Google says Nest’s built-in mic not listed in specs was not meant to be secret

If the little company with a fantastic device did not really have a business model besides eventually getting bought out they have been working for one of the big five (or whatever the current count is) from day one, they just did not know which one exactly.

I think there are two ends on a diagram of skepticism and scrutiny.

On one end you have individuals who will find nearly any conspiracy viable for whatever reason. That most conspiracy theories are eventually shown to be false doesn't really seem to bother them. On the other end you have individuals that will never believe anything could possibly be true, so long as a government or corporation has plausible deniability. The lengthy list of conspiracy theories that turned out to be true, or other conspiracies that nobody knew of - only revealed decades after due to declassification, don't really seem to bother them.

I suppose we could call both ends naive. Naively trusting to naively untrusting. The 'right' degree of scrutiny is somewhere in the middle. In this case you have the largest ad delivery corporation in the world. They've "accidentally" engaged in behavior such as snooping and logging data from unsecured wifi connections with their street view vehicles, continued to track users' locations on Android devices even when tracking was "disabled", and so on. Google is also one of the companies that known is known to be collaborating with intelligence agencies including, but not limited to, the NSA. Most recently they were one of the first companies fined for refusing to abide the GDPR regulations for a variety of actions including lack of legal basis for the information they were collecting, lack of transparency in what/how it was collected, and enrolling users in tracking without their permission. And while not directly related, I think it speaks to the true character and ethos of the company that one of the words they plan/planned to black-list in their tracking enabled censorship driven search engine in China is literally "human rights." [1]

And now they "accidentally" forgot to include on the packaging information that an internet connected device installed centrally within homes also had a recording device. I mean given the context of who you're talking about where do you think the idea that this device, and omission might be less the benign, ranks on the scale of 'naively trusting -> naively untrusting' scale? The connotation of conspiracy theory, as in your usage, is implying it's naively untrusting. I do not think this is a logical conclusion.

[1] - https://theintercept.com/2018/12/01/google-china-censorship-...

And many people don't have Android phones, so this could be pretty significant.

Besides, the attack vector for a non-Google attacker to access this mic may be different than for accessing the mic on a phone

>You have two options, choose one:

Your analysis is sensible. Where we should choose the most likely explanation, it might become sharper:

- In case you're not familiar with it, one helpful tool is prior probability (Bayesian thinking). This video is short and accessible: https://www.youtube.com/watch?v=BrK7X_XlGB8

- There is a public intelligence budget in 2018 of $54.9 billion in the United States[1], as compared with the combined annual R&D expenditure of Apple, Google, Intel, and Microsoft at $53.2 billion[2]. This employs over 100,000 people[3].

- According to Snowden, they covertly use microphones.[4] He had reporters put their mobile phones in a fridge/microwave, since they could be turned on remotely.

A sensible assumption is that you are unlikely to chance upon a covert surveillance mechanisms if one is installed. (For example, speakers could also be used as microphones.) Where a bug is present, I think assigning 1% to the probability of finding it is reasonable.

In view of the above, after you find an undisclosed and apparently (but not physically) disabled microphone in a product, which is more likely?

1. One of the 100,000 people mentioned, using some of the $59,900,000,000 annual budget mentioned, put it there. They do this thousands of times per year, and you've just found one of them. However, the chances of your finding it are low. (1%).

2. It was put in there as part of normal product design but left unused. Perhaps it will be legitimately enabled in a future version. Perhaps Google will use it for OK Google, its voice assistant. It has no covert intention. Google spends a lot of effort on ensuring privacy. The chances of your finding it are very high (90%) - it's not meant to be hidden and is no secret.

If the chances of your finding a covert device is 1% in case there is one, and the chances of your finding an unused but not physically disconnected microphone is 90% if there is one, then to complete your analysis of which is more likely, you should know how many times the scenarios in 1 and 2 occur.

I hope these additional tools - Bayesian probability and some figures about the base rate, could make your analysis sharper. Personally, I feel it's likely that a 1% chance of discovering a covert bug, multiplied by the thousands of such bugs (devices) out there, makes it more likely than the 90% chance of finding a totally unused and unadvertised microphone in a product, since there would be few such cases.

--

[1] https://en.wikipedia.org/wiki/United_States_intelligence_bud...

[2] https://www.statista.com/statistics/265645/ranking-of-the-20...

[3] https://en.wikipedia.org/wiki/United_States_Intelligence_Com...

[4] Pick your reference: https://www.google.com/search?q=snowden+microphones

You are assuming that the people talking to us have any chance of knowing. Even in a company with a relatively flat hierarchy there are walls of "they don't need/want to know that detail" between the engineers & budgeting[1] and top-brass & marketing. Sometimes this comes from the technical side ("I won't include that detail, it'll only confuse them") sometimes the other way ("That huge document you sent through, could you distil it down to a side or two of key points?").

I suppose they could try to instil a whistle-blowing culture whereby people are rewarded for highlighting potential problems list this to other silos[2], but then like external bug bounties you get into a new family of argument about what the problem is worth, who truly found it first, and the race to be first will lead to a lot of noise around any useful signal.

[1] the engineers will know it is there as they are designing the thing, the money people will know as they will have been involved in the "it is cheaper to just leave it and disable it than to redesign it out" decision-making process.

[2] no matter how flat/heterogenus/other-all-together-now-buzzword-compliant-word-of-the-momemtn a company claims to be, there will be siloed groups within it, and within them like Russian dolls in larger organisations.

> how on earth do they think they deserve trust

They probably don't, individually. They are like us, with similar concerns.

But they don't need to think they deserve it individually as long as the company overall can convince enough of us that they do (and convince enough of us that will never be convinced of that, that it doesn't really matter in the long run anyway).