The Big Security Questions of Amazon Key
It's all over the news in headlines like this: "Amazon Delivers Inside Your House With Amazon Key". Yes, inside your house, when you are not home. As in, opening your front door and putting a package inside your house. Before reading any of the many news stories about this, these are the questions and thoughts that first came to mind as security experts:
* What are the liability issues for a homeowner if there are dogs?
* At what point does delivery cross over into home invasion?
* How will Amazon ensure that while their delivery person may not steal or intrude what about those who know the delivery person?
* Are background checks ran on all Amazon delivery personnel? And, what gets a pass?
* Could someone pose as an Amazon delivery person who is actually planning to burglar or hide in the home?
* Considering many suspects caught on camera are still at large due to poor resolution issues and cheap technology (think DIY purchased and installed cameras), what kind of camera technology is used in the Amazon Key? Facial recognition?
* If an Amazon delivery person opens the door and a family pet runs out, are they liable?
* Could someone slip into the home undetected by the Amazon Key while the door is being opened?
* Are Amazon delivery personnel at greater risk as victims of planned home invasions if they regularly drop packages at certain doors?
And many, many more. There is no doubt that Amazon knew this would be controversial and their marketing and product development experts have spent countless hours with top legal minds to tackle these and probably any number of other questions and scenarios.
Also, given the marketing budget of Amazon, assumed to be enormous, the Amazon Key is almost certain to be a "thing" with staying power. So, what is it and what do we see as the major security issues that home and business owners must consider before signing on? That is the objective of this post.
What is the Amazon Key?
The first thing we discovered during our research is that the Amazon Key is not a free for all entry system, but a remote control entry mechanism managed by the home/business owner. And, as the operator of the Amazon Key you can let anyone in your home, not just Amazon deliveries. The same idea is found with NEST and August Home systems. And, recently WalMart launched a campaign for a similar entry system allowing delivery personnel to deliver groceries directly to your refrigerator. How many people are comfortable with a stranger going into their home and making mental note of the layout while putting items into the fridge? What about employees visually scanning for cues about how their company can market to you in the future based on the items they see in your home? There is a wasp nest of what-ifs that come with these new technologies.
The Amazon Key In-Home Kit. Source: Amazon.com
The Amazon Key system includes (as sourced from the Amazon Prime website):
* Amazon Cloud Cam (Key Edition) indoor security camera features 1080p Full HD, night vision, and two-way audio.
* Choose an Amazon Key-compatible smart lock from leading lock manufacturers, Kwikset and Yale.
* Use the Amazon Key App to watch deliveries, check in anytime via live view, and lock and unlock your front door from anywhere.
How Issues are Resolved
While the website does not go in depth into security issues, at this time the way things are handled, such as broken items to home invasions, is via the Amazon Happiness Guarantee. Will Amazon get involved in a police report or investigation? Will Amazon assist in identification of subjects? We don't know yet. And, unfortunately...
You Must Disarm Your Security System on Delivery Day
From the FAQs: "Amazon Key is not integrated with home security systems. On the day of delivery, you will need to disarm your home security alarm. We do not recommend using in-home delivery if you are not comfortable disarming your security system on delivery day."
This is probably one of the biggest security concerns. Burglars don't often make random hits. They plan, they watch, and they know your habits. They know who comes and goes, and when. When there are workers in the neighborhood, often there is an increase in home invasions, and not necessarily by the workers themselves but those they may know. If a neighbor is having a new roof put on, the workers literally have a bird's eye view of all the happenings and patterns in their visibility: from the neighbor who leaves the house with the back door open for the dog to the general time of day most homes are empty. If your home has regular delivery or other services and access is granted via keyless remote entry, and it is public knowledge that on those days your security system must be deactivated, your home is ripe for the picking.
In addition, the security camera is not actually inside the lock but rather a desktop style camera on a stand that the end user must strategically place. And if the cat knocks it over then...oh well. If you have another camera installed that is not the Amazon camera and it records an incident will it be admissible as evidence to resolution with Amazon since it was not the actual system camera doing the recording? There are quite a few worms in the box.
A new question that came to mind after doing some research is:
* If you grant access via an Amazon Key or similar system, like that promoted for WalMart, and your home is burglarized during a delivery or because of a delivery, or by a friend or associate of an employee of a delivery or service company authorized to use the keyless entry system, how will this play out in a court of law? Is there "implied risk" by using one of these systems?
How Is The Key Unlocked?
We discovered that the key is unlocked via a scanner device carried by the delivery person. There is no code or actual physical key.
The first thing that comes to mind at learning this is skimmers. Skimmers are devices placed on ATMs, gas pumps, and point of sale swipers found at stores that look identical to the original device that receives and scans your credit card, and fits over the original device. The skimmer allows for the transaction to go through as usual with a catch: now your card information is being read by the skimmer and either saved in the device and removed bye the thief later, or transmitted to the thief electronically. In order for the skimmer devices to be made so perfectly identical so as to go undetected, someone had to have the plans and the specs and got them into the hands of a manufacturer either directly or via a chain of connections. It's a replication process. So, how easy would it be for a savvy crime ring to replicate the Amazon Key scanner?
A credit card point of sale swiper (right) and an identical but slightly larger skimmer which fits over top of the original equipment. Photo Source: krebsonsecurity.com
Clearly with any new technology there are a lot of questions. There is no doubt that this won't be the last we hear of this kind of technology and the pros and cons. It may not be long before news catches wave of the first crimes committed using this technology and how they are resolved. And, in the legal system there may not be enough precedence to solve the legal issues around granting access to strangers remotely, resulting in difficult court decisions. What about implied risk? What about assumed risk? And, so on.
Other areas of concern are:
* The IoT security risk
* How easy it will be to hack into the Amazon camera
* How secure the Amazon cloud is with video storage
* The camera is private labeled for Amazon but where is the camera manufactured and by which company?
We will be watching the development of this technology and how it does affect the end user, and the safety and security of homes, families, businesses, and communities. Right now the end user of these types of systems should assess and know the potential risks and determine if they are ok with that and if the convenience outweighs the issues.
Experience the next generation of interactive security services and solutions with GenX Security.
With custom security integration solutions come custom quotes designed for your needs. Please contact us by clicking here or calling 866-598-4369.
