Amazon Echo

[matt40k]

However it does not give a date/time of when it heard things.

Really? Google gives you datetime and location, seems old Amazon wouldn't :s

 

Yer, I've had a few interesting ones. My fav so far was when it ignore my son when he was having a strop on, told him he needs to calm down then Google will listen - and it did. Google takes no s**t.

[MartinByard]

It's a bit late, but when we wanted to test out Alexa we had to get a different VLAN set up that didn't route out through the proxy, otherwise it wouldn't work at all (it could join the normal wifi network we had, but couldn;t do anything with it).

[JJonas]

You can push a button on the Echo to turn off the microphone, the ring turns red when it is switched off.

 

Make sure they disable voice purchases in the app

 

Under settings you can see the history of what it has heard, you can delete the voice recordings here as well.

 

Perhaps test it, then demo it to the person responsible for your GDPR compliance to see if they are happy for it to continue to be used.

[enjay]

Well , in the end didn’t get round to being asked again ... so I guess the plan was abandoned - till the next time ..

 

Or the plan went ahead anyway without your involvement... Hot-spotted from their phone if your proxy can't support an Echo.

[Stormborn15]

Or the plan went ahead anyway without your involvement... Hot-spotted from their phone if your proxy can't support an Echo.

 

Luckily I get alerted by email if anyone uses phone or other device as a hot spot. Shows up as a rogue SSID and is automatically blocked ...[emoji102]

[Jawloms]

Luckily I get alerted by email if anyone uses phone or other device as a hot spot. Shows up as a rogue SSID and is automatically blocked ...[emoji102]

 

How is it blocked?

[enjay]

Luckily I get alerted by email if anyone uses phone or other device as a hot spot. Shows up as a rogue SSID and is automatically blocked ...[emoji102]

 

How can you block me setting a hotspot on my personal phone and connecting my personal Echo/tablet/friend's phone to it?

[sigma]

Were I a parent with a child in a class with Alexa or similar I would object. GDPR

[enjay]

Were I a parent with a child in a class with Alexa or similar I would object. GDPR

 

Can you expand on that? How is using Alexa contrary to GDPR?

[Jawloms]

Can you expand on that? How is using Alexa contrary to GDPR?

 

At the very least, because if any of them use names etc. you're sending personal data off to a third party without consent.

[enjay]

At the very least, because if any of them use names etc. you're sending personal data off to a third party without consent.

 

Only if the name is used after Alexa thinks she hears a wake-up word, and secondly if the use is part of the teaching consent isn't needed. In this particular instance, it sounds like it might have been end-of-term games rather than anything educational, mind you!

 

Is it wrong I anthropomorphised the Alexa and only realised I'd done it when I proof-read before posting?!

[Rob_D]

How can you block me setting a hotspot on my personal phone and connecting my personal Echo/tablet/friend's phone to it?

 

Some (probably most) enterprise WiFi systems have ability to detect and "suppress" "rouge APs" (I know our Fortinet system can, and our old Aruba could). I can't find much online about exactly how this works, but there's some information here.

[matt40k]

At the very least, because if any of them use names etc. you're sending personal data off to a third party without consent.

Not sure it would be - it'll be your voice, but it wouldn't know who's voice it was as it'll be mixed within a group. CCTV would be WAAAAY worse, yet its common place. Personally, sending off all your sensitive data to Capita without parental consent, for something they may, or may not use is alot worse, yet people seem happy doing so :S

[pete]

Luckily I get alerted by email if anyone uses phone or other device as a hot spot. Shows up as a rogue SSID and is automatically blocked ...[emoji102]

 

Unless your automatic blocking involves passive measures such as rapidly wallpapering the area with Bacofoil, you're committing a criminal offence:

 

https://www.ofcom.org.uk/spectrum/interference-enforcement/spectrum-offences/jammers

 

Specifically:

 

How jammers work

 

A jammer normally functions by emitting an electromagnetic disturbance, sometimes called ‘noise’, on a band at an intensity that overwhelms the target receiver, making reception impossible.

 

Jammers may be designed to affect specific services like the frequencies allocated for mobile phone services, satellite navigation systems, Wi-Fi or security systems. Jammers have been used to commit crime.

 

Criminal offences

 

Use of jammers

 

It is a crime to use any apparatus, including jammers, for the purposes of deliberately interfering with wireless telegraphy (radio communications) in the UK. The maximum penalty is two years’ imprisonment and/or an unlimited fine. See section 68 of the Wireless Telegraphy Act 2006.

 

(bold = my emphasis)

 

Which is why most Wireless systems have a "No really, are you *really* sure you want to turn this on?" confirmation dialogue for that setting.

[enjay]

Some (probably most) enterprise WiFi systems have ability to detect and "suppress" "rouge APs" (I know our Fortinet system can, and our old Aruba could). I can't find much online about exactly how this works, but there's some information here.

