So Wait, People Seriously Think Bill Barr Will Rein In Tech Monopoly Power?

from the ill-communication dept

So we've noted for a while how while a lot of the anger against "big tech" is certainly justified, there's a sizeable segment of this growing DC chorus that's being quietly orchestrated by telecom giants. Companies like AT&T, Verizon, and Comcast just effectively convinced the FCC to self-immolate, dismantling huge swaths of its broadband consumer protection authority (what could go wrong?). At the same time, the DOJ and FCC have been rubber stamping every terrible telecom merger than comes down the pike. When it comes to telecom monopolies, you'll hear nary a peep from the Trump administration.

Contrast that to the GOP and Trump administration's sudden, breathless interest in "big tech" monopolies. In case you'd missed it, top telecom lobbyists have spent the last two years pushing ironically for a massive regulatory crackdown on "big tech" companies. For example Mike Powell, former FCC boss turned top cable industry lobbyist, put it this way at a 2018 appearance at an industry trade event:

"Our governmental authorities need to get a handle on what kind of market power and harm flow from companies that have an unassailable hold on large pools of big data, which serve as barriers to entry, allowing them to dominate industries throughout the economy," he said. "For years, big tech companies have been extinguishing competitive threats by buying or crushing promising new technologies just as they were emerging. They dominate their core business, and rarely have to foreclose competition by buying their peers. Competition policy must scrutinize more rigorously deals that allow dominant platforms to kill competitive technologies in the cradle," he added."

So you'll notice here that telecom is accusing big tech of all the things telecom routinely engages in, from buying competitors to stifle competition, to laying claim to massive troves of consumer data with little accountability or oversight. This bizarre asymmetrical policy positioning, where Silicon Valley monopolies are bad but telecom monopolies apparently don't exist, has since become a DC mainstay, as reflected by the positions of folks like Josh Hawley and Marsha Blackburn. Neither have so much as mentioned telecom in passing in their conversations about monopoly power, and the latter of the two has literally never seen an AT&T policy proposal she didn't support.

Enter Bill Barr, the former Verizon General Counsel who spent years helping Verizon crush competitors, violate privacy and wiretap law, and generally engage in all the kind of behaviors he's now supposedly policing. On that end, reports this week emerged stating that Barr has slowly been taking control of numerous antitrust inquiries at the DOJ from DOJ antitrust boss Makan Delrahim:

"Barr has centralized oversight of antitrust matters under a handful of appointees in his office and that of his deputy attorney general, Jeffrey Rosen. Those moves have sidelined the Antitrust Division’s current leadership, headed by Assistant Attorney General Makan Delrahim, who for the past year has been the public face of DOJ’s investigations into Silicon Valley’s treatment of its users and customers."

Delrahim of course flubbed the AT&T Time Warner lawsuit, which I still believe had more to do with pleasing Rupert Murdoch and pissing off CNN than any serious concern about monopoly power. Such concerns are violently out of character for the Trump administration, which only seems to embrace such rhetoric when it serves a political purpose (see: the nonexistent censorship of Conservatives). Delrahim also just came under fire recently for rubber stamping the controversial Sprint T-Mobile merger in some very problematic ways, tying himself in knots to approve the competition-eroding deal.

On one hand, you could believe that Barr suddenly and uncharacteristically cares about monopolies and is engaged in a good faith effort to more seriously police them, as Matt Stoller suggests here:

"He has an understanding of what it’s like to be in competition with these monopolists. He understands what’s at stake,” said Matt Stoller, director of research at the American Economic Liberties Project, an anti-monopoly nonprofit.

“I have more faith in Barr than in Delrahim,” added Stoller, though he still predicted that Barr and the DOJ would bring a narrower antitrust suit against the tech platforms than he believes is warranted.

The problem with this claim is Barr has never, in history, shown the slightest interest in seriously reining in monopoly power, as his time at Verizon makes pretty clear. It's far more likely that Barr's interested in using the DOJ's antitrust enforcement authority as a political and personal blunt weapon. Notably to help this administration's BFFs in the telecom sector wage regulatory war on companies they (not at all coincidentally) are trying to erode video ad market share from. It's similar to the way that Ajit Pai has bizarrely demonized Netflix while just completely ignoring much worse problems in telecom.

