Your Android Phone is Eavesdropping

Are the Russians listening too?

I’m getting paranoid about devices listening to me.

Gotham Gal recently blogged about friends who started to get ads for things they never searched for but had recently talked about (not talked about online, just talked about with a group of friends). Alexa was the first suspect; she was there and she listens. But Alexa somehow would have had to sort out all the different voices and have some way of associating them with people and the computers and phones they use to search the web. Nevertheless, I always switch Alexa’s listening off unless I specifically want to talk to her.

Commenters on Gotham Gal’s post pointed a finger at the Facebook smartphone app. It would recognize its owner’s voice. It would know exactly where in the database to put the possible new interest and how to serve ads which catered to it. I don’t use the Facebook app or Facebook itself much, so I filed my suspicions away for future investigation.

Yesterday I realized that my Android was eavesdropping.

“say OK Google” it said in the search box of the home screen. If I said “OK Google”, I could then give it a voice command like “navigate to the nearest saloon”. Very good for handsfree driving. But, if it’s listening to see whether I say “OK Google”, then it has to be listening to everything I or anyone else says in the car and whatever I listen to on the car’s audio system. Maybe it ignores all that until it hears “OK Google” and maybe it doesn’t. How can I be sure? What if it thinks it heard “OK Google”; then I know it’ll send what it hears next to the Google cloud for interpretation.

What if it’s been hacked? There’s a story in today’s Wall Street Journal saying that Russians are hacking the smartphones of NATO troops. I don’t want to be alarmist but does that mean that if the phones are listening to the troops then the Russians can as well?

No thanks, I don’t want it to listen.

So, of course, I googled how to turn off “OK Google”. The instructions, even from third parties are simple but also misleading. If you go into settings for the Google app, you can turn off “OK Google”. Trouble is that doesn’t turn off listening, If you then say “OK Google”, you get an alert telling you that you turned off the functionality. The only way the phone can give you the alert, obviously, is if it’s till listening. Problem NOT solved.

But you can turn off eavesdropping. You go into settings for the phone, choose apps, choose the Google app, choose permissions, choose microphone, and turn it off. You’ll get the warning below and there are serious consequences for turning this off.

Once you have told the Google app it can’t listen, it won’t. Not even if you tap the microphone option at the right of the search box. It goes into listen mode in this case but never says it is ready for you to speak or even says it won’t listen. You have to type in your request. So you pay a price for stopping the phone from listening. For me the security is worth the price. If I want to talk to Google, I turn its ability to listen back on.

Android ought to support a mode in which the phone only listens AFTER the microphone button is tapped and this ought to be the default. Security is too important to have all new phones in an insecure mode. There is also no good reason, although there are some bad ones, to force a choice between convenience and security in this particular case. The microphone button ought to be an on-off switch for the microphone. Even better, there should be a hardwired mute button for the mike, as there is on Alexa, so it can’t be hacked on.

Note: I have a Moto Z²; it is possible that other Android phones behave differently. If you have an iPhone and you can wake it up by saying “Siri”, then it is always listening to you. You don’t know who else may be.

See also: Alexa – Cover Your Ears