Alexa, I Want the Truth

• Published in: The Army Lawyer no. 2; pp. 48 - 59
• Main Author: Mills, Benjamin A
• Format: Trade Publication Article
• Language: English
• Published: Charlottesville Superintendent of Documents 01.01.2021
• Subjects: Case law; Civil defense; Cloud computing; Command and control; Crime; Criminal investigations; Customer services; Data collection; Electronic devices; Evidence; Indoor environments; Internet of Things; Litigation; Murder; Public prosecutors; Remote computing; Search warrants; Toilets; Trials; Virtual reality; Water meters; United States > US; Arkansas
• ISSN: 0364-1287; 1554-9011

Beyond mere entertainment, smart devices now influence medical care, fitness, security, indoor climate, environmental aesthetics, all manner of appliances, clothing, personal accessories, transportation, even beds and toilets.3 Among the most powerful devices in the IoT universe are the "virtual assistants," like Amazon's Alexa Echo and Google's Voice, which are always on and always listening.4 Whenever a virtual assistant hears its "wake word," it activates and records what is heard, as well as any given reply.5 Because little or no data is stored on virtual assistant devices,6 their function depends on access to powerful "cloud" computing-networked servers with the ability to analyze, record, and respond to users.7 Although cloud computing connects virtual assistant users to an unprecedented capability to command and control their world, it comes at the cost of enormous amounts of personal data being digested into the cloud.8 Thus, in a world where everything is heard and everything is connected, it requires no imagination to discern that criminal evidence can also be heard, created, and documented through the IoT, including virtual assistants.9 As illustrated by the case study of Arkansas v. Bates,10 prosecutors will likely face future scenarios requiring collection and use of information from the IoT. [...]this article is organized into two main sections that aim to assist a military prosecutor in the collection and use of digital evidence derived from virtual assistants. The Legal Framework Arkansas v. Bates recounts one of a growing number of cases in which the government attempts to collect digital contents of potential criminal evidence captured by a virtual assistant.12 In Bates, the Alexa Echo was located in the kitchen near the back patio where Collins's body was found, and witnesses indicated that the device was playing music during the evening gathering-suggesting that its operation resulted in the capture of some data that might shed light on events surrounding the mysterious death.13 Interestingly, a separate device in Bates's home, a smart water meter, recorded that the home had used 140 gallons of water between 0100 and 0300 on the night of the murder, corroborating investigators' observations that someone had recently hosed down the area surrounding the body.14 Although the government has now dismissed charges against Bates,15 the case highlights the importance of collecting evidence from the IoT and the likelihood that similar evidentiary scenarios will replicate frequently in the very near future.16 When that happens, a prosecutor's use of the proper legal framework will ensure successful collection and admission of that evidence at trial. With regard to delayed customer notice, digital service providers do not typically report when data is merely subject to preservation (since the providers are not yet disclosing any user information), but there may be unique commercial practices or user agreements that could result in case-damaging disclosure to a suspect.22 Where case-appropriate, avoid this scenario by making a simple request for delayed notice.23 Likewise, a request to preserve future categories of data may be important, depending on the type of data and unique case factors at play in an investigation.24 While neither delayed notice nor future preservation are specifically addressed by the text surrounding preservation rules, the concepts are rooted in the same statutes discussing compulsory instruments and can be important facets of an ongoing investigation.25 Notwithstanding a lack of case law on these specific clauses, the SCA gives data holders a complete civil defense for actions in "good faith reliance on ... a court warrant or order ... or a statutory authorization (including a request of a governmental entity under section 2703(f) [preservation orders]. "26 And since preservation of data is distinct from actual disclosure, the risk of successful adverse litigation for these clauses is extremely low. [...]digital service providers are incentivized to fully comply with reasonable preservation requests.