PhD candidate Esther Görnemann held an advanced training session for the Austrian Data Protection Authority on the Market, Functioning and user’s privacy concerns regarding Amazon Alexa. The training documentation was shared among the European Data Protection Board and is now available on the Privacy lab website. 

The presentation covers a broad spectrum of issues around the technology behind voice assistants. It gives a comprehensive but understandable overview of the functioning of Wake-word Detection, speech recognition, Language Understanding and Language Generation. The author conducted a qualitative research study focusing on the interactions between users and the Amazon Alexa voice assistant and uncovered a number of specific privacy and security concerns users expressed. In the given presentation, these user concerns will be addressed one by one with the goal of identifying how legitimate and realistic they are. For this effort, published research, hacking attempts, submitted patents, public statements, media coverage and user experiences are efficiently analyzed and combined to reach satisfactory conclusions.

Core findings

• The wake word detection module balances out precision and latency, causing false positives: the wake word is often recognized although it was not said by the user. 

• Recent research points to discrepancies between transmitted recordings and recordings accessibly stored in the user’s profile.

• Recent patent submissions suggest that voice recordings can be used to infer detailed and intimate knowledge about the user, especially in combination with other available information.

• Privacy policies, Product information and Terms of Use are formulated vaguely and do not provide exhaustive information

• The lack of access control and user authentication causes specific privacy and security issues

Amazon Alexa – Market, Functioning, user’s privacy concerns

About the author

PhD candidate Esther Görnemann works at the Institute of Information Systems and Society at Vienna University of Economics and Business, supervised by Prof. Sarah Spiekermann-Hoff.

The documentation has been developed for a professional training held April 24, 2019 at the Austrian Data Protection Authority in Vienna.

As part of the ITN Privacy&Us, this research project received funding from the European Union’s Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No 675730.

Despite considerable efforts, hate speech remains a highly present online phenomenon. This is in no small part because hate speech is so difficult to identify. Hate speech is intersubjective construct, which makes it difficult to scientifically capture and measure. Both from a legal and societal perspectives, the understandings of what constitutes hate speech are widely different. Yet the impacts of hate speech are very real. It has spread throughout public discourse and has real world consequences for the people affected by it. Saying that it is hard to measure and therefore nothing can be done about it, is to abdicate responsibility for a deeply problematic societal phenomenon and to surrender public space to hatred.

In order to respond to this challenge, the Privacy and Sustainable Computing Lab at Vienna University of Economics have partnered with der STANDARD, an Austrian newspaper with one of the largest German-language online communities in the world. In the coming months we will be working closely together with der STANDARD to develop a design-based approach which changes the way the forum works in order to reduce the amount of hate speech in the forums. These design changes focus on strengthening the power of community within der Standard Forums and will be developed in close collaboration with the Forum users themselves.

While we do not believe that this project – or indeed any other technical system – can ‘solve’ or ‘fix’ hate speech, we hope that it may be able to make its appearance less frequent on der STANDARD forums. Also, as there are considerable difficulties in measuring hate speech, we intend to measure different legal, societal and practical aspects of hate speech, while acknowledging that these proxies for hate speech may differ. We also hope that this design-based approach will reduce the reliance on filtering techniques. Such techniques currently constitute one of the main responses to hate speech and are far from ideal. Not only do they frequently catch the wrong types of content, they are also frequently not very effective in preventing the appearance of hate speech more broadly.

At a time when numerous newspapers have decided to shut down their discussion forums, we believe that this project can contribute to strengthening the public sphere online. If we want to prevent this public space from shrinking further, we need better responses to hate speech than content removal. We believe that a design-based approach can contribute to reducing the prevalence of hate speech online by strengthening the power of community.

