An Amazon Echo recorded a family’s conversation, then sent it to a random person in their contacts, report says

A family in Portland received a nightmarish phone call two weeks ago.

“Unplug your Alexa devices right now,” a voice on the other line said. “You’re being hacked.”

Apparently, one of Amazon.com’s Alexa-powered Echo devices in their house had silently sent recordings to the caller, without the family’s permission. The person, who happened to be an employee of the husband, was in the family’s contact list.

“My husband and I would joke and say I’d bet these devices are listening to what we’re saying,” a woman who identified herself only by her first name, Danielle, told KIRO 7, a news station covering Seattle and western Washington.

“We unplugged all of them and he proceeded to tell us that he had received audio files of recordings from inside our house,” she said. “At first, my husband was, like, ‘No you didn’t!’ And the (recipient of the message) said ‘You sat there talking about hardwood floors.’ And we said, ‘Oh gosh, you really did hear us.’ ”

Danielle said she felt invaded after listening back to her own conversations, silently captured by an eavesdropping machine. “I’m never plugging that device in again,” she said. “I can’t trust it.”

Amazon did not immediately respond to a request for comment. But the company told KIRO 7 in a statement, “Amazon takes privacy very seriously. We investigated what happened and determined this was an extremely rare occurrence. We are taking steps to avoid this from happening in the future.” It was not clear what type of Echo device was involved.

Amazon’s chief executive, Jeffrey P. Bezos, owns the Washington Post.

Danielle told KIRO 7 the device did not tell her that it would be sending the recorded conversations.

This isn’t the first time that Amazon’s smart speaker has garnered scrutiny over potential eavesdropping. Last month, researchers discovered a flaw in the Alexa voice assistant, enabling an Echo to continue listening to a person without them knowing. The devices are supposed to record audio only after users issue a voice command, known as a “wake word.” Amazon quickly fixed the vulnerability after researchers alerted the company.

Daniel Kahn Gillmor, a staff technologist for the ACLU’s speech, privacy, and technology project, said the intuitive nature of connected devices can mask their complexity and the possibility of malfunction.

“The Amazon Echo, despite being small, is a computer – it’s a computer with microphones. speakers and it’s connected to the network,” he said. “These are potential surveillance devices, and we have invited them further and further into our lives without examining how that could go wrong. And I think we are starting to see examples of that.”