Please Welcome The Los Angeles Police Department (Brought To You In Part By A Generous Grant From Ring)

from the RTs-are-possibly-endorsements dept

Amazon's doorbell-camera acquisition, Ring, has captured a large segment of the home security market. Part of its growth is due to its long list of law enforcement partnerships. Coupled with the rollout of its companion app, Neighbors, Ring has been handing out cameras to cops… who then hand out these complimentary cameras to local homeowners.

Strings are attached -- some explicit and some implicit. The implicit strings connect cops to citizens: the assumption recipients of discounted or free cameras will allow officers to access recordings without having to bother the courts with a warrant request.

The explicit strings tie up cops, making them brand ambassadors for Ring and its ever-expanding network of cameras. If cops want cheap cameras and the access to recordings those might provide, they have to become Ring's unofficial spokespeople.

Public records show Ring has required police departments to assign employees to act as press and social media liaisons in the new partnership with Ring. Ring controls PR efforts and public statements. It also dangles its wifi-connected carrot: more signups for Ring's Neighbors app means more free cameras for cops.

This unhealthy relationship between Ring and law enforcement is detailed in a recent LA Times article by Johana Bhuiyan. Thousands of dollars of cameras were handed out to LAPD officers in exchange for their promotion and distribution of Ring's products.

Ring provided at least 100 LAPD officers with one or more free devices or discount codes and encouraged them to recommend the company’s web-connected doorbells and security cameras, emails reviewed by The Times reveal. In more than 15 cases, emails show that officers who received free gadgets or discounts promoted Ring products to fellow police officers or members of the public.

Officers asked for cameras, passing them on to other officers, friends and family members, as well as local homeowners. As more devices were activated, Ring sent emails congratulating the most proactive officers and promising even more free gear if this continued.

This would be problematic even without potential violations of LAPD guidelines. This is Ring using a government agency as a distribution center and advertising agency. And this is a government agency willingly performing both of those tasks in exchange for even more Ring brand evangelism.

But this back-and-forth, along with exchanges of activations for more free products, seemingly violates the LAPD's policies. However, it appears Ring and the officers were cognizant of the guidelines and worked together to ensure they weren't violated.

LAPD rules restrict the acceptance of gifts that could be seen as an attempt to influence the actions of officers. After a preliminary review of the emails, the department said officers did not appear to have violated agency rules.

An agency spokesperson said that although accepting free devices and personally recommending those products to community members did not violate the LAPD code of ethics, a paid endorsement would run afoul of agency rules.

That isn't to say the actions of everyone involved were above-board and above reproach. Staying within the guidelines frequently meant straying right up to the edge of them. It also meant finding ways to influence officers to continue pushing Ring's products without crossing that line. It appears LAPD supervisors believe the only form of payment that's unacceptable is cash. Anything else -- no matter its effect on officers and their actions -- adheres to the letter of the law while mostly ignoring its spirit.

Here are few examples of Ring/LAPD interactions the LAPD considers to be acceptable:

Officer Eric Mollinedo from the Olympic division emailed Ring’s director of operations, August Cziment, asking for promo codes as well as information about receiving a unit for his home. Mollinedo said he’d be manning a booth at an upcoming public safety fair. Cziment said Ring would get him “going with flyers, as well as a unit.” Ring also provided Mollinedo a coupon code and encouraged him to distribute it to his colleagues.

[...]

Sgt. Justin Scott exchanged a series of emails with Cziment about an offer for a free stick-up camera. Ring asked him to share the offer with his entire West L.A. station. [...] Later that month, Scott ran promotional language by the company before sending it to fellow officers, emailing Cziment a block of text about the stick-up camera offer for his approval. Cziment replied, “Looks great! Keep me updated on how it all goes.”

In Scott's case, the free camera offer resulted in responses from 60 officers. Some asked for discount codes for themselves and family members. Others asked if they were still eligible for a prior Ring giveaway. Another officer approached Ring directly, asking for the "donation" of a free camera to be raffled off at a station social function. Ring obliged.

