Your phone isn’t listening to you, researchers say, but it may be watching everything you do

By Makena Kelly, The Verge, Jul 3, 2018

You’ve seen the YouTube videos. It’s a shaky-cam iPhone shot with a wide-eyed someone giggling under their breath “cat food,” or some other miscellaneous thing they allegedly never talk about or search for near or on their device. The climax of this plot line hits in the following hours or days after they’ve muttered said random phrase, and they’re suddenly served an ad on Facebook of the exact same thing they said before. Preposterous! It’s the classic “your phone is listening to everything you say,” conspiracy theory that so many people have willingly started to believe. But, according to researchers from Northeastern University, reported by Gizmodo’s Kashmir Hill, this isn’t the case at all. After a yearlong study, they found no evidence that your apps are listening to you, but they did find out that they may be watching everything that you do.

A group of computer science academics ran an experiment that tested over 17,000 of the most popular Android apps in order to determine if any of them recorded audio from the phone’s microphone. Some of these apps were Facebook’s own and over 8,000 other apps capable of sending information to the social media platform. Out of the set of apps tested, more than half had permissions to access the device’s camera and microphone, according to the report, which would allow for any conversations one had whilst having the app opened to potentially be recorded. Using an automated program as a method of interacting with the apps on the devices, all of the traffic created was analyzed and the researchers determined that no audio files were sent to any third-party domains.

Researchers were quick to mention the limitations of the study and never made a definitive claim that your apps are never secretly listening to you. Since an automated system was used to test the apps, the results may be different from what a human would encounter. The automated system was also unable to sign into these apps and could have missed audio that was processed locally on the device.

But, the researchers did notice something else funky, according to Gizmodo. Several apps had taken video recordings and screenshots of what people were doing. These screenshots were then sent off to third-party domains.

One of these apps, GoPuff — a service similar to PostMates, but primarily used for late-night “munchies” deliveries — had recorded a video of the app’s screen and sent it to third-party mobile analytics company Appsee. For delivery apps, sensitive information like credit card numbers and addresses are the main sets of data users enter. In a similar vein, GoPuff had recorded and shipped off a recording of the screen that asks for a customer’s zip code. GoPuff’s privacy policy didn’t notify users that their screens could potentially be recorded. After researchers contacted GoPuff regarding what they had found, they updated their privacy policy to say that user’s “personally identifiable information” may be collected.

So by attempting to debunk one conspiracy theory, researchers were able to create a situation primed for another one to take its place. And without easily recognizable disclosures from companies that your screen may be recorded, this new theory may persist just as strongly as the one the researchers were sick of hearing about.

See this publication in Russian