The privacy loophole in your doorbell

[MechAg94]

Police were investigating his neighbor. A judge gave officers access to all his security-camera footage, including inside his home.
https://www.politico.com/news/2023/03/07/privacy-loophole-ring-doorbell-00084979

The police said they were conducting a drug-related investigation on a neighbor, and they wanted videos of “suspicious activity” between 5 and 7 p.m. one night in October. Larkin cooperated, and sent clips of a car that drove by his Ring camera more than 12 times in that time frame.

He thought that was all the police would need. Instead, it was just the beginning.

They asked for more footage, now from the entire day’s worth of records. And a week later, Larkin received a notice from Ring itself: The company had received a warrant, signed by a local judge. The notice informed him it was obligated to send footage from more than 20 cameras — whether or not Larkin was willing to share it himself.

Just something to remember when/if you start putting these cameras around your house.

Link courtesy of:
RING Doorbell Gives Private Video To Police | Privacy Scandal    The Civil Rights Lawyer
https://www.youtube.com/watch?v=9VMEaKsyB-g

[Ben]

Amazon has these devices set up to also acquire neighboring signals, so if your Internet connection goes down for instance, your Ring will "borrow" your neighbor's connection via their Ring until your service is restored. It is a very low bandwidth and limited connection, but still, it's a way in. I have no idea what the security protocols are and if they are "default strong" or if as is so often the case, they default to "be social and share with the village". I did read that Amazon plans to greatly expand this type of connectivity, both for the "neighborhood" stuff, and for LE.

[Nick1911]

Records made that are relevant to an investigation can be subpoenaed, regardless of who makes them.  That part isn't new.  The fact that everyone is always making records of everything all the time, that's new.

[WLJ]

[dogmush]

I will preface this with the note that I really like my ring and blink cameras.  They are often pretty handy, and my wife likes checking on what the dogs and maids are doing.

That said, I feel like it's pretty common sense to not put a camera on something that you don't want recorded.  Just as a general rule of thumb.  Didn't we go through all this when laptops started having cameras ubiquitously? 

[MechAg94]

Records made that are relevant to an investigation can be subpoenaed, regardless of who makes them.  That part isn't new.  The fact that everyone is always making records of everything all the time, that's new.

And this is running into the other problem that police and judges often go for broad search warrants that go beyond what they actually need for the investigation.  And this guy wouldn't have known about it if Ring hadn't been nice enough to tell him.

[cordex]

I got rid of my ring camera when I moved. I have a bunch of cameras which only record locally (but can be accessed remotely). The only indoor space I put those cameras in is my garage.

This was intentional.

Laptop/phone/tablet cameras are less of an issue because they are not by default always recording. Sure, they can be compromised and you need to consider that, but it is a different situation entirely. A judge can’t order a third party to disclose everything that went in front of your phone or laptop camera the way they can with a Ring camera.

Yet.

[Ben]

That said, I feel like it's pretty common sense to not put a camera on something that you don't want recorded.  Just as a general rule of thumb.  Didn't we go through all this when laptops started having cameras ubiquitously?

Other than my garage/outside ones, I've gotten in the habit of turning the blink cameras in the house towards a wall, and only reorienting them if I'm going to be gone for more than a day and wanting to monitor the house. I keep bouncing back and forth on the Ring doorbell. I'm far enough away from neighbors and the county road that I wouldn't be on a "share" network, and someone would have to drive down my private road to the house to hijack the Ring. At that point, they could potentially get into my other "internet of things" devices like the thermostat, that are isolated on my guest network.

[MillCreek]

I have six Ring cameras on the exterior of the house and one inside covering the main living space. The living space camera has motion detection off so I have to manually activate that when we are out of town on vacation or the like. I actually read the privacy disclaimers when I signed up for the service.

Edited to add: plus, based on what I have read in the legal journals, I am also aware of subpoenas for Alexa or Google assistant information.  What your searches are, what your purchase history is, and what Alexa or Google have overheard.  We have several Alexa devices in the house.

[Ben]

I got rid of my ring camera when I moved. I have a bunch of cameras which only record locally (but can be accessed remotely).

I may have asked you this before, but what are you using? Are they all wired power?

