Loading story…
Voice assistants and other smart home devices are generating detailed records that can later be accessed by companies or sought by law enforcement, raising concerns that everyday household technology may become a source of criminal evidence. Reporting highlighted that devices such as Amazon Alexa continuously collect behavioral, audio, and usage data, with wake-word systems capable of false activations that may cause unintended recordings to be uploaded for cloud processing and retention.
The coverage pointed to U.S. criminal investigations in Arkansas, Florida, and New Hampshire in which Amazon Echo data was sought or used, underscoring how cloud-stored smart home records can become subpoenaable evidence. It also warned that smart TVs, robot vacuums, smart locks, Fitbits, and even connected water meters can create searchable logs of daily life, and urged users to reduce exposure by inventorying connected devices, limiting unnecessary internet connectivity, understanding whether devices are truly powered off, and keeping at least one room free of smart technology.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
According to the article, police in Florida used Amazon Echo recordings as part of a murder investigation in 2019. The reference presents this as another example of smart-speaker data being used as criminal evidence.
The article states that prosecutors in Arkansas sought Amazon Echo data in a 2015 murder investigation. It also says Amazon initially fought the demand on First Amendment grounds before the defendant later consented to release the data.
The article says a judge in New Hampshire ordered Amazon to provide two days of Echo recordings in a double-homicide case. No explicit date is given in the content for this court order.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Consumer CCTV and smart camera systems, widely adopted for home security, present significant privacy and security risks. In several documented cases, criminals have accessed CCTV footage by exploiting weak or stolen passwords, sometimes purchased cheaply from public databases, allowing them to obtain sensitive video recordings before victims are even aware of a crime. These incidents highlight that while cameras can deter theft and provide evidence, they also create new vulnerabilities if not properly secured, raising concerns about who truly controls access to surveillance data. Beyond the risk to device owners, smart cameras and doorbells routinely capture footage of bystanders—neighbors, visitors, and passersby—without their knowledge or consent. A recent study found that most major vendors of these devices do not adequately address bystander privacy in their policies, often placing the responsibility on device owners rather than taking proactive steps to protect non-users. Legal frameworks like GDPR and CCPA offer limited guidance for recordings made on private property, leaving significant gaps in privacy protection for individuals inadvertently caught on camera.
Jul 12, 2026
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in **DJI Romo robot vacuums** allowed a researcher to obtain access tokens for more than **6,700** other vacuums and view sensitive user data such as **home floor plans**, **live video feeds**, and **microphone input**; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game *Dungeon Crusher* exposed user information after a **misconfigured Elasticsearch** instance leaked **24.5 million** in-game chat records and purchase-related data, including **IP addresses**, **email addresses**, and **partial payment card details**, creating downstream risk for fraud and targeted phishing. Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented **FlyTrap**, a physical-world attack against **autonomous target-tracking drones** in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that **Tire Pressure Monitoring System (TPMS)** sensors broadcast a fixed **unique ID** in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from **20,000+ vehicles** during a multi-week study.
Jun 29, 2026
Gamers Nexus, Level1Techs, and independent researchers reported that LG smart TVs may capture microphone audio while in hibernation or apparently off, including audio not preceded by a recognized wake word. Testing and firmware inspection allegedly found recordings retained locally in plaintext even while the television was disconnected from the internet. The researchers also said the sets collect local-device IP addresses, nearby Wi-Fi SSIDs and signal strengths, and location-related information, creating privacy and security risks if retained data is later exposed or transmitted. LG denied that its televisions continuously record conversations, stating that voice processing begins only when users press the remote voice button or enable the `Hi LG` wake word. The company said wake-word detection occurs locally and unrecognized audio is immediately deleted, while describing network-device discovery as a standard capability supporting connectivity, content sharing, and smart-home features. LG added that voice recognition, Automatic Content Recognition, and interest-based advertising are separately opt-in and can be disabled.
Sep 15, 2026