As Mike noted in a recent interview with Mathew Ingram, it's also very likely Trump sees these inquiries as a great way to gain leverage in efforts like his misguided war on encryption:

"In reality, Barr has been (misleadingly) complaining about encryption to support his authoritarian impulses to want to have access to all information. This has never been the way the world works, and thanks to technology, law enforcement already has more access than ever to most information about people. The real goal here for Barr was just to use 230 as a wedge to try to break encryption."

There's really been zero evidence to suggest most of these "big tech" inquiries at the DOJ are being seriously conducted in good faith. In fact there's ample evidence the wheels of DOJ antitrust enforcement have been hijacked for what has often been bizarre and petty vendettas on behalf of Trump. But sure, a guy who spent years propping up US telecom monopolies and has never shown the slightest genuine interest in the problems monopolies cause is just the guy to finally fix the nation's longstanding monopoly problems, why not.

Filed Under: antitrust, big tech, competition, doj, fcc, makan delrahim, michael powell, telcos, william barr
Companies: amazon, apple, facebook, google, verizon

Turns Out Most People Still Don't Hate 'Big Internet' As Much As Politicians And The Media Want Them To

from the these-things-make-our-lives-better dept

"The narrative" over the past few years concerning internet companies has clearly shifted. It went from one that generally praised the wonders and power of the internet to one that now blames the internet for everything. The hagiographc coverage of the past clearly went too far, but the current "techlash" seems to have gone way too far in the other direction as well -- much of it from people grasping at straws over why things they don't like have happened in the world. The good folks over at The Verge have done a big consumer survey of people's general opinions of various big internet companies and it shows that most people still like these internet services, and believe, on the whole, that they make their lives better, not worse. Even the services that get the "worst" grades, still get over a 60% "favorable" rating, while Amazon, Google, YouTube, Netflix, Microsoft, and Apple all come in over 80% positive (with Amazon, Google, and YouTube breaking 90%).

A separate question asked how people view these companies' impact on society, and again, they are mostly positive -- and even in the cases where there is some level of negativity (mainly: Facebook, Instagram, and Twitter), the positive feelings greatly outweigh the negative:

There are many more fascinating findings and I recommend checking out the full Verge story on this, though I will note a bit of generational shock, as someone who lived through the 90s era of everyone in tech absolutely hating Microsoft and not trusting the company one bit, to Microsoft now being listed as the company that people trust the most with their data. Times sure have changed.

Still, as the general narrative -- and a lot of political rhetoric -- is focused on how awful these companies are and how "something must be done" about them, it does seem worth noting that most of the public seems to really like these services and feel the world is a better place because of them.

Now, take that information and compare it to just how little people trust companies in the telecom sector, and you might wonder why none of the narrative seems to focus on those companies. Indeed, the only political pressure on those companies seems to be to get them to merge and consolidate faster. Also, I should note that as fond as people are of repeating the silly and misleading line that "if you're not paying for it, you're the product," compare the levels of trust between all of these free internet services (very high) and the telco services you pay for (very low), and perhaps realize that it's not the "free" or "not free" part that engenders trust.

Filed Under: big internet, big tech, consumers, narrative, techlash, users
Companies: amazon, apple, facebook, google, microsoft, twitter, youtube

Ring Continues To Pitch Facial Recognition To Law Enforcement While Claiming It Won't Be Adding Facial Recognition To Its Cameras

from the boths-sides-of-mouth-fully-operational dept

Ring continues to insist it is not adding facial recognition to its sadly super-popular doorbell cameras. Its insistence is suspect for several reasons.

First, it employs a "Head of Facial Recognition Tech" at its Ukraine office. A company that isn't planning to add facial recognition doesn't need anyone in charge of tech it's not planning on using.

Second, its lengthy answers to Congressional questions stated that the company would continue to develop and explore other options in response to "customer demand." If enough customers express an interest in facial recognition, Ring would be stupid not to add that to its list of features, even if it has spent months denying it ever plans to do so.

Third, its answers to direct questions about facial recognition software are anything but direct. Cyrus Farivar of NBC News asked Ring about this feature after receiving something that indicated otherwise from a public records request. The response sounds firm but really isn't.

