What would be required to monitor Amazon Alexa traffic?

Question

I had this interaction with a friend's robot today:

"Alexa, are you spying on me?"

"I only send audio data back to Amazon when I hear you say the wake word."

If I wanted to ensure that Amazon is indeed only exfiltrating recordings from the network /after/ saying the wake word, what would be required to do that? I'm imagining something like having the router block the Alexa outbound traffic unless an additional device, say a raspberry pi, also detected the wake word and opened the gate. (I imagine Alexa polls periodically just to make sure it's connected and would complain.)

You're welcome to provide a packet inspection/forensic solution, but I'm curious about third party work-arounds that actually forcefully prohibit communication.

I further understand there is another security issue, that Alexa could very well only send audio data back to Amazon when she hears the wake word, but /could be recording all speech all the time/, and just sends it back to Amazon in bursts when woken up and perfectly compliant with what she told me, and I don't think there's a way around that.

Answer 1

As you noticed, Alexa could record all the time and send it only after you say the wake word. You could notice it by larger upload size. But at the same time Alexa could analyse the recordings and only send interesting parts like when you mention the word "bomb" which reduces the upload size so you would only notice it if you look at the traffic in a very detailed way. You also cannot block it in a comfortable way because you would need to do a detailed analyses of the data before it is sent which most likely makes the use of Alexa meaningless because it is more work then doing the work Alexa should do yourself.

But you have 2 options:

• Use a trusted client instead of the vendor provided (I don't know if one exists)
• Use another trusted device that powers on Alexa when it hears the wake word and all the other time cuts the power line.