Read update
  • Google has just published a support page to address the reported issue. The company assures pre-order customers that their units won't be affected, and the defect should be limited to the batches given out at Made by Google events, which presumably includes 4,000 Home Minis distributed at the donut pop-up events as well as the ones from the October 4th press event.

When the first home assistants were announced, I was excited. A device I could wake up with a simple hotword that would answer my questions, set reminders, turn on the TV, and dim the lights, all without me having to get off the couch, sounded fantastic. Amazon's Echo and Echo Dot, Google's Home, and a myriad others, most recently the Home Mini, have invaded our kitchens, living rooms, and bedrooms. Heck, I put one in the bathroom.

Without fail, every time a new listening device comes to market, some tinfoil hat-wearer points out how perfect they would be as modern-day Trojan horses for any of the three-letter acronym organizations - NSA, CIA, FBI - you name it. Manufacturers, on their part, assure us their devices are perfectly safe and only listen when prompted. We brush the concerns off and move on with our lives, but not before granting our smart pineapples (did you know "pineapple" is the codename for Google Home?) access to the smart rice maker, smart vacuum, and smart toothbrush.

I didn't give too much thought to these privacy concerns because they all sounded theoretical and unlikely. My four Google Homes and three Echos sat quietly on their respective desks and counters, and only turned on when one of three things happened:

  1. I called out a hotword (Alexa for Echos and Hey or OK Google for Homes).
  2. A video I was watching or podcast I was listening to did this (I'm looking at you, Marques!)
  3. They heard a noise or word that they thought sounded like a hotword but in reality was not. This happened once or twice every few days.

That is until last week, when a 4th case came along - 24/7 recording, transmission to Google's servers, and storing on them of pretty much everything going on around my Home Mini, which I had just received at the Made by Google October 4th launch event.

Before I describe exactly what happened and how I discovered this pretty incredible violation of privacy, I'd like to point out that it ended up being a hardware defect in my Home Mini as well as an unspecified small number of others. Google never intended for it to happen and has reacted incredibly swiftly to rectify the situation.

So what happened?

Wednesday, October 4th

I went to the Google launch event in San Francisco that I'm sure many of you watched closely. In addition to the two new Pixels, the Pixelbook, Pixel Buds, and Google Clips, Google introduced the Home Mini, a tiny $50 version of the Home we'd expected for several months. Everyone in attendance got to take one home, and having run out of rooms to put it in, I stuck mine in the bathroom. Before you go raising your eyebrows, this is a room I spend a considerable amount of time in, listening to podcasts, music, and asking Google random questions when I get ready for the day in the morning.

Several days passed without me noticing anything wrong. In the meantime, as it turns out, the Mini was behaving very differently from all the other Homes and Echos in my home - it was waking up thousands of times a day, recording, then sending those recordings to Google. All of this was done quietly, with only the four lights on the unit I wasn't looking at flashing on and then off.

In the meantime, Android Police, along with numerous other publications, gave the Mini glowing reviews. Their units were fine. Mine, however, was not (#artemsluck as usual).

Friday, October 6th

I turned on a TV located not too far from the Mini and attempted to watch a show. I say "attempted" because during the first 10 minutes, the Mini turned itself on several times a minute, listened to whatever was on the TV, and attempted to respond, usually by saying it did not understand. At some point, it even somehow managed to take over my Spotify stream that was playing in the office and switched it to the bathroom:

At this point, I was ready to chuck the Mini at a wall and yell at David for not noticing the very obvious sensitivity issue that was dialed up past 11 all the way to 111.

Having freshly discovered the day prior that Google's My Activity portal on the web contained an Assistant-specific section, I opened it up, and my jaw dropped. I saw thousands of items, each with a Play button and a timestamp, all attributed to the cryptically named com.google.android.apps.chirp/mushroom/prod and Assistant. See for yourself:

At this point, I remembered chirp was the codename for the Google Home ecosystem and realized mushroom likely referred to the Mini, since the regular Home is pineapple. After listening to a dozen audio clips that looked something like this...

... I went back to the bathroom to take a closer look at the mischievous Mini. Was I grossly misunderstanding how Assistant works or was there something seriously wrong?

Yes, everything you tell your Assistant is recorded and stored on Google's servers unless you explicitly disable it in My Activity, which will adversely affect the accuracy of recognition.

I turned on a nearby TV and started recording. Here's what I saw:

Just to clarify, the audio is not coming out of the speaker next to the Home Mini, but from a TV speaker a few feet away.

As you can see, the Home Mini quietly turns on, flashes its lights, then shuts off after recording every sound. When the volume increases, it actually attempts to respond to random queries. I was even able to get it to turn on just by knocking on the wall.

Friday, October 6th - 4:22pm

At this point, I realized the seriousness of the situation and contacted Google PR. I described the issue, added "urgent" to the subject, and sent it off, not expecting a response until Monday at best.

Hi,

Please forward this to the Google Home team for a response. We are working on a story and will publish in the next day or so. I just discovered the issue and based on my understanding, it's quite a serious violation of privacy, specific to the Google Home Mini. Could you please confirm that the Mini's codename is "mushroom"?

Here's an example screenshot from the Google My Activity page, filtered by Assistant. As you can see, there are thousands of triggers that record, transmit, and save the audio snippets on Google's servers. All of them say they were triggered by a hotword. It's obviously not true. I also noticed the Home Mini is extremely sensitive to nearby sounds (TV, speech, etc.) and has a lot of false positives, including ones that result in an audible response (usually that it didn't understand what was asked).

