such platforms, however, has been the difficulty individuals face in acquiring their personal data from data controllers. The GDPR, which came into effect on March 25, 2018, requires data controllers to provide individuals access to all data they have about them, as well as to facilitate “portability” of that data. These new rights under the GDPR could drive the emergence of “human-cantered” personal data ecosystems, in which individuals’ roles are no longer limited to that of passive “data subjects”, but in which they become active stakeholders that have access to, exercise control over, and create value from their personal data.

However, although the provisions of the GDPR align closely with this vision, it is still largely unclear how they will be implemented by data controllers and whether and how citizens will exercise their digital rights in practice. In the EXPEDiTE project, we will investigate these timely questions, as well as more broadly explore challenges, barriers and drivers for the emergence of human-cantered personal data ecosystems. Furthermore, we will investigate how individuals — once they become able to acquire their personal data – can integrate and analyze it. To this end, we will explore the concept of context-rich personal knowledge graphs that “liberate” data from closed environments, link and enrich it with other available (e.g., open) data, and create insights and value from individuals’ previously dispersed data. Additionally, such graphs have the potential to facilitate innovative products and services without locking individuals into proprietary environments. In this project, we will tackle key technical challenges involved in realizing this vision, including technical interfaces, syntactic and semantic interoperability, and mechanisms that allow users to share data, exercise control over its utilization, and automatically manage consent for the use of their data. The project results will feed into a comprehensive roadmap that will assess the current state of personal data ecosystems in Austria and in the broader international context, synthesize the major challenges and opportunities they face, and outline a path towards human-centered personal data ecosystems.

The main aims of EXPEDiTE can be summarised as follows:

• This interdisciplinary research project aims to resolve key tensions between providing personalized services and the right to privacy, by envisioning new human-centric personal data ecosystems (PDEs) in which personal data can only be collected and processed under the control of the data subject.
• While the right to privacy is not new, the European General Data Protection Regulation (GDPR) will considerably contribute to the implementation of this right and provides new opportunities to study the way in which a balance between the right to privacy can be achieved through data portability or the right to access and modify personal data.
• In this project, we will analyze how GDPR is perceived and implemented in practice, what key barriers hinder its implementation, and how the implementation of GDPR Exploratory Projects can be improved by changing the socio-technical configuration of actors.
• We will use an interdisciplinary approach to develop a roadmap towards human-centric PDEs in Austria, which describes the current state of personal data processing in Austria, conceptualizes technical requirements of human-centric PDEs, develops the concept of personal knowledge graphs, discusses barriers and challenges ahead of human-centric PDEs, and envisions technological, social, and economic opportunities that human-centric PDEs will bring.
• Finally, our project will connect Austria – for the first time – to the global MyData movement which aims to empower humans with their own personal data – enabling novel business models, innovative technologies, and R&D projects that not only benefit citizens within and beyond the borders of Austria, but also foster economic growth while respecting the right to privacy.

Esther Görnemann recently presented her work at the Lab as part of the Privacy & Us doctoral consortium in London. Her work provides an important perspective on the crucial role that the individual experience of Moments of Truth plays in understanding how human beings think about privacy and how under which circumstances they start actively protecting it. Here is a brief overview of her current research as well as a short introductory video.

During preliminary interview sessions, a number of internet and smartphone users talked to me about the surprising experience when they realized that personal information had been collected, processed an applied without their knowledge.
In these interviews and in countless furious online reports, users expressed concern about their device, often stating they felt taken by surprise, patronized or spied upon.

Some examples:

• In an interview, a 73-year old man recalled that he was searching for medical treatment of prostate disorders on Google and was immediately confronted with related advertisements on the websites he visited subsequently. Some days later, he also started to receive email spam related to his search. He said “I felt appalled and spied upon” and ever since had begun to consider whether the search he was about to conduct might contain information he would rather keep for himself.

• A Moment of Truth that made headlines in international news outlets was the story of Danielle from Portland who in early 2018 contacted a local TV station and reported that her Amazon Echo had recorded a private conversation between her and her husband and had sent it to a random person of the couple’s contact list who immediately called the couple back, to tell them what he had received. The couple turned to Amazon’s customer service, but the company was not immediately able to explain the incident. When she called the TV station, Danielle expressed her feelings: “I felt invaded. A total privacy invasion. I’m never plugging that device in again, because I can’t trust it.” While Amazon later explained the incident, saying the Echo mistakenly picked up several words from the conversation and interpreted them as a series of commands to record and send the audio, Danielle still claims the device had not prompted any confirmation or question.  

• An interview participant recalled how he coincidently revealed that his smartphone photo gallery was automatically synchronized with the cloud service Dropbox. He described his reaction with the words “Dropbox automatically uploaded all my pictures in the cloud. It’s like stealing! […] Since then I’m wary. And for sure I will never use Dropbox again.”

Drawing from philosophical and sociological theories, this research project conceptualizes Moments of Truth as the event in which the arrival of new information results in a new interpretation of reality and a fundamental change of perceived alternatives of behavioural responses.

The notion of control or agency is one of several influential factors that mobilizes people and is key to understand reactions to Moments of Truth.

The goal of my research is to construct a model to predict subjects’ affective and behavioural responses to Moments of Truth. A central question is why some people display an increased motivation to protest and claim their rights, convince others, adapt usage patterns and take protective measures. Currently, I am looking at the central role that the perception of illegitimate inequality and the emotional state of anger play in mobilizing people to actively protect their privacy.

https://www.youtube.com/watch?v=jkq5TukhEu4