Morgan Culbertson, Ring spox, emailed:

"The features described are not in development or in use, and Ring does not use facial recognition technology…"

This sounds definitive but Ring's pitch to cops -- obtained by Farivar -- says something different:

At the 1:30 mark, the video says the company is working on future versions that will include "suspicious activity detection and person recognition."

How does the company reconcile this pitch to law enforcement with its public statements on the subject? It can't. So, it doesn't. Farivar's questions to Ring about this video went unanswered.

Maybe the explanation is that Ring isn't planning to add it to its consumer products but is developing something for law enforcement to apply to footage via its portal. This would allow Ring to continue to claim it's not adding facial recognition software to its cameras while still making use of its "Head of Facial Recognition" person.

But there's also no reason to believe Ring is being honest about any of this. Like any company under the x-ray, it will say what serves it best right now even if it means rolling back those quasi-promises the minute Ring feels it can get away with making its products even more problematic.

Filed Under: doorbells, facial recognition, law enforcement, police
Companies: amazon, ring

Ring Says It Helps Cops Fight Crime But The Data Shows It's No Better At This Than Any Other Security Camera

from the and-its-competitors-aren't-dragged-down-by-law-enforcement-baggage dept

The number of law enforcement agencies Ring partners with continues to grow -- up to nearly 900 by the latest count. Ring pitches its devices to homeowners as a better way to keep their homes secure. And maybe it is. But the pitches it makes to law enforcement agencies are something else.

Ring drives this particularly questionable engagement by insinuating people who've received free or cheap cameras will become part of a surveillance network overseen by cops, who will be able to solve tons of crimes and receive tons of footage from compliant recipients without a warrant.

None of this appears to be happening. While homes with Ring cameras are arguably more secure, the same could be said for any consumer camera -- most of which aren't handed to homeowners by law enforcement. A recent report by Cyrus Farivar for NBC News shows there's not much crime being solved by the vast network of Ring cameras and the company's hundreds of law enforcement partners. (via Jeffrey Nonken in the Techdirt chat window)

Thirteen of the 40 jurisdictions reached, including Winter Park, said they had made zero arrests as a result of Ring footage. Thirteen were able to confirm arrests made after reviewing Ring footage, while two offered estimates. The rest, including large cities like Phoenix, Miami, and Kansas City, Missouri, said that they don’t know how many arrests had been made as a result of their relationship with Ring — and therefore could not evaluate its effectiveness — even though they had been working with the company for well over a year.

The extensive agreements with Ring -- ones that allow the company to write press releases and veto law enforcement statements it doesn't like -- apparently don't require any sort of data gathering or reporting that would tie Ring cameras to arrests. The report says none of the 40 departments contacted collect data that might indicate whether or not the increased installation of cameras has reduced crime or resulted in more arrests.

Ring cameras may be everywhere, but their contribution to combating crime is apparently no greater than its competitors. Any other camera company could boast it's contributed just as much as Ring has, all without blurring the line between public and private by aggressively courting law enforcement agencies. The list of criminals taken down by Ring footage reads like a small town paper's police blotter:

Of the arrests that police connected to Ring, most were for low-level non-violent property crimes, according to interviews and police records reviewed by NBC. These arrests detailed the theft of a $13 book, the theft of a Nintendo Switch video game console (and several items, including two coffee mugs, purchased from the Home Shopping Network valued at $175. In Parker County, Texas, two people were arrested for allegedly stealing a dachshund named Rufus Junior, valued at $200.

These are the success stories. And that's from agencies that actually have success stories to relate. Most don't have anything to talk about or are only reporting a very small number of arrests in relation to their cities' overall property crime rate.

But it has opened a dialog of sorts between citizens and law enforcement. Some people view their cameras and the law enforcement portal as a "may I speak to the manager" connection.

Ring makes it so frictionless to share footage with police that some residents submit videos of anything they find displeasing, even when there is no indication that a crime has been committed, Lt. Santos, of Winter Park, said.

“We’ve gotten videos of racoons in the yard, with people saying, ‘Hey, can you deal with these racoons?’” he said. “That’s the type of people we’re dealing with. They’re constantly sending us video clips.”

Ring continues to insist its hundreds of law enforcement partnerships makes citizens safer. But outside of a handful of arrests related to small property crimes, there's nothing in the data that suggests the thousands of cameras and hundreds of partnerships has actually increased public safety.

