Report: Cortana recordings were protected with 'no security measures'

It's not like your voice-assistant conversations ever involve private information, right?

A report from the Guardian, which relies on an ex-Microsoft contractor as a source, claims that Cortana audio recordings were protected with "no security measures" until possibly as recently as last summer. Many of these recordings, which in some cases included audio clips from accidental activations of the smart assistant, were allegedly easily accessible over the Chinese internet with minimal safeguards.

How minimal? Well, according to the unnamed contractor, all they had to do was log into a web portal via their Chrome browser. What's more, the contractors, based in China, were all reportedly told to use the same password.

"They just give me a login over email and I will then have access to Cortana recordings," the contractor told the Guardian. "I could then hypothetically share this login with anyone."

We reached out to Microsoft in an attempt to confirm details of the Guardian's reporting, but received no immediate response.

It's worth emphasizing that, for a long time — and in some cases still to this day — actual humans listened to the conversations you had with smart assistants like Alexa and Siri. Employees and contractors with access to these audio recordings admitted that many of the files they were sent for review appeared to have been recorded without the users' knowledge. That is, no prompt word or phrase such as "hey Google" had been spoken.

Following media reports on the eavesdropping practice, makers of smart assistants moved to partially curtail the practice. Facebook, for example, briefly paused the human review of Portal conversations — but only briefly.

Customers, at least some of whom had been unaware that recordings of their conversations with smart assistants were being passed around for laughs by contractors, understandably responded to the news with surprise. That, at least according to the Guardian's source, the security protecting Cortana recordings was so lacking only makes matters worse.

SEE ALSO: Amazon's 'Alexa Answers' is a hot mess, surprising exactly no one

Importantly, Microsoft told the Guardian that the program described by the contractor no longer exists in China. Whether or not that alone should make you feel better about smart assistants, well, is an open question.

UPDATE: Jan. 10, 2020, 4:04 p.m. PST: A Microsoft spokesperson responded with the following statement:

We review short snippets of de-identified voice data from a small percentage of customers to help improve voice-enabled features, and we sometimes engage partner companies in this work. Review snippets are typically fewer than ten seconds long and no one reviewing these snippets would have access to longer conversations. We’ve always disclosed this to customers and operate to the highest privacy standards set out in laws like Europe’s GDPR. This past summer we carefully reviewed both the process we use and the communications with customers. As a result we updated our privacy statement to be even more clear about this work, and since then we’ve significantly enhanced the process including by moving these reviews to secure facilities in a small number of countries. We will continue to take steps to give customers greater transparency and control over how we manage their data.