InfoSecBulletin Cybersecurity for mankind
Amazon has agreed to pay nearly $31 million to the Federal Trade Commission (FTC) in order to resolve allegations related to its Alexa and Ring home security businesses.
The larger portion of the settlement, amounting to $25 million, will address accusations that Amazon violated the US Children’s Online Privacy Protection Act Rule (COPPA Rule) and misled Alexa customers about the deletion of data collected by the smart voice assistant.
CISA unveils 25 new advisories for Industrial Control Systems
Intel Issues Alert on 20+ Vulnerabilities, Urges Firmware Updates
Urgent: GitLab Patches flaws allowing unapproved pipeline Job Execution
Fortinet admits data breach after hacker claims to steal 440GB
Gov.t issues high alert on android devices
TD Bank fined $28 million for sharing customer data
Global-Cybersecurity-Index
Bangladesh secure role-model position by ITU
New RansomHub Attack Kill Kaspersky’s TDSSKiller To Disable EDR
Not Enough, Say Experts
India set to train 5000 ‘Cyber Commandos’
Researcher detect 21 New Ransomwares in August
The Department of Justice (DoJ), acting on behalf of the FTC, filed a complaint stating that Amazon falsely assured users, including parents, that they could delete Alexa voice recordings and geolocation information. However, it was alleged that Amazon retained some of this data for extended periods and used it unlawfully to enhance the Alexa algorithm.
ALSO READ:
World see transmission at a record speed of 200 gigabits per second
Samuel Levine, the director of the FTC’s Bureau of Consumer Protection, stated that Amazon’s actions of misleading parents, retaining children’s recordings indefinitely, and disregarding deletion requests violated COPPA, prioritizing profits over privacy. He emphasized that COPPA prohibits companies from retaining children’s data indefinitely, especially for the purpose of training algorithms.
Separately, Ring, a business acquired by Amazon in 2018, will pay $5.8 million to settle charges related to compromising consumer privacy and failing to implement adequate security practices. The funds will be used for consumer refunds.
The FTC complaint alleged that Ring deceived customers by allowing unauthorized access to their videos by employees and contractors, and by using customer videos to train algorithms without consent. The complaint claimed that one employee had accessed thousands of video recordings from female users’ Ring cameras, including intimate spaces like bathrooms.
Furthermore, the complaint stated that Ring was slow to enhance customer account security to mitigate the risk of brute-force attacks, despite users experiencing multiple credential stuffing attacks in 2017 and 2018. The complaint highlighted that inadequate implementation of security measures from 2019 onwards hindered their effectiveness. As a result, malicious actors gained access to stored videos, live video streams, and account profiles of approximately 55,000 US customers, and even engaged in threats and extortion attempts.
In addition to the financial penalties, Amazon will be required to delete inactive child accounts, as well as certain Alexa voice recordings and geolocation information. The company will also be prohibited from using this data for training its algorithms.
Ring will be mandated to delete data, models, and algorithms derived from videos that were unlawfully reviewed. It will need to establish a privacy and security program, incorporating safeguards for human review of videos, multi-factor authentication for employee and customer accounts, and other protective measures.
Amazon issued a statement expressing disagreement with the FTC’s claims regarding Ring and Alexa and denying any violations of the law. The company emphasized its commitment to strong privacy protections and customer controls, its compliance efforts with COPPA, and its collaboration with the FTC before expanding Amazon Kids to include Alexa. Amazon acknowledged that, as part of the settlement, it agreed to make a minor adjustment to its existing practices, including the removal of inactive child profiles after 18 months, unless a parent or guardian opts to retain them. The statement further claimed that Ring had addressed the identified issues independently years ago, prior to the FTC’s investigation.