Ring has since abandoned its guideline-skirting "brand ambassador" program with the LAPD. These partnerships are still in place elsewhere in the nation. Ring has always been happy to tout its tight relationships with law enforcement agencies even though its cameras -- despite the company's hefty market share -- have done little to reduce crime rates. The company may have made some better decisions in recent weeks -- like requiring law enforcement requests for footage to be made publicly through its online portal -- but it's certainly not interested in slowing the spread of its product.

Ring has relied on law enforcement to expand its market base for years. It's not going to completely abandon that plan just because some of its more unseemly aspects have been exposed.

Filed Under: lapd, police, ring, sponsorship, surveillance, video doorbells
Companies: amazon, ring

Amazon Ring App Found To Be (Again) Exposing User Locations, Home Addresses

from the fool-me-once dept

While Amazon Ring and other doorbells certainly deliver a certain convenience, they've created no shortage of entirely new problems. Problems that could have been avoided with just a bit of foresight and ethical behavior. First comes the fact they're being integrated into our already accountability-optional law enforcement and intelligence apparatus. Then, like the rest of the "let's connect everything to the internet but do a shit job on basic security and privacy because it costs money" IOT sector, they can't be bothered to get the fundamentals right when it comes to consumer security.

The latest example involves Ring failing to adequately secure users information when they share to the Ring "Neighbors" portion of the Ring app. Journalists had already showcased how Ring's security standards were hot garbage. And while Amazon has taken some steps to address those concerns (like making two-factor authentication mandatory), this week it was revealed that Ring’s Neighbors app was exposing the precise locations and home addresses of users who had posted to the app:

"While users’ posts are public, the app doesn’t display names or precise locations — though most include video taken by Ring doorbells and security cameras. The bug made it possible to retrieve the location data on users who posted to the app, including those who are reporting crimes."

Whoops-a-daisy!

The disclosure comes on the heels of a similar report from Gizmodo last year that found it wasn't too difficult to ferret out hidden data allowing journalists (and anybody else) to map the location of Ring users nationwide:

"Examining the network traffic of the Neighbors app produced unexpected data, including hidden geographic coordinates that are connected to each post—latitude and longitude with up to six decimal points of precision, accurate enough to pinpoint roughly a square inch of ground."

Neat! Ring's already facing a class action lawsuit from users not particularly happy about receiving death threats and racist slurs after their Ring smart cameras were hacked.

Purportedly, Ring's Neighborhood functionality is generally supposed to help communities band together and discuss potential security threats. Kind of a neighborhood watch for the modern era. More often, however, the functionality results in people engaging in paranoid hyperventilation about minorities or homeless people getting a skosh too close to the azaleas.

If you're going to be earning additional billions from selling access to consumer residential cameras to intelligence and law enforcement every year, it seems like the very least you can do is invest a little bit more in taking consumer privacy and security seriously, even if "caring about consumers" and "selling their camera surveillance and location data to any nitwit with a nickel" operate somewhat discordantly.

Filed Under: doorbell, locations, privacy, ring
Companies: amazon, ring

FBI Horrified To Discover Ring Doorbells Can Tip Off Citizens To The Presence Of Federal Officers At Their Door

from the those-bastards-and-their-surreptitious-cameras dept

Ring's camera/doorbells may as well be branded with local law enforcement agency logos. Since Amazon acquired the company, Ring has cornered the law enforcement-adjacent market for home security products, partnering with hundreds of agencies to get Ring's products into the hands of residents. A lot of this flows directly through police departments, which can get them almost for free as long as they push citizens towards using Ring's snitch app, Neighbors, and allow Ring to handle the PR work.

So, it's hilarious to find out the FBI is concerned about Ring cameras, considering the company's unabashed love for all things law enforcement. The Intercept -- diving back into the "Blue Leaks" stash of exfiltrated law enforcement documents -- has posted an FBI "Technical Analysis Bulletin" [PDF] warning cops about the threat Ring cameras pose to cops. After celebrating the golden age of surveillance the Internet of Things has ushered in, the FBI notes that doorbell cameras see everyone who comes to someone's door -- even if it's people who'd rather the absent resident remained unaware of.