I'm still looking for the most efficient solution well away from the house. I'm currently playing with a cellular game camera, which is not bad, as it sends alerts as soon as it's triggered, the reception is good, and I have the optional solar battery pack, which has yet to drop below 80%, even through this Winter. It's $10/mo per camera though, with an unlimited data/camera plan starting at $30/mo.

[cordex]

I use a Lorex system which is hardwired PoE (one network cable per camera providing data and power). The cameras are 4K.

[HankB]

I'm moderately surprised that nobody has yet come up with a software fix to securely encrypt and "privatize" the information collected by some of these systems.

Interestingly enough, several years ago one of my banks send me a couple of small, sliding "shutters" which I could stick on my webcam to physically block the lens in case of a hack. So my webcam is normally blocked, and I only slide open the shutter on the rare occasions that I'm using skype or some other video service.

[dogmush]

I'm moderately surprised that nobody has yet come up with a software fix to securely encrypt and "privatize" the information collected by some of these systems.

People have, but you lose the cloud storage and easy remote notifications of the Ring/Blink systems.  Without those features you just have some kinda expensive, not very good, webcams, so if you wanted to go that route, it's cheaper and easier just to by the non 3rd party networked cameras in the first place and set up your own system.

[Bogie]

Every so often, I do my special dance, just in case someone is watching...
 
And... Try saying this: "Alexa, talk dirty to me."

[charby]

I won't install a Ring or a Nest, or similar that can be accessed remotely.

I don't trust Chinese tech, not that I have anything to hide, but I'm concerned that they have a backdoor hard coded in the hardware and can use all of our devices to cause a DOS attack someday.

[HeroHog]

5 IP cameras on a password protected (MY Password) and firewalled net.
3 Wired cams in our car.
NO cameras in the house at this time.

[MechAg94]

I'm moderately surprised that nobody has yet come up with a software fix to securely encrypt and "privatize" the information collected by some of these systems.

Interestingly enough, several years ago one of my banks send me a couple of small, sliding "shutters" which I could stick on my webcam to physically block the lens in case of a hack. So my webcam is normally blocked, and I only slide open the shutter on the rare occasions that I'm using skype or some other video service.

A small strip of electrical tape works well for the laptop web cam also. 

[K Frame]

Reason 3,492,867 why I will NOT have any of this home automation stuff in my home.

I thought long and hard about getting a smart TV, but finally did as my old TV was going out and it's virtually impossible to find a dumb TV anymore.

[HankB]

People have, but you lose the cloud storage and easy remote notifications of the Ring/Blink systems.  Without those features you just have some kinda expensive, not very good, webcams, so if you wanted to go that route, it's cheaper and easier just to by the non 3rd party networked cameras in the first place and set up your own system.

Couldn't they "pre-encrypt" the images and then just store the encrypted files on cloud storage? (I'm not a programmer, so I don't know how hard this might be.)

A small strip of electrical tape works well for the laptop web cam also. 

After a scandal where a "school issued" laptop's camera was accessed by school officials after hours - leading to the wrongful accusation of drug use by a student - I heard this tape trick was being used as SOP by a great many students . . . and that some administrators weren't happy about it.

[cordex]

Couldn't they "pre-encrypt" the images and then just store the encrypted files on cloud storage? (I'm not a programmer, so I don't know how hard this might be.)

Of course.  Pre-encryption or multi-key encryption are just two options.

The problem ultimately is one of usability.  When users inevitably forget their passwords they don't want to lose their data forever.  If the provider can reset your password and restore your access without you having to provide some sort of code or key then any barriers to them accessing your data are simply procedural, not technical.

[dogmush]

Couldn't they "pre-encrypt" the images and then just store the encrypted files on cloud storage? (I'm not a programmer, so I don't know how hard this might be.)

Sure, not that big a deal.  You could get the cameras, jail break them, flash a new OS that works with your secure network of choice and rock on, but why bother?

As webcams, Ring/Blink are kinda expensive.  If you are going to go to the trouble of removing all the functionality that the preconfigured cloud set up brings.....just by some webcams and save a bunch of money.  There's just not much market to secure the commercial cloud systems, because folks that don't want that functionality just buy cheaper cameras.