Filed Under: doorbells, law enforcement, overhype, policy, ring, security
Companies: amazon, ring

Xbox Chief Says Its Main Competitors Are Now Google, Amazon Rather Than Sony, Nintendo

from the not-so-sure dept

There are great rivalries in this world. The United States and Russia. The Yankees and the Red Sox. All of us and our mothers-in-law. And, in the gaming space for over a decade, there has been Microsoft and Sony. Since the Playstation 2 v. Xbox iteration of this, Sony and Microsoft have gone head to head in the console wars, with Nintendo also filling in some more niche-style gaming needs. The last battle in this war, the Playstation 4 v. the Xbox One, quite famously went in Sony's favor, with Microsoft having a disastrous pre-launch PR nightmare and sales numbers that ultimately saw Sony never once trailing its chief rival.

And yet, as Sony has announced its forthcoming Playstation 5 console, the man in charge of Microsoft's Xbox product recently stated that Google and Amazon are its competitors now, not Sony and Nintendo.

Microsoft’s head of gaming and Xbox, Phil Spencer, has revealed that the company sees Amazon and Google as its main competition for the future. Speaking in an interview with newly launched technology publication Protocol, Spencer dismisses Sony and Nintendo’s ability to create a cloud infrastructure that will challenge Microsoft, Google, or Amazon.

“When you talk about Nintendo and Sony, we have a ton of respect for them, but we see Amazon and Google as the main competitors going forward,” says Spencer. “That’s not to disrespect Nintendo and Sony, but the traditional gaming companies are somewhat out of position. I guess they could try to re-create Azure, but we’ve invested tens of billions of dollars in cloud over the years.”

This, of course, all revolves around game streaming services and gaming-as-a-service platforms. Spencer appears to indicate that such services are the way gaming will be done in the near future and Microsoft is somewhat uniquely positioned among the traditional console rivals to dive into that market, with the built out Microsoft Azure platform backing them. Sony and Nintendo aren't likely to be able to build out their own infrastructure to rival Azure, and would instead have to partner with another company. Except that Amazon and Google are the likely candidates for that and Google has its own Stadia product in place, despite its ongoing problems.

But the real question is: Is Spencer right to bet on game streaming as the wave of the future? There are real roadblocks in its way. Google is not without resources and its Stadia product both hasn't lived up to expectations and has poisoned the well to at least some extent with the public. Those bad impressions may not last forever, but certainly it doesn't look like game streaming is going to be ready for prime time in this console cycle. Add to that the woeful state of broadband internet in America, not to mention how a lack of competition has allowed providers to put data caps in place, and you very quickly have to wonder if game streaming has an underlying American infrastructure problem that it can't possibly solve.

You have to wonder too if Spencer is hedging his bets with all of this in preparation for losing yet another battle in the current console wars.

Cloud gaming still seems like it’s in the distant future, especially as Sony and Microsoft prepare to launch the traditional PlayStation 5 and Xbox Series X consoles later this year. Both next-generation consoles will go head-to-head throughout the important holiday season, and Nintendo is still seeing positive growth with its Switch sales, thanks to the new Switch Lite.

If past is prologue, you would expect Sony to rush into the next battle in a strong position compared with Microsoft. If that occurs, Spencer probably better be right if he's going to bet on game streaming.

Filed Under: competition, playstation, stadia, streaming, video games, xbox
Companies: amazon, google, microsoft, nintendo, sony

Ring Updates Privacy Dashboard Again, Allows Users To Preemptively Block All Law Enforcement Requests For Footage

from the 'get-a-warrant'-functionality dept

After months of negative publicity, Ring is finally taking a few small steps towards not being completely awful. The company clearly would rather be a government contractor than a supplier of consumer products, but has repeatedly gotten in its own way by selling products to consumers rather than surveillance tech to government agencies.

Trying to have it all, Ring welcomed police departments into the fold, offering steep discounts on cameras to agencies that played along with its PR pitches and distribution tactics. Citizens could get cameras for almost nothing from local cops with the implicit suggestion they share their recordings with cops whenever law enforcement asked.

