Amazon’s home security and video doorbell company Ring announced today a new encryption system designed to reduce how long the company itself can access them. As a result, the new system could also limit what Ring is able to share with law enforcement.
The company is rolling out a new encryption system called “Throw Away the Key Encryption” or TAKE that will eventually become the default for all Ring customers worldwide. The rollout begins in September.
Currently, Ring videos are encrypted while traveling to the cloud, but Ring’s cloud services can still access the footage that it has stored. TAKE adds another layer of protection designed to limit how long the company has access to the video recordings.
Under TAKE, Ring videos are protected with unique encryption keys that regularly rotate. A copy of those keys is temporarily held inside a “secure enclave within the cloud,” which Ring says it can only access under limited conditions to execute and process features like Video Search, Video Descriptions, and Smart Alerts.
Ring then permanently deletes its copy of the keys after 24 hours. After that, the keys needed to access the recordings are stored on a customer’s authorized devices.
If a customer pulls up an older recording and Ring needs to process it for playback or another cloud feature, the Ring app can temporarily send the necessary key back to the company. Ring says the key is deleted again once that processing is finished.
For customers who want even stronger protections, Ring will continue offering end-to-end encryption. The tradeoff is that features requiring Ring to process video in the cloud will not be available.
The new TAKE system could limit what Ring is able to provide to law enforcement. Ring says on its privacy page that for customers who enable TAKE or end-to-end encryption, the company can only provide “non-video information, such as basic subscriber information,” in response to valid law enforcement requests such as warrants, subpoenas and court orders.
A company spokesperson confirmed this in an email, adding that Ring would also provide encrypted video files, in addition to non-video information, in response to valid legal process.
“Privacy and security are not a one-time announcement for us. They are part of how we build,” the company said in a press release. “We are constantly listening to what matters most to our customers and inventing accordingly to deliver the best products and experiences possible.”
The rollout comes amid growing scrutiny of surveillance technology like video doorbells and automated license plate readers like Flock.
Earlier this year, Ring canceled a planned Flock integration into Ring’s Community Requests program. The initiative allows users to voluntarily share video footage when requested by police working on active investigations, with the footage being handled by a third party like Flock Safety.
Ring stepped away from the partnership following backlash to a Super Bowl ad promoting its AI-powered “Search Party” feature, which uses Ring cameras to help find lost pets. Critics, including Sen. Ed Markey, voiced concerns that the tech could eventually be used to surveil and identify humans.
Ring still works with the taser and body camera maker Axon in its Community Requests program.
That program replaced Ring’s earlier Request for Assistance system, which allowed police to directly ask nearby Ring users to voluntarily provide footage without obtaining a warrant.
Gizmodo reported in 2019 that the company had partnered with hundreds of police departments at the time and even provided agencies with talking points and templates for press releases and social media posts.
Read the full article here