The document describes a 2017 incident in which FBI agents approached a New Orleans home to serve a search warrant and were caught on video. “Through the Wi-Fi doorbell system, the subject of the warrant remotely viewed the activity at his residence from another location and contacted his neighbor and landlord regarding the FBI’s presence there,” it states.

Ratted out by home security tech -- the kind often pushed on residents by law enforcement officers hoping to expand their surveillance networks by deputizing doorbells. Ring's cameras aren't just mute witnesses. Owners receive notifications when someone comes to their door and, depending on model, are able to hold conversations with them using built-in mics and speakers.

This means the sneak-and-peek feds might have been overhead discussing their tactical plans or specifics about the investigation. Hilarious. And this is how another FBI document on the subject of doorbells puts it, turning a normal home security device into a devious tool to be wielded against law enforcement:

“[S]ubject was able to see and hear everything happening at his residence” and possibly “covertly monitor law enforcement activity while law enforcement was on the premises…"

Covert monitoring is the best monitoring, as these FBI agents are well-aware. Sucks when it's the alleged perps doing the covert monitoring, I guess. And it sucks when the FBI decides now is the time to be hot and bothered when security cameras have been catching cops visiting/raiding properties for years. Audio recording isn't some new technology either, so if cops haven't been clued into this possibility already, they have no one to blame but themselves.

The documents are fascinating, and not just because they appear to turn Ring into a co-conspirator in crimes after so many years of being besties with law enforcement. It also shows how much goes unnoticed by people who routinely cite their years of training and experience when applying for search warrants. This should have been obvious from day one.

Filed Under: doorbells, fbi, ring, surveillance, warrants
Companies: amazon, ring

Ring Docs Show Company Is Testing Consumer Enthusiasm For Facial Recognition, License Plate Reader Capabilities

from the be-the-implemented-changes-you-want-to-see-in-the-world dept

It seems like Ring really wants to add facial recognition tech to its cameras. It employs a "Head of Facial Recognition Tech." It pitches this still-nonexistent feature to law enforcement. And it says it will "continue to innovate" to meet customer feature demands in response to Congressional queries about its facial recognition plans.

But now is not the best time to be trotting out new facial recognition products. Cities and one entire state have enacted bans or moratoriums on facial recognition tech use by government agencies. Even the leader in law enforcement body cams (Axon, formerly Taser) has pulled back from adding this tech to its products. So, Ring is playing it safe even if it's inevitably going to add this feature in as soon as it can justify it.

And it's looking for ways to justify it. Just like it promised Congress, it will continue to "innovate" by adding features customers say they want -- even if it's tech many feel is untrustworthy, if not possibly dangerous. A document obtained by Ars Technica shows the company is feeling out its newest customers on several potential features, including facial recognition.

Ring last week distributed a confidential survey to beta testers weighing sentiment and demand for several potential new features in future versions of its software. According to screenshots shared with Ars, potential new features for Ring include options for enabling or disabling the camera both physically and remotely, both visual and audible alarms to ward off "would-be criminals," and potential object, facial, and license plate detection.

The survey actually suggests two possible facial recognition tech uses: one alert for "familiar faces" and another for "unfamiliar." This feature would presumably be tied to a user-generated whitelist of "familiar" faces, rather than something maintained by Ring. But just as presumably, Ring would have access to user selections and recorded footage. Law enforcement agencies are already running obtained Ring footage through their own facial recognition programs, so this addition would just save them a little bit of time.

And, as noted above, Ring is pitching something new -- at least for its line of products: license plate recognition. This is a new development.

The company has also not publicly discussed any plans for potentially deploying object detection or license plate scanning technology. In the same letter, lawmakers asked Amazon if employees had access to "any previously tagged information in video feeds that specifically identify a person or vehicle," including specific license plate data; to that question, Amazon answered simply "no."

The survey doesn't actually call this "recognition." It calls it "license plate detection." This feature would send an alert to users if a vehicle's license plate is detected and readable by the camera. Again, this wouldn't be linked to any license plate database and would rely on whitelisting for "recognition," but it's still somewhat surprising to see a home security system offer this functionality.

