Google Home Mini glitch triggers secret recordings

The privacy glitch that befell Google’s new £49 ($49) Home Mini speaker last week was small but, critics might suggest, still revealing.

The trouble started when journalist Artem Russakovskii, who had been given a review unit at the launch event on 4 October, noticed that the Mini kept turning itself on even when not commanded to.

Deciding to search for clues in the device’s logs, he got a shock:

I opened it up, and my jaw dropped. I saw thousands of items, each with a Play button and a timestamp.

The Mini, it seemed had recorded and uploaded to Google every sound detected in its vicinity for a two-day period, which seemed to be every sound no matter how inconsequential. It even activated after a simple knock on the wall.

This behaviour could be disabled and recordings deleted but only at the expense of harming the system’s future voice recognition accuracy.

What on earth was the Mini playing at?

According to Google, the device had malfunctioned because of a physical problem with the touch panel, which was designed to allow owners to activate recording without using the “OK Google” voice command.

Although this only affected review units handed out during press launches, the company decided to disable the touch feature on all Minis by way of a software update. This process started on 7 October (a day after the errant recording was brought to its attention) and was due to be completed by 15 October.

Concluded Russakovskii:

My Google Home Mini was inadvertently spying on me 24/7 due to a hardware flaw. Google nerfed all Home Minis by disabling the long-press in response, and is now looking into a long-term solution.

For most owners, the usability of the Mini (which doesn’t go on official sale until 19 October), will be unaffected by the software change.

As to its image of the Mini, that might be a bigger issue.

Although resembling a small speaker, the Mini is really a sensor that integrates into Google’s Home platform, which sends the voice commands or questions it receives to a remote server.

Although these activate only after they detect a command such as “OK Google”, by design they are listening all the time in expectation of this.

The system also relates commands to an individual user account. Google allows account holders to control this data as well as mute the Mini, but users must remember to do this. Many probably won’t.

The privacy implications of this system are obvious even as Google dismissed worries that this is just a new form of surveillance dressed up as something useful:

We take user privacy and product quality concerns very seriously. Although we only received a few reports of this issue, we want people to have complete peace of mind while using Google Home Mini.

The incident has echoes Amazon’s troubles when earlier this year it found itself fending off a police request to access recordings made by its Echo speaker in connection with a murder investigation.

Google’s Mini will doubtless probably still sell well – this isn’t another example of the privacy arguments that helped sink Google Glass. But the last thing the company needs is to add fuel to the idea that these devices are, however inadvertently, gateways to a new era of home surveillance.