<SNIPPED IMAGE>

Now here's the kicker - based on Google My Activity, the onslaught of thousands of transmitted and saved Assistant-related audio queries started on the day the Home Mini was set up (October 4). The mention of "com.google.android.apps.chirp/mushroom/prod" does not appear before then either, all pointing to the Home Mini being the culprit and not the larger Homes, Android TVs, or phones.

Needless to say, if a listening device records almost every minute of every day and stores it remotely, we're talking about a huge privacy violation. Does Google have a comment about this?

Thank you.

Sincerely,

Artem

Friday, October 6th - 4:32pm

To my surprise, the first reply came in 10 minutes later. They were looking into it. I replied with a few more details.

Friday, October 6th - 5:58pm

Google assured me that this was the first time they've heard of this issue and were really interested in swapping out my unit to examine it.

Friday, October 6th - 7:00pm

Google PR was on the way to my house to pick it up. Mind you, we're talking about a Friday night here. That's dedication! I wasn't home at the time, but by 9pm, the exchange was made. In fact, I was left with two replacement Google Home Minis for my trouble. I'm on to you, Google! (/s)

An engineer was driving up to Oakland to examine it that very night. It was clear how seriously they were treating the situation.

Saturday, October 7th

The next day, Google sent me its initial assessment that I will quote here:

We have learned of an issue impacting a small number of Google Home Minis that could cause the touch mechanism to behave incorrectly. We are rolling out a software update today that should address the issue. If you're having any additional issues, please feel free to contact Google Support at 1-855-971-9121.

I asked for some clarifications and gave them more time.

Sunday, October 8th

Further clarifications arrived. The Google Home Mini supports hotword activation through a long press on the touch panel. This method allows people to activate the Google Assistant without saying the hotword. On a very small number of Google Home Mini devices, Google is seeing the touch panel register "phantom" touch events.

In response, the updated software disables the long press to activate the Google Assistant feature. Once the Google Home Mini devices receive the updated software, all long press events (real or phantom) will be ignored and Google Assistant will not be invoked accidentally.

The company also let me know that they're in the process of building a long-term fix, whatever it may be. It's too early to say if they're going to be able to deal with "phantom" touch events entirely in software or if a recall for affected units will be in order.

Monday, October 9

I followed up with some more questions.

Tuesday, October 10

The firmware I was originally running was 1.28.99351. Google says the new firmware is 1.28.100122, and the rollout has already been completed.

You can also see that the online Home Mini documentation has been updated to reflect the above:

Conclusion

So there you have it. Don't be surprised that the long-press to activate Assistant functionality, described in many reviews, isn't working. My Google Home Mini was inadvertently spying on me 24/7 due to a hardware flaw. Google nerfed all Home Minis by disabling the long-press in response, and is now looking into a long-term solution.

I'd like to once again commend the company's reaction to my report and the speed at which they issued the OTA that dealt with the problem right away, giving them time to look for a proper fix.

UPDATE: 2017/10/10 5:31pm PDT BY

Google has just published a support page to address the reported issue. The company assures pre-order customers that their units won't be affected, and the defect should be limited to the batches given out at Made by Google events, which presumably includes 4,000 Home Minis distributed at the donut pop-up events as well as the ones from the October 4th press event.

Additionally, Google has removed all existing activity generated by long pressing the top of a Mini from their servers.

It's still unclear at this point what the fate of the long-press feature is in the long term.

[Fixed issue] Google Home Mini touch controls behaving incorrectly

The Google Home team is aware of an issue impacting a small number of Google Home Mini devices that could cause the touch control mechanism to behave incorrectly. We immediately rolled out a software update on October 7 to mitigate the issue.

Who is affected: People who received an early release Google Home Mini device at recent Made by Google events. Pre-ordered Google Home Mini purchases aren't affected.

My Activity: We take user privacy very seriously. We've removed any activity/queries that were created by long pressing the top of a Google Home Mini between October 4 and October 7, when the software update was rolled out. That information will no longer be listed on your My Activity page. You can also always go to your My Activity page and delete any past activity from your account.

Next steps: If you're still having issues, please contact Google Home Support at 1-855-971-9121 to get a replacement Google Home Mini.

UPDATE: 2017/10/11 5:28pm PDT BY

Google has decided to permanently remove all top touch functionality. The company sent us the following statement:

We take user privacy and product quality concerns very seriously. Although we only received a few reports of this issue, we want people to have complete peace of mind while using Google Home Mini.

We have made the decision to permanently remove all top touch functionality on the Google Home Mini. As before, the best way to control and activate Google Home Mini is through voice, by saying "Ok Google" or "Hey Google," which is already how most people engage with our Google Home products. You can still adjust the volume by using the touch control on the side of the device.

Note that it's not just the long-press to activate Assistant that's getting permanently canned, but also the single-tap functionality to play, pause, and stop alarms/timers. The support page has now been reflected accordingly:

Top touch functionality

We've decided to permanently remove all top touch functionality on Google Home Mini. We made this decision to avoid any confusion and give you complete peace of mind while using your Mini. The update will be completely rolled out by end of day October 15, 2017.

The good news is you get the same functionality using your voice.

  • Say "Ok Google" or "Hey Google" instead of pressing and holding the top of Mini to start a request.
  • Say "Ok Google" or "Hey Google <pause/play/stop>" instead of tapping the top of Mini to control music, alarms, and timers.

Volume control

Mini's volume controls haven't changed. You can still control volume by side touch and voice.