We are delighted to inform you that Privacy and Sustainable Computing Lab in collaboration with the Institute of Information Systems and New Media (WU Wien) has started the interdisciplinary research project EXPEDiTE. The full title of the project is “EXPloring opportunities and challenges for Emerging personal DaTa Ecosystems: Empowering humans in the age of the GDPR – A Roadmap for Austria“. The Linked Data Lab of the Vienna University of Technology and the NGO OwnYourData are our partners in this project which is funded by the Austrian Research Promotion Agency (FFG). Soheil Human and Dr. Ben Wagner are project leads for EXPEDiTE. Prof. Axel Polleres, Prof. Sarah Spiekermann, and Prof. Gustaf Neumann shape the advisory board of the project. Here is a short description of the project:

In our increasingly digital societies, data is perceived as a key resource for economic growth. Among the highest-valued corporations today, many have business models that are essentially based on data of or about their users. This development has raised serious concerns about individuals’ right to privacy and their ability to exercise control over their own data, as well as about the broader shifts of power between data subjects and data controllers that this development entails. Consequently, European policy makers have passed the General Data Protection Regulation (GDPR), which has imposed stricter regulations on personal data handling practices within the EU.

In parallel, a movement – often associated with the term “MyData” – has emerged in the civil society with the goal to put individuals in control of their personal data. One of the major adoption barriers for such platforms, however, has been the difficulty individuals face in acquiring their personal data from data controllers. The GDPR, which came into effect on March 25, 2018, requires data controllers to provide individuals access to all data they have about them, as well as to facilitate “portability” of that data. These new rights under the GDPR could drive the emergence of “human-cantered” personal data ecosystems, in which individuals’ roles are no longer limited to that of passive “data subjects”, but in which they become active stakeholders that have access to, exercise control over, and create value from their personal data.

However, although the provisions of the GDPR align closely with this vision, it is still largely unclear how they will be implemented by data controllers and whether and how citizens will exercise their digital rights in practice. In the EXPEDiTE project, we will investigate these timely questions, as well as more broadly explore challenges, barriers and drivers for the emergence of human-cantered personal data ecosystems. Furthermore, we will investigate how individuals — once they become able to acquire their personal data – can integrate and analyze it. To this end, we will explore the concept of context-rich personal knowledge graphs that “liberate” data from closed environments, link and enrich it with other available (e.g., open) data, and create insights and value from individuals’ previously dispersed data. Additionally, such graphs have the potential to facilitate innovative products and services without locking individuals into proprietary environments. In this project, we will tackle key technical challenges involved in realizing this vision, including technical interfaces, syntactic and semantic interoperability, and mechanisms that allow users to share data, exercise control over its utilization, and automatically manage consent for the use of their data. The project results will feed into a comprehensive roadmap that will assess the current state of personal data ecosystems in Austria and in the broader international context, synthesize the major challenges and opportunities they face, and outline a path towards human-centered personal data ecosystems.

The main aims of EXPEDiTE can be summarised as follows:

• This interdisciplinary research project aims to resolve key tensions between providing personalized services and the right to privacy, by envisioning new human-centric personal data ecosystems (PDEs) in which personal data can only be collected and processed under the control of the data subject.
• While the right to privacy is not new, the European General Data Protection Regulation (GDPR) will considerably contribute to the implementation of this right and provides new opportunities to study the way in which a balance between the right to privacy can be achieved through data portability or the right to access and modify personal data.
• In this project, we will analyze how GDPR is perceived and implemented in practice, what key barriers hinder its implementation, and how the implementation of GDPR Exploratory Projects can be improved by changing the socio-technical configuration of actors.
• We will use an interdisciplinary approach to develop a roadmap towards human-centric PDEs in Austria, which describes the current state of personal data processing in Austria, conceptualizes technical requirements of human-centric PDEs, develops the concept of personal knowledge graphs, discusses barriers and challenges ahead of human-centric PDEs, and envisions technological, social, and economic opportunities that human-centric PDEs will bring.
• Finally, our project will connect Austria – for the first time – to the global MyData movement which aims to empower humans with their own personal data – enabling novel business models, innovative technologies, and R&D projects that not only benefit citizens within and beyond the borders of Austria, but also foster economic growth while respecting the right to privacy.