Why You Should Opt Out of Amazon Sidewalk: A Cybersecurity Expert‘s Perspective

As a cybersecurity researcher and consultant with over 15 years of experience securing cloud services and IoT devices, I‘ve seen my fair share of privacy-intrusive technologies. But few have raised as many red flags as Amazon Sidewalk.

Launched in June 2021, Sidewalk is a mesh network developed by Amazon to extend the range of low-bandwidth smart home devices. It works by pooling together a small portion of internet bandwidth from the Wi-Fi networks of millions of Amazon customers.

When enabled, certain Amazon devices like Echo speakers and Ring cameras act as "Sidewalk Bridges." These bridges connect to Sidewalk-enabled devices like Tile trackers, smart locks, and wearables to keep them online even when they‘re out of range of the owner‘s home Wi-Fi network.

The problem? Sidewalk is turned on by default for Amazon customers without clear notice or consent. And opting out is left up to individual users on a per-device basis.

In this post, I‘ll break down exactly how Sidewalk works, the major security and privacy risks it introduces, and why disabling it is the best option for most people. I‘ll also provide step-by-step instructions for opting out across all your Amazon devices.

How Amazon Sidewalk Works

At its core, Sidewalk is a low-power, long-range wireless network that piggybacks on the home Wi-Fi connections of Amazon device owners.

Sidewalk Bridges like Echo speakers use 900 MHz radio signals and Bluetooth Low Energy (BLE) to communicate with Sidewalk-enabled endpoints. These endpoints could be anything from Tile trackers to smart irrigation systems to wearable medical devices.

Under the hood, Sidewalk-compatible devices connect to Amazon‘s servers using a protocol called LoRaWAN (Long Range Wide Area Network). LoRaWAN is designed for low-powered devices to send small amounts of data over long distances with minimal battery drain.

According to Amazon, each Sidewalk Bridge is capped at contributing a maximum of 500MB per month^1 of a user‘s internet bandwidth to the Sidewalk network. Bandwidth is also limited to 80Kbps per bridge.

While those numbers might sound small, the scale and reach of Sidewalk is anything but. Amazon has sold over 200 million Alexa-enabled devices worldwide^2. If even a fraction of those devices become Sidewalk Bridges, it will create a massive mesh network with coverage rivaling or exceeding cellular networks in some areas.

And adoption is accelerating. Research firm IDC estimates that over 350 million smart home devices will be Sidewalk-compatible by 2025^3. That‘s an incredible amount of foreign devices potentially connecting to your home network without your knowledge or control.

5 Risks of Participating in Amazon Sidewalk

1. Compromised network privacy

The most immediate risk of enabling Sidewalk is the erosion of your network privacy.

By design, Sidewalk siphons off a portion of your private Wi-Fi bandwidth and pools it with that of other users to create a semi-public network. You no longer have full control or visibility over what devices are communicating through your network.

Sidewalk traffic is separate from your main Wi-Fi network. But any network is only as secure as its weakest link. Sidewalk introduces a new set of external devices and connections that could be used as an attack vector by bad actors.

This is especially concerning given Amazon‘s spotty track record on privacy. In the past, Amazon has been caught:

• Recording and saving voice data from Alexa devices without explicit user consent^4
• Sharing Ring camera footage with law enforcement without a warrant or user permission^5
• Failing to encrypt Ring footage, exposing customer video feeds to eavesdropping^6

If Amazon can‘t be trusted to safeguard the data transiting its own devices, how can we expect it to secure an exponentially more complex decentralized network?

2. Increased attack surface

Every Sidewalk-enabled device is another potential entry point for hackers looking to infiltrate your network.

These devices communicate not just with Amazon‘s servers, but with other bridges and endpoints that you have no control over. A flaw or vulnerability in any one of those external touchpoints could expose your network to attack.

Even if you personally refrain from setting up Sidewalk-compatible devices, your network could still be relaying connections for other people‘s poorly-secured smart gadgets. The likelihood of a breach increases with each new device added to the network.

Security researchers have already uncovered flaws in Amazon‘s proprietary Sidewalk protocols that could allow attackers to intercept data or execute malicious code^7. As Sidewalk scales up, it will become an even more enticing target for cybercriminals.

