Amazon Echo

[enjay]

it's obviously justifiable to monitor hotspots in your building for network maintenance and security.

 

Is it justifiable though? I'm not only gathering the information on students but also staff and visitors...

[enjay]

Also, since my phone can do Bluetooth tethering, I'm not sure what I'd actually achieve even if I did suppress wifi hotspots...

[sigma]

Can you expand on that? How is using Alexa contrary to GDPR?

 

Because the school would be gifting my child's voice print to Amazon without my consent. Whoever owns the account is the data controller be that the school or teacher and they would need my consent to collect that data to share with a third party. If the school or teacher did not delete the data at any time the implication is that Amazon would keep the voice print for as long as they liked.

 

https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=201809740

 

1.3 Alexa Interactions. Alexa is a continuously improving service that you control with your voice. Alexa streams audio to the cloud when you interact with Alexa. Alexa is always learning and getting smarter; Alexa updates through the cloud automatically to add new features and skills. To provide the Alexa service, personalize it, and improve our services, Amazon processes and retains your Alexa Interactions, such as your voice inputs, music playlists and your Alexa to-do and shopping lists, in the cloud. Learn more about these voice services including how to delete voice recordings associated with your account.

 

https://www.amazon.co.uk/gp/help/customer/display.html/ref=hp_left_v4_sib?ie=UTF8&nodeId=GFAFHBBCG76WTBXQ

 

 

About Kid Skills

 

Kid skills are skills that have been identified by the developer as directed to children. Kid skills are turned off by default. You can turn all kid skills on in the Settings menu of your Alexa app. You can turn off all kid skills at any time by changing that same setting. When turned off, kid skills cannot be used on your account. You can find more information about each kid skill, including any terms provided by the developer of the skill, on the detail page for the skill in your Alexa App.

 

If you turn kid skills on, Alexa processes and retains information related to your and your child’s use of kid skills, including voice recordings, in the cloud to provide and improve your experience and our services. We handle any personal information we receive in accordance with Amazon.co.uk’s Privacy Notice.

 

Like other voice interactions with Alexa, you can review your and your child’s voice interactions with kid skills by visiting History in the Settings menu of your Alexa App. You can also delete specific voice recordings associated with kid skills from that same History setting, or you can delete all voice recordings associated with your account for each of your Alexa-enabled products at the Manage Your Content and Devices page at http://www.amazon.co.uk/mycd.

 

https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=201909010#GUID-1B2BDAD4-7ACF-4D7A-8608-CBA6EA897FD3__SECTION_34D09FECEE2746B2B8CB0ED6CB4BC147

 

Are Children Allowed to Use Amazon Services?

 

Amazon Europe doesn't sell products for purchase by children. We sell children's products for purchase by adults. If you're under 18, you may use Amazon Services only with the involvement of a parent or guardian.

 

How Long Do We Keep Your Personal Information?

 

We keep your personal information to enable your continued use of Amazon Services, for as long as it is required in order to fulfil the relevant purposes described in this Privacy Notice, as may be required by law such as for tax and accounting purposes, or as otherwise communicated to you. For example, we retain your transaction history so that you can review past purchases (and repeat orders if desired) and what addresses you have shipped orders to, and to improve the relevancy of products and content we recommend.

 

[enjay]

Because the school would be gifting my child's voice print to Amazon without my consent.

 

But if the use of Alexa is part of the teaching and learning, the school doesn't need parental consent. Same way we don't ask for consent to create Google Apps or Mathswatch accounts, we just do DPIAs on the companies.

[Rob_D]

But if the use of Alexa is part of the teaching and learning, the school doesn't need parental consent. Same way we don't ask for consent to create Google Apps or Mathswatch accounts, we just do DPIAs on the companies.

This is interesting as we've been told we need signed consent before we can set up network logins and O365 accounts.

[Mayki5]

I would beware though, as voice prints would be classed as Biometric data, which requires MUCH greater scrutiny when it comes to personal information.

[enjay]

This is interesting as we've been told we need signed consent before we can set up network logins and O365 accounts.

 

Your legal basis for those is public task, not consent. O365 is the way you have chosen to carry out your public authority task of educating the children.

[enjay]

I would beware though, as voice prints would be classed as Biometric data, which requires MUCH greater scrutiny when it comes to personal information.

 

Perhaps, but there's nothing which can link the voice print back to an individual, unlike when we biometric data to identify students in the lunch hall.

[chaplic]

Your phone is broadcasting its SSID. My APs can pick that up. The controller can potentially use several APs to triangulate the position of the device. They don't need to authenticate with the device to know its there or to generate interference to block it.

 

It's the same way the auto channel select works on home wifi systems.

Rogue AP detection is fairly common feature of enterprise WLAN, but I can only assume you mean grabbing the MAC address of said device then latterly blocking it from the corp wifi, or using previous logs to figure out who it belongs to.

 

Thread is a little moot, the devices are not configurable with a proxy and want all manner of ports open to, well, just about everywhere.

[FishCustard]

While faffing about in the office today I idly thought that I should buy an 'Alexa thingy' (as I call them as I keep forgetting the actual name) for work. I then realised (a) what on Earth would I use it for, and (b) I wouldn't want one within spitting distance of the school network for all the reasons mentioned above.

 

It'd probably only get used for "Alexa, play the My Little Pony theme" pranks by my colleagues anyway

[Stormborn15]

[quote=chaplic;1696512

 

Thread is a little moot, the devices are not configurable with a proxy and want all manner of ports open to, well, just about everywhere.

 

This ... I could explain that to the teacher - but I would have to make it look like ‘I tried ‘ first before coming to that conclusion ...

[matt40k]

This ... I could explain that to the teacher - but I would have to make it look like ‘I tried ‘ first before coming to that conclusion ...

I'd say, I've done a bit of digging and I'm not sure it will work, bring it in and we can give it a try. No promises.

[enjay]

Can you punch a hole in your proxy for the Alexa's IP address, so the proxy allows it through unimpeded? Then advise the teacher about privacy concerns and make sure they unplug it when not in use.

[chaplic]

No. Amazon don't specify target IP addressees for it. You can get some by trial-and-error, but it's a fools errand.

[enjay]

No. Amazon don't specify target IP addressees for it. You can get some by trial-and-error, but it's a fools errand.

 

I wasn't meaning whitelist the target addresses, I was meaning creating a bypass or exemption rule to allow all traffic from the Alexa out.