 

I get how you could detect a rogue AP on your LAN, but my phone isn't on the LAN when it is being a hotspot.

[djrscally]

Curveball, I bet at least 50% of the kids have a smartphone doing this anyway. Certainly mine does (I.E. voice activated google assistant).

[sigma]

Not sure it would be - it'll be your voice, but it wouldn't know who's voice it was as it'll be mixed within a group. CCTV would be WAAAAY worse, yet its common place. Personally, sending off all your sensitive data to Capita without parental consent, for something they may, or may not use is alot worse, yet people seem happy doing so :S

 

The school needs to use SIMS (or equivalent) to do its job. I can't see Alexa anywhere on the curriculum? If CCTV is in effect "Closed circuit" and is clearly defined and logged who can access it then there are fewer issues that with Alexa and say Class Dojo where the school cannot control where the data goes or who has access to it or what its used for either now or in the future once its been collected.

 

Also in terms of SIMS, the school has a contract which details responsibilities and data sharing. Amazon has no such contract for the home version and will be able to vary it at any time without proactively informing you,. as is the case with most consumer as opposed to business versions.

[Rob_D]

I get how you could detect a rogue AP on your LAN, but my phone isn't on the LAN when it is being a hotspot.

Your phone is broadcasting its SSID. My APs can pick that up. The controller can potentially use several APs to triangulate the position of the device. They don't need to authenticate with the device to know its there or to generate interference to block it.

 

It's the same way the auto channel select works on home wifi systems.

[djrscally]

Your phone is broadcasting its SSID. My APs can pick that up. The controller can potentially use several APs to triangulate the position of the device. They don't need to authenticate with the device to know its there or to generate interference to block it.

 

It's the same way the auto channel select works on home wifi systems.

 

What system do you use to do this? I am also under the perhaps misguided impression that it would be illegal to generate noise to block an AP you don't own.

[matt40k]

The school needs to use SIMS (or equivalent) to do its job. I can't see Alexa anywhere on the curriculum? If CCTV is in effect "Closed circuit"

 

Nope. Capita doesn't need the data to school to function, even if it uses SIMS. Heck schools have been functioning for the last 20 years without sending data to Capita and can continue to do so. If schools use a Capita hosted solution, fine. But in this day an age we operate on a min amount of data required, not lets take everything and MAYBE we'll use it. They should be sync all contacts, but only pulling up the sensitive data as and when that parent signs up.

 

Modern CCTV are most deferentially not closed circuit, IP cameras are the new norm and most are at least backing up to the cloud. Add the fact most security systems are monitored by a third party. Now add in AI enabled cameras.

 

Least with the Echo pupils are annoymous.

[Rob_D]

What system do you use to do this? I am also under the perhaps misguided impression that it would be illegal to generate noise to block an AP you don't own.

I'm not debating the legality of it. I'm just answering the questions of how it can see/interact with devices not on the same lan.

 

We just have rogue AP detection on our Fortinet. I think it can so suppression, but it's not something we've ever looked into.

[djrscally]

I'm not debating the legality of it. I'm just answering the questions of how it can see/interact with devices not on the same lan.

 

We just have rogue AP detection on our Fortinet. I think it can so suppression, but it's not something we've ever looked into.

 

Yeah I was more just meaning to express surprise that systems were built to be able to do it; I'm sure if they have the capability then I'm wrong about the law.

 

But yeah, cool: Suppressing rogue APs

[Rob_D]

Yeah I was more just meaning to express surprise that systems were built to be able to do it; I'm sure if they have the capability then I'm wrong about the law.

But yeah, cool: Suppressing rogue APs

 

I'd guess it would be legal if you could absolutely insure that you were only doing it on your property and had warning signs. I'm really thinking of military bases and the like.

[enjay]

I'm not debating the legality of it. I'm just answering the questions of how it can see/interact with devices not on the same lan.

 

We just have rogue AP detection on our Fortinet. I think it can so suppression, but it's not something we've ever looked into.

 

Pretty neat. I've just had a look at our FortiWLC and that has this functionality too. I'm not sure what use the monitoring is without the suppression though - (how) do you use it?

 

You'd probably need to make sure staff, visitors and contractors knew you were doing the suppression. Possibly even just the monitoring - where would you stand on privacy/GDPR if you were monitoring for hotspots in/near your school grounds?

[djrscally]

Pretty neat. I've just had a look at our FortiWLC and that has this functionality too. I'm not sure what use the monitoring is without the suppression though - (how) do you use it?

 

You'd probably need to make sure staff, visitors and contractors knew you were doing the suppression. Possibly even just the monitoring - where would you stand on privacy/GDPR if you were monitoring for hotspots in/near your school grounds?

 

I think it'd be fine, you can't access the actual data sent to / from the hotspots because those will be encrypted so all you can collect is the info about the hotspot; even if that constitutes PII it's obviously justifiable to monitor hotspots in your building for network maintenance and security.

 

I have no idea why you'd bother though