Last year, around the Thanksgiving holiday, Ohio businessman Michael Larkin received a request for video from his Amazon Ring security system from Hamilton city police.
He complied, providing video from his doorbell camera that was stored on Ring’s servers. After balking at further demands, he subsequently learned that authorities had bypassed the need to get his consent by presenting Ring with a search warrant for video from several of his Ring cameras, including one that covered an indoor area of his home.
According to Politico, Larkin received a notice from Ring that the tech biz had received a warrant and was required to turn over video from numerous cameras, without giving the owner with any say in the matter.
The police reportedly sought neighborhood surveillance as part of a drug investigation in the US city. Larkin’s video-enabled Ring doorbell and other recording devices, they believed, might have captured information that would be helpful with their investigation.
The City of Hamilton Police Department did not respond to requests seeking comment about the scope of its search warrant.
Larkin evidently did not end up providing any video from inside his home because that particular camera was disconnected during the period covered under the warrant.
But the incident has renewed concern among privacy advocates and lawmakers that Ring allows police to outsource surveillance in a way that evades oversight, diminishes the public’s privacy protections, and deprives product owners of the ability to make decisions about the video their devices have captured.
Many of these concerns were articulated in a New York University School of Law research paper [PDF] published last May. The paper explains, “Ring is one part of a growing, largely unregulated, market for ‘lateral surveillance’ – private individuals surveilling one another. Police increasingly are leveraging privately-owned surveillance devices, from internet-connected cameras to automated license plate readers. Lateral surveillance may at times have security benefits, but it also has real costs, as this report endeavors to make clear.”
The report overall cites positive changes Ring has made to address criticisms, noting that the company does not provide direct bulk access to surveillance and provides mechanisms to monitor how public agencies request recordings.
Ring makes several home security products that record video and store the files remotely on corporate servers. For the past several years, privacy groups and lawmakers have challenged how the company handles customers’ surveillance video, which gets stored up to 60 days by default in the US, or up to 180 days at most, absent legal orders to the contrary.
According to Ring’s most recent transparency report [PDF], the company received 1,939 search warrants during the second half of 2022, along with 281 subpoenas, six court orders, 18 non-US information requests, and 2,031 requests to preserve data. The company says it notified users in response to 691 information requests, stating that it does so unless prohibited or presented with a clear indication of illegal conduct.
Ring also may skip notifications to owners when there’s an emergency. In response [PDF] to an inquiry last year from Sen. Ed Markey (D-MA), Ring revealed that it shared user recordings without any notice to customers 11 times in 2022, per its policy on exigent or emergency requests.
A Ring spokesperson told The Register, “Ring carefully reviews every search warrant and other legal process we receive when determining how to respond. We do not disclose customer information in response to government demands, such as a search warrant, unless we’re legally required to comply.”
“Our response depends on the information requested and whether we have that information. We review all legal documents served on us, and if we have reason to believe that a demand is overbroad, we question the request and may ask law enforcement to suggest a more limited production of information.”
Ring’s spokesperson also said that the company implemented end-to-end encryption on nearly all of its devices in January 2021. So in theory Larkin could have denied Ring’s ability to hand his video to police if he activated encryption.
However, as the Electronic Frontier Foundation has observed, customers have to choose to encrypt their stored surveillance footage because encryption is not enabled by default.
The Register asked Ring whether anyone could cite any example of being unable to respond to a warrant because a customer had encrypted the data, and what percentage of customers activate encryption. Ring’s spokesperson said, “I don’t have that for you.” ®