That was the initial wave of bad press: the co-opting of police departments to turn consumer security cameras into extensions of law enforcement surveillance networks. The second wave was almost worse. It involved the hijacking of Ring cameras by malicious jerks who used lists of credentials taken from security breaches to take control of the connected devices.

Ring shifted the blame for these hijackings to the end users. While Ring does encourage the use of "strong" passwords and two-factor authentication, it did not -- until recently -- make either of these the default. A recent update to its "privacy dashboard" finally allowed users to easily control access to their cameras by providing lists of all IP addresses/devices currently logged in. It also nudged users in the direction of 2FA a bit more firmly, making this opt-out, rather than opt-in.

The latest update goes further. And it must have been painful to implement, since it undercuts part of the company's sales pitches to law enforcement agencies. Ring has played up the advantages of cops handing cameras to citizens, creating portals that give officers maps of Ring camera locations and coaching cops on the finer points of obtaining footage without a warrant. This addition to Ring's privacy dashboard is going to make it a bit more difficult for cops to bypass the warrant process when seeking to obtain camera footage from Ring users.

In the new update, users will be able to see an "Active Law Enforcement Map" clarifying which local institutions are part of the Neighbor Portal network. They will also be able to disable requests for video from officials, whether or not they have received one in the past. (This feature was available previously, but an account had to have received one request for the opt-out option to appear.)

Ring's blog post on the dashboard update not-so-subtly hints that users shouldn't do this by telling readers about a couple of times the video request tool was used to solve crimes. Even if this PR nudge proves ineffective, cops aren't completely out of luck. Ring is happy to turn over footage stored in its cloud to law enforcement without notifying users, even as it claims this footage still belongs to the end users.

This is a move in the right direction for Ring. Unfortunately, it still seems focused on becoming an appendage of law enforcement, rather than a producer of consumer goods. As long as it spends more time trying to figure out how it can best assist government middlemen, it's going to keep disappointing the actual users of its cameras.

Filed Under: doorbell, law enforcement, preferences, privacy, ring, ring doorbell, surveillance
Companies: amazon, ring

Amazon Tells Ukraine Publication To Alter Its Article After It Links The Company To Ring's Problematic Ukraine Branch

from the burnt-by-your-own-source dept

An extremely-problematic wing of an extremely-problematic company is back in the news. Ring's Ukraine division made headlines last fall when the presence of a "Head of Facial Recognition Tech" in the Ukraine office appeared to contradict Ring's claims it was not interested in adding facial recognition to its cameras.

More disturbing news surfaced earlier this month, when it was discovered this office had allowed its employees to view Ring camera footage uploaded by users. Ring doesn't just produce doorbell cameras. It also sells in-home cameras, making this revelation particularly worrying.

Beginning in 2016, according to one source, Ring provided its Ukraine-based research and development team virtually unfettered access to a folder on Amazon’s S3 cloud storage service that contained every video created by every Ring camera around the world. This would amount to an enormous list of highly sensitive files that could be easily browsed and viewed. Downloading and sharing these customer video files would have required little more than a click. The Information, which has aggressively covered Ring’s security lapses, reported on these practices last month.

Not only did the R&D team have complete access to customers' recordings, so did Ring's US-based engineers and executives. And who knows how many other people have accessed these recordings illicitly? When this access was granted to an untold number of Ring employees, Ring did not encrypt uploaded recordings. The company apparently felt encryption was too expensive to implement and would possibly limit revenue opportunities for the company as it aggressively moved into the home security market.

It turns out the company was using customers' footage to train its AI to recognize faces and other objects. This would be the same facial recognition Ring swears it isn't going to be implementing anytime soon.

Apparently, this abuse of trust has resulted in growth opportunities for Ring-Ukraine. A recent article by Ukranian publication Vector stated the office would be lending its expertise to other Amazon products, which possibly includes Rekognition, Amazon's homegrown facial recognition program.

But that story was buried by Amazon PR shortly after it appeared, according to Sam Biddle of The Intercept.

I asked multiple Amazon representatives and Ring’s head of communications about the Vector article, including specifically what were the “many other Amazon projects” Ring’s Ukrainian staff now worked on.

Although Amazon ignored repeated requests for comment and Ring refused to discuss the subject on the record, it seems that the company did take action: Within hours of my inquiries, the text of the Vector piece was quietly edited to remove references to Amazon. Most notably, the entire quoted sentence about the “many other Amazon projects” the Kyiv office was working on was excised.

