InfoSecBulletin Cybersecurity for mankind
Amazon has agreed to pay nearly $31 million to the Federal Trade Commission (FTC) in order to resolve allegations related to its Alexa and Ring home security businesses.
The larger portion of the settlement, amounting to $25 million, will address accusations that Amazon violated the US Children’s Online Privacy Protection Act Rule (COPPA Rule) and misled Alexa customers about the deletion of data collected by the smart voice assistant.
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed
ALERT
Thousands of IP addresses compromised nationwide: CIRT warn
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
The Department of Justice (DoJ), acting on behalf of the FTC, filed a complaint stating that Amazon falsely assured users, including parents, that they could delete Alexa voice recordings and geolocation information. However, it was alleged that Amazon retained some of this data for extended periods and used it unlawfully to enhance the Alexa algorithm.
ALSO READ:
World see transmission at a record speed of 200 gigabits per second
Samuel Levine, the director of the FTC’s Bureau of Consumer Protection, stated that Amazon’s actions of misleading parents, retaining children’s recordings indefinitely, and disregarding deletion requests violated COPPA, prioritizing profits over privacy. He emphasized that COPPA prohibits companies from retaining children’s data indefinitely, especially for the purpose of training algorithms.
Separately, Ring, a business acquired by Amazon in 2018, will pay $5.8 million to settle charges related to compromising consumer privacy and failing to implement adequate security practices. The funds will be used for consumer refunds.
The FTC complaint alleged that Ring deceived customers by allowing unauthorized access to their videos by employees and contractors, and by using customer videos to train algorithms without consent. The complaint claimed that one employee had accessed thousands of video recordings from female users’ Ring cameras, including intimate spaces like bathrooms.
Furthermore, the complaint stated that Ring was slow to enhance customer account security to mitigate the risk of brute-force attacks, despite users experiencing multiple credential stuffing attacks in 2017 and 2018. The complaint highlighted that inadequate implementation of security measures from 2019 onwards hindered their effectiveness. As a result, malicious actors gained access to stored videos, live video streams, and account profiles of approximately 55,000 US customers, and even engaged in threats and extortion attempts.
In addition to the financial penalties, Amazon will be required to delete inactive child accounts, as well as certain Alexa voice recordings and geolocation information. The company will also be prohibited from using this data for training its algorithms.
Ring will be mandated to delete data, models, and algorithms derived from videos that were unlawfully reviewed. It will need to establish a privacy and security program, incorporating safeguards for human review of videos, multi-factor authentication for employee and customer accounts, and other protective measures.
Amazon issued a statement expressing disagreement with the FTC’s claims regarding Ring and Alexa and denying any violations of the law. The company emphasized its commitment to strong privacy protections and customer controls, its compliance efforts with COPPA, and its collaboration with the FTC before expanding Amazon Kids to include Alexa. Amazon acknowledged that, as part of the settlement, it agreed to make a minor adjustment to its existing practices, including the removal of inactive child profiles after 18 months, unless a parent or guardian opts to retain them. The statement further claimed that Ring had addressed the identified issues independently years ago, prior to the FTC’s investigation.
