Siri Found ‘Not Guilty’ of Serial Eavesdropping

Although the summer of 2019 seems like such a long and idyllic time ago these days, you may still recall the minor scandal that erupted when a whistleblower revealed that third-party contractors had been listening to recordings of private Siri conversations, and while the situation mostly blew over after Apple promised to make some serious changes, this didn’t stop a class-action lawsuit from being filed by those who felt that Apple had been invading their privacy.

To recap, Apple had long kept anonymized recordings of initial Siri interactions that could be used for analysis to help improve Siri by determining how often the voice assistant was triggered inadvertently.

Naturally, however, proper analysis of these recordings required that they be listened to by actual humans.

Unfortunately, while Apple went to great lengths to ensure that these were completely stripped of any digital information that could have identified where they came from, there was no way to prevent the audio of the recordings themselves from including personal information, especially where Siri was triggered unintentionally, since in those situations the voice assistant was much more likely to hear something it shouldn’t have been hearing.

In fact, in the report, which was leaked to The Guardian by a contractor who was employed by Apple for this purpose, it was revealed that some interactions captured specific names and addresses, while in other cases the reports were less identifiable, but still included very personal situations such as interactions between doctors and patients, business meetings, drug deals, and even couples having sex.

While Apple has always been transparent about the fact that some Siri recordings are reviewed by actual humans, it seems that one of the bigger mistakes it made in this case was to employ third-party contractors to review the data, rather than confining it to Apple employees who had been more appropriately security screened.

Further, up to that point Apple hadn’t offered any way to allow users to opt-out of sharing their recordings, other than of course to disable Siri entirely — both issues that Apple quickly fixed only a few weeks after the Siri exposé appeared.

The Lawsuit

Still, at least some lawyers clearly felt that Apple’s decision to allow this to happen in the first place was grounds for a lawsuit, and less than two weeks after The Guardian’s report first appears, a class-action suit was filed in the U.S. federal court in Northern California.

The suit accused Apple of “unlawful and intentional recording of individuals confidential communications without their consent,” pointing to California’s Invasion of Privacy Act, Consumer Legal Remedies Act, and Unfair Competition Law, while seeking damages for Apple’s continuing violations of all three of these statues going back to October 2011, when Siri was first introduced on the iPhone 4S.

The lawsuit centered on the premise that Apple had been deliberately making “unauthorized recordings” of users’ voices, and doing so with the full knowledge that other humans would be listening to them, but not fully disclosing to consumers that they are “regularly being recorded without consent.”

While in many jurisdictions a conversation can be legally recorded with the consent of only one party — meaning, for instance, you can record a phone call with another person as long as you know you’re recording it — that’s not the case in California — the law in that state prohibits the recording of any oral communications unless all the parties consent, although it’s obviously a lot murkier here exactly who the “other party” would be in the case of a Siri request.

‘Hey Siri’

The main recordings at issue in the lawsuit were those made via accidental activations, since the filing basically acknowledged that deliberately uttering the phrase “Hey Siri” would constitute consent on the part of the user uttering it — although that might not necessarily apply to minors under California law. However, it was not necessarily made clear to users that their recordings could be captured even when they didn’t specifically call for Siri.

To be clear, no Apple device passively records conversations that are occurring in its vicinity. Siri only begins recording when it hears the phrase “Hey Siri” — or at least it does when it thinks it hears the phrase. This is exactly where the problem came in, and was in fact part of the reason why Apple had contractors evaluating these recordings in the first place. The argument was that because users hadn’t deliberately called for Siri, there were numerous situations where users were being recorded without their knowledge or consent.

Case Dismissed

According to Bloomberg, the class-action lawsuit has been tossed out by the court for a lack of evidence, although this doesn’t necessarily mean that it’s finished for good.

Specifically, U.S. District Judge Jeffrey White didn’t actually rule on the merits of the case, but rather said that the plaintiffs hadn’t presented enough facts to support their claims that they had directly suffered any actual harm from Apple’s actions.

However, Judge White also noted that the consumers could revise and refile their suit if they could provide additional evidence that proved that they have actually suffered injury in a “concrete and particularized” way.

Instead, it seems that the plaintiffs offered merely “conjectural” and “hypothetical” examples of harm.

One of the points that the original filing made was that many consumers “would not have bought their Siri Devices if they had known Apple was recording their conversations without consent,” but it seems that according to Judge White, merely having the possibility of being recorded is not the basis for a valid claim.

Notably, none of the plaintiffs could provide any proof that their private data was accidentally collected by Apple and misused, and in fact based all of their allegations on the original article in The Guardian.

In his ruling, however, Judge White noted that The Guardian article was not sufficient evidence of harm to the specific plaintiffs in the case, since it not only indicated that merely a “small portion” of daily Siri activations were sent to contractors, which included international activations as well as accidental ones, and also made specific references to the Apple Watch and the HomePod, neither of which were owned by any of the plaintiffs.

At this point, the plaintiffs have been given 20 days to revise and refile the lawsuit, although it seems highly unlikely that they will be able to provide sufficient evidence to support their claims, as it sounds like they would have to prove that Apple had collected specific recordings of their own private communications as a result of Siri having been accidentally triggered, and due to the way in which Apple anonymously stores Siri recordings, it’s hard to see how there would be any way to get that data even if they attempted to subpoena Apple for disclosure.