The author of the story told The Intercept he had nothing to do with the belated deletion. In fact, he was not aware of any editing until The Intercept brought it to his attention. An email from Vector's editor-in-chief explained the situation, although not all that satisfactorily.

We published a news about rebranding, later pr-manager of Ring Ukraine called me and asked to take Amazon mention out from the article. Since I had a good relationship with manager, the article got just several dozens of views and I understood that everyone know that Ring is part of Amazon anyway, I didn’t even asked questions, said ok and took Amazon part out

It appears Amazon doesn't want people to know it has given a problematic division even more responsibility. It also may be trying to head off another Ring-related PR nightmare by removing any text that might suggest Ring customer recordings are being used to train facial recognition software used by government agencies.

But it's too late to change public perception. The scrubbing may keep Amazon from being linked to unfettered access to Ring camera recordings in search results, but there's no separating Amazon from Ring. And there's nothing here that suggests either company is moving away from leveraging user-generated content to fine-tune AI for the customers they really want: law enforcement agencies.

Filed Under: journalism, ring, ukraine
Companies: amazon, ring

Ring Throws A Moist Towelette On Its Dumpster Fire With A Couple Of Minimal Security Tweaks

from the [yelling-over-the-roaring-flame]-WE-CARE-DEEPLY-ABOUT-OUR-USERS dept

Things have gotten worse and worse for Amazon's Ring over the past several months. Once just the pusher of a snitch app that allowed city residents to engage in racial profiling from the comfort of their homes, Ring is now synonymous with poor security practices and questionable "partnerships" with hundreds of law enforcement agencies around the nation.

Ring owners recently discovered how easily their cameras could be hijacked by assholes with no moral compass and too much time on their hands. Using credentials harvested from security breaches, online forum members took control of people's cameras to entertain a podcast audience who listened along as hijackers verbally abused Ring owners and their children.

Ring is now being sued for selling such an easily-compromised product. Ring's response to the original reports of hijackings was to blame customers for not taking their own security more seriously. Ring does recommend two-factor authentication but that's about all it does. It does not inform users when login attempts are made from unrecognized IP addresses or devices, and does not put the system on lockdown after a certain number of failed attempts are made.

Yes, users should use strong passwords (and not reuse passwords), but blaming customers for engaging in behavior most customers will engage in is unproductive. Instead of making two-factor authentication a requirement before deployment, Ring has just repeatedly pointed to its prior statements about its "encouragement" of 2FA -- an "encouragement" that is mostly comprised of defensive statements issued in response to another negative news cycle.

Since it can't keep blaming its millions of customers for its own failings, Ring is taking a very, very small step in the direction of actually taking its customers' security seriously. [Please hold your tepid applause until the end of the announcement.]

Ring has announced that it is adding a new privacy dashboard to its mobile apps that will let Ring owners manage their connected devices, third-party services, and whether local police partnered with Ring can make requests to access video from the Ring cameras on the account. The company says that other privacy and security settings will be added to the dashboard in the future. This new Control Center will be available in the iOS and Android versions of the Ring app later this month.

It's barely enough to make any one feel whelmed, much less overly so. There are two small additions that put this ahead of what Ring offered prior to the newsworthy camera hijackings. First, the app will allow users to see who's logged in at any given time and logout unrecognized IP addresses or locations from within the app.

The second addition finally puts some (baby) teeth into Ring's 2FA recommendation:

[R]ing is continuing to inform its customers of the importance of two-factor authentication on their accounts and will be making it an “opt-out” thing for new account setups, as opposed to the opt-in setup it currently is.

Swell. So that's kind of… fixed. I guess. Now Ring just needs to work on all the other problematic things about itself, like the fact that it's still not going to notify users when new IP addresses, devices, or locations attempt to access their cameras. And it's not going to stop using cop shops as Ring marketing street teams. And for all of its insistence footage is never handed over to cops without the proper paperwork, it still deals from the bottom of the deck by claiming end users own all their footage even as it's handing this footage to law enforcement without the end user's permission or involvement.