Picture this nightmare scenario: A botnet operator compromises millions of insecure Sidewalk endpoints and uses them to launch DDoS attacks or spread ransomware. The operator then uses Sidewalk‘s long range to hop from network to network, with the source of the attack obscured.

It might sound far-fetched, but we‘ve seen similar attacks play out with other IoT devices like security cameras and DVRs. The larger the network, the greater the risk posed by these distributed threats.

3. Enabling stalking and abuse

One of the most unsettling applications of Sidewalk is using it to extend the range of Bluetooth tracking devices.

Tile, one of Sidewalk‘s premier partners, manufactures small tags that can be attached to easily lost objects like keys or wallets. When the tag comes within range of a Sidewalk bridge, it transmits its location data back to the owner‘s smartphone app.

It doesn‘t take much imagination to see how this technology could be exploited by bad actors. A stalker could slip a Tile into their target‘s car or purse, then use Sidewalk‘s expanded coverage to track their victim‘s movements over a much wider area than with Bluetooth alone.

This isn‘t just theoretical. Domestic violence and cyberstalking support groups have already reported cases of abusers using Tile devices to keep tabs on their victims^8. With Sidewalk, this kind of location-based harassment can now happen on an unprecedented scale.

What‘s more, anyone with a Sidewalk bridge could be unwittingly providing the infrastructure for this type of activity. Because of the way Sidewalk is designed, bridge operators have no way to see what kind of data is passing through their network or where it‘s coming from.

This lack of transparency is a major red flag. Amazon should not be enabling such a massive location tracking network without robust safeguards against misuse.

4. Expanding Amazon‘s surveillance reach

Another troubling aspect of Sidewalk is how it fits into Amazon‘s broader strategy of expanding its surveillance capabilities.

Amazon already has an extensive network of Ring cameras, Alexa smart speakers, and Blink home security systems collecting data on users‘ homes and neighborhoods. With Sidewalk, the company gains access to a new stream of location and activity data as millions of additional devices phone home through the network.

This data could be immensely valuable for behavioral profiling, targeted advertising, and other invasive applications. And unfortunately, Amazon‘s track record on protecting user privacy does not inspire confidence.

In 2019, a coalition of over 40 civil rights groups called on government regulators to investigate Amazon‘s surveillance practices^9. The groups cited Amazon‘s partnerships with over 600 police departments to promote Ring products and its use of facial recognition technology as evidence of the company‘s overreach.

So far, Amazon has been vague about its plans for Sidewalk data. The company says it will use the data to "improve the network performance and reliability of Sidewalk-enabled devices," but provides no specifics on retention periods, sharing with third parties, or use for non-Sidewalk purposes^10.

Given Amazon‘s history of playing fast and loose with user data, this lack of transparency is extremely worrying. Users should not have to blindly trust that their private network connections won‘t be exploited for commercial gain or handed over to law enforcement without due process.

5. Unclear benefits for most users

For all the risks Sidewalk introduces, its practical benefits for the average user are questionable at best.

The most common use cases Amazon touts are:

1. Extending the range of Tile trackers and similar Bluetooth devices
2. Allowing smart locks and security systems to stay online if your home Wi-Fi goes down
3. Enabling outdoor smart home devices like lights and sprinklers

While these applications might be useful for a subset of customers, they hardly seem compelling enough to offset the significant privacy and security concerns for the vast majority of Echo and Ring owners. Most people simply don‘t need an "always on" connection for their smart gadgets.

Moreover, relying on a nebulous, crowdsourced network for mission-critical tasks like home security access or medical monitoring (another use case floated by Amazon) seems downright irresponsible from a reliability standpoint.

There are no guarantees around quality of service, uptime, or troubleshooting on Sidewalk. If your elderly relative‘s fall detection pendant fails because the nearest Sidewalk bridge is on the fritz, you‘re pretty much out of luck.

When you weigh the niche benefits against the wide-ranging risks, it‘s hard to make a case for leaving Sidewalk enabled. Until Amazon puts strict, enforceable safeguards in place, users‘ best bet is to opt out entirely.