Ring has a lot to fix if it's ever going to make its way out of the PR pit it's dug for itself. This is something, but it's just barely something. It's not enough. And it says Ring still isn't serious about protecting its customers -- not from law enforcement and not from malicious idiots who've found a new IoT toy to play with.

Filed Under: cybersecurity, dashboard, doorbells, police, ring doorbell, security
Companies: amazon, ring

Shocking Absolutely No One, Ring Admits Employees Improperly Accessed Customers' Data

from the who-could-have-seen-this-coming dept

Ring never fails to disappoint. And by "disappoint," I mean never fails to be disappointing. This pleases me. So, I guess Ring never fails to please… by being incessantly disappointing.

I realize this is beginning to resemble a beating that continues long past the point the victim has lapsed into unconsciousness. But if Ring hadn't made itself such an inviting punching bag, I would not continue to rain down printed blows on its oh so very soft body.

Ring first grabbed our attention by offering up a snitch app that encouraged neighbors to start talking about suspicious people in their neighborhood. This app also happened to be a portal for the voluntary sharing of footage captured by Ring cameras, most of which were built into Ring's "smart" doorbells.

From there, things went from bad to worse to godawful to horrendous to PR-team-on-constant-suicide-watch. It has been super-enjoyable for me (and hopefully for Techdirt readers) for two reasons:

1. Ring promiscuously got in bed with over 600 law enforcement agencies, selling them "free" cameras to hand out to homeowners with some implicit/not-so-implicit strings attached. In return, law enforcement agencies gave up their authority and autonomy, granting Ring permission to write their press releases and statements for them.

2. Ring does not care about its customers. It enjoys a commanding lead in the market, but it has produced yet another internet-connected thing that it does not bother to secure properly. When breaches happen -- and they are unimaginably horrifying breaches that involve hijacked cameras -- the company says customers should have done more to secure their devices, rather than accept any responsibility for doing as little as possible to prevent this sort of thing from happening.

So, the latest news is more fuel for the dumpster fire. It's not just cops grabbing footage without bothering with the Fourth Amendment niceties. There's also abuse happening internally -- the sort of abuse you'd expect when you give people access to a wealth of personal information.

The doorbell-camera giant Ring has terminated employees in recent years for improperly accessing users’ video data, parent company Amazon told lawmakers this week, an admission that could increase pressure on the firm to prove it protects customer privacy.

The company has investigated four complaints regarding employees abusing their access to camera data over the past four years, Brian Huseman, a vice president of public policy at Amazon, wrote in a letter to five senators this week.

The company did not provide any detail about the data that was improperly accessed, but considering how much data Ring collects -- along with footage from millions of cameras -- the imagination is free to run wild.

This is the latest unsurprising development for Ring. Give enough people access to intimate recordings and data, and abuse is bound to happen. Maybe the Ring employees were just following the lead of their law enforcement partners, who also have access to a great deal of personal info and abuse this access with alarming frequency.

I'm sure Ring will weather this news cycle as it has every other over the past 12 months: by claiming it takes everyone's security seriously and sending out tweets to anyone tagging the company with the latest bad news saying the coverage is inaccurate. But no one believes Ring, especially when its defensive tweets talk their way around direct questions and link to talking points delivered by Ring reps.

Ring is no longer just a dumpster fire d/b/a a security camera company. Its flaming dumpster existence is mounted to every flatbed car on a never ending train wreck. It can't pull the plug on its thousands of buddy cops. And it appears to be far more interested in market growth than properly serving the customers it already has. Things will get worse. That's it. There's no "before it gets better." At best, Ring can only hope to fade from the public eye before it alienates any more of its past and future customers.

Filed Under: abuse, doorbells, employees, police, surveillance, video
Companies: amazon, ring

Ring Sued Because 'Taking Customers' Security Seriously' Means Selling Easily-Hijacked Cameras

from the DUMPSTER-FIRE-2019-???? dept

Amazon's Ring has been uniformly terrible ever since it decided its primary market (homeowners) should be treated with less care and concern than the market it's actually courting and subsidizing (law enforcement agencies).

Since it's not really in the customer service business anymore, the end users who thought they were buying some security and peace of mind have discovered they've actually become part of a law enforcement surveillance network run by a company that doesn't really seem to be in the security business.

A group of forum members found Ring cameras incredibly easy to hijack. Running scripts utilizing lists of credentials harvested from the web's many security breaches, some sociopathic idiots were able to brute force their way into taking control of devices. Their favorites were the ones equipped with mics, where they could verbally abuse and taunt unsuspecting Ring owners for the enjoyment of their podcast audience. (I really wish I were making that last part up but this is the internet we have.)

When the news cycle of "hacked" Ring cameras began, Ring was quick to point out this wasn't its fault. To a certain point, Ring is right. Ring says it encourages the use of two-factor authentication and strong passwords. Great. So do lots of IoT device makers. But very few are actually forcing their users to engage two-factor authentication prior to allowing the connected device to go "live" on the web. Ring isn't doing this either.

It's even worse in Ring's case. Ring says it's the customers that are wrong, but it does absolutely nothing to prevent this sort of hijacking. There's no lockout after a certain number of failed logins. No warnings are sent to owners about logins from unrecognized devices or IP addresses. Repeated failed login attempts aren't flagged as suspicious. For a company supposedly in the security business, this is a pretty insecure way to run a business.

It's this latest insecurity that's getting the company sued.

Amazon and its home security subsidiary Ring are facing a federal lawsuit in California over allegations that its "lax security standards" led to a series of invasive and frightening hacks over the past year.

The lawsuit, which alleges Ring security cameras have been hacked six times across the U.S., comes as Amazon's Ring faces a barrage of scrutiny from lawmakers, privacy advocates and the public over its cybersecurity standards and widespread partnerships with local police departments.

The lawsuit [PDF], filed by a victim of just such a "hacking" hopes to become a class action when it's all grown up and fully-represented. Until then, there's this incident, which happened to the plaintiff.

Plaintiff John Baker Orange is a resident of Jefferson County Alabama. He purchased a Ring outdoor camera for his house in July 2019 for approximately $249.00. The Ring camera was installed over his garage with a view of the driveway. Mr. Orange purchased the Ring camera to provide additional security for him and his family which include his wife and three children aged 7, 9, and 10. Recently, Mr. Orange’s children were playing basketball when a voice came on through the camera’s two-way speaker system. An unknown person engaged with Mr. Orange’s children commenting on their basketball play and encouraging them to get closer to the camera. Once Mr. Orange learned of the incident, he changed the password on the Ring camera and enabled two-factor authentication. Prior to changing his password, Mr. Orange protected his Ring camera with a medium-strong password.

Orange alleges that Ring did almost nothing to protect its customers while promising its products will protect its customers.

Unfortunately, Ring does not fulfill its core promise of providing privacy and security for its customers, as its camera systems are fatally flawed. The Ring system is Wi-Fi enabled, meaning that it will not work without internet connectivity. Once connected, however, any internet device can be seen by the on-line community, making it incumbent upon its manufacturer to design the device such that it can be properly secured for only intended use. This obligation is even more critical in instances where the device, like the Ring camera, is related to the safety and security of person and property.

Ring failed to meet this most basic obligation by not ensuring its Wi-Fi enabled cameras were protected against cyber-attack. Notably, Ring only required users enter a basic password and did not offer or did not compel two-factor authentication.

He's not wrong. Security is pretty much an afterthought for this security company. It likes to put its resources into pitching its products to cops, who can then hand the flawed products to citizens in exchange for possible glimpses of camera recordings in the future.

But is it enough to win a lawsuit? The plaintiff alleges negligence and a few other related torts, but he'll have to prove Ring deliberately sold a product it knew was insecure. Ring is probably aware of the lack of built-in security, but is it more deliberately negligent than any other IoT device maker that decides to dumb down security options to increase adoption and marketshare? And if it's just as terrible as its competitors, should that be enough to allow it to escape a lawsuit?

Maybe this one will hit Ring hard and force it and its competitors in the IoT marketplace to actually take the security of their customers seriously, rather than just saying that after their customers have already been compromised. Or maybe I just want Ring to get smacked around for pushing an insecure product on consumers with the assistance of over 600 law enforcement agencies. Ring has been an absentee landlord in its market, grabbing all the market share it can while leaving its millions of customers to fend for themselves when it comes to securing their devices properly.

Filed Under: doorbells, iot, lawsuit, ring, security
Companies: amazon, ring