How to Opt Out of Amazon Sidewalk

Convinced that Sidewalk is more trouble than it‘s worth? Here‘s how to turn it off on all your Amazon devices:

On all devices via Alexa app:

1. Open the Alexa app on your phone
2. Tap More > Settings > Account Settings
3. Select Amazon Sidewalk, then turn Sidewalk off

For individual devices on Amazon.com:

1. Go to amazon.com/myx and sign into your account
2. Click the Devices tab
3. Select each Sidewalk-compatible device (Echo speakers, Ring cameras, etc.)
4. Scroll down and toggle off the Sidewalk setting

In the Ring app:

1. Open the Ring app and tap the three-lined menu icon in the top left
2. Go to Control Center
3. Tap Sidewalk, then tap the slider to disable it
4. Select "Update my Amazon Sidewalk preferences" to confirm

I recommend going through these steps for every Amazon device in your household. Pay special attention to any new Echo speakers or Ring products you acquire, as they will likely have Sidewalk enabled by default.

It‘s important to note that there is no global "off switch" for Sidewalk that applies across your entire Amazon account. You must manage the settings on a per-device basis, which is an unnecessary hassle.

If you‘re a developer building Sidewalk-compatible products, I also urge you to implement an opt-in flow rather than enabling the network by default. Require affirmative, informed consent from your users before activating Sidewalk on their devices.

Securing Your Network If You Use Sidewalk

If you‘re in the minority of users who find Sidewalk‘s benefits compelling enough to leave it enabled, there are still some steps you can take to harden your network against potential threats:

• Place your Sidewalk bridges on a separate guest Wi-Fi network isolated from your primary network. This will prevent any compromised Sidewalk devices from pivoting to your more sensitive home devices.

• Use the strongest available encryption on your Wi-Fi router. Ideally WPA3, but WPA2-AES is also acceptable. Avoid WPA and WEP protocols, which have known vulnerabilities.

• Change your router‘s admin credentials from the factory defaults. Use a complex passphrase and consider enabling two-factor authentication if your router supports it.

• Keep your router and all connected smart home devices patched and updated. Set up auto-updates if the option is available.

• Monitor your network logs for any unusual traffic or connection attempts. If you notice persistent suspicious activity, consider factory resetting your Sidewalk bridges and disabling the feature.

While these mitigations can help in the short term, they are not a substitute for more robust security and privacy protections from Amazon. No amount of end user hardening can fix the fundamental issues of transparency and consent posed by an opt-out mesh network.

The Path Forward for Sidewalk

Amazon Sidewalk is a classic example of a technology that puts the interests of the company ahead of the security and privacy of individual users. By quietly enabling Sidewalk on millions of devices, Amazon has created a vast surveillance network with little oversight or accountability.

As a cybersecurity professional, it‘s difficult for me to recommend that anyone leave Sidewalk enabled in its current form. The risks of exposed location data, network intrusion, and abuse far outweigh the marginal benefits for the average user. Sidewalk must be strictly opt-in.

If Amazon wishes to continue developing Sidewalk, it should take the following steps to address the concerns outlined in this post:

1. Require explicit, informed opt-in consent from users before activating Sidewalk on any device. Provide a clear, accessible explanation of how the technology works and what data will be collected.

2. Give users granular control over which devices can participate in Sidewalk and which functions they can perform (e.g. location tracking vs. simple connectivity). Allow users to set bandwidth caps and exclude certain devices from the network.

3. Implement strict data minimization practices. Collect only the information necessary to operate the network, and delete it as soon as it‘s no longer needed. Resist the urge to monetize Sidewalk data for advertising or analytics.

4. Be transparent about data sharing practices. Commit to not providing any Sidewalk data to law enforcement without a valid warrant. Regularly publish transparency reports detailing data requests and disclosures.

5. Work with third-party security researchers to audit Sidewalk‘s protocols and infrastructure. Establish a bug bounty program to encourage responsible disclosure of vulnerabilities.

6. Provide a global opt-out mechanism that disables Sidewalk across all devices associated with an Amazon account.

Until these basic protections are in place, security-conscious individuals and organizations should give Sidewalk a wide berth. No amount of convenience is worth sacrificing the integrity of our networks and devices.

If you found this post informative, please share it with your friends and colleagues. The more people who understand the risks of Sidewalk, the more pressure Amazon will face to prioritize privacy and security over blind data collection.

Together, we can hold tech giants accountable and build connected products that put user interests first. Stay safe out there!