It's not that license plate readers are unheard of in the residential sector. It's just that they're usually included in more expensive systems tied to lucrative 24/7 monitoring contracts. This would put some of that power in a doorbell camera, allowing Ring users to operate not-so-automatic license plate readers during their downtime.

Ring continues to claim it's just engaging in blue-skying with beta testers and has no immediate plans to implement either of these features. But it's not denying it has an interest in being a market leader in domestic surveillance tech and will follow the market wherever it's led… or wherever it nudges the market towards.

Filed Under: doorbells, facial recogntion, license plate readers, privacy, surveillance
Companies: amazon, ring

Ring Continues To Pitch Facial Recognition To Law Enforcement While Claiming It Won't Be Adding Facial Recognition To Its Cameras

from the boths-sides-of-mouth-fully-operational dept

Ring continues to insist it is not adding facial recognition to its sadly super-popular doorbell cameras. Its insistence is suspect for several reasons.

First, it employs a "Head of Facial Recognition Tech" at its Ukraine office. A company that isn't planning to add facial recognition doesn't need anyone in charge of tech it's not planning on using.

Second, its lengthy answers to Congressional questions stated that the company would continue to develop and explore other options in response to "customer demand." If enough customers express an interest in facial recognition, Ring would be stupid not to add that to its list of features, even if it has spent months denying it ever plans to do so.

Third, its answers to direct questions about facial recognition software are anything but direct. Cyrus Farivar of NBC News asked Ring about this feature after receiving something that indicated otherwise from a public records request. The response sounds firm but really isn't.

Morgan Culbertson, Ring spox, emailed:

"The features described are not in development or in use, and Ring does not use facial recognition technology…"

This sounds definitive but Ring's pitch to cops -- obtained by Farivar -- says something different:

At the 1:30 mark, the video says the company is working on future versions that will include "suspicious activity detection and person recognition."

How does the company reconcile this pitch to law enforcement with its public statements on the subject? It can't. So, it doesn't. Farivar's questions to Ring about this video went unanswered.

Maybe the explanation is that Ring isn't planning to add it to its consumer products but is developing something for law enforcement to apply to footage via its portal. This would allow Ring to continue to claim it's not adding facial recognition software to its cameras while still making use of its "Head of Facial Recognition" person.

But there's also no reason to believe Ring is being honest about any of this. Like any company under the x-ray, it will say what serves it best right now even if it means rolling back those quasi-promises the minute Ring feels it can get away with making its products even more problematic.

Filed Under: doorbells, facial recognition, law enforcement, police
Companies: amazon, ring

Ring Says It Helps Cops Fight Crime But The Data Shows It's No Better At This Than Any Other Security Camera

from the and-its-competitors-aren't-dragged-down-by-law-enforcement-baggage dept

The number of law enforcement agencies Ring partners with continues to grow -- up to nearly 900 by the latest count. Ring pitches its devices to homeowners as a better way to keep their homes secure. And maybe it is. But the pitches it makes to law enforcement agencies are something else.

Ring drives this particularly questionable engagement by insinuating people who've received free or cheap cameras will become part of a surveillance network overseen by cops, who will be able to solve tons of crimes and receive tons of footage from compliant recipients without a warrant.

None of this appears to be happening. While homes with Ring cameras are arguably more secure, the same could be said for any consumer camera -- most of which aren't handed to homeowners by law enforcement. A recent report by Cyrus Farivar for NBC News shows there's not much crime being solved by the vast network of Ring cameras and the company's hundreds of law enforcement partners. (via Jeffrey Nonken in the Techdirt chat window)

Thirteen of the 40 jurisdictions reached, including Winter Park, said they had made zero arrests as a result of Ring footage. Thirteen were able to confirm arrests made after reviewing Ring footage, while two offered estimates. The rest, including large cities like Phoenix, Miami, and Kansas City, Missouri, said that they don’t know how many arrests had been made as a result of their relationship with Ring — and therefore could not evaluate its effectiveness — even though they had been working with the company for well over a year.

The extensive agreements with Ring -- ones that allow the company to write press releases and veto law enforcement statements it doesn't like -- apparently don't require any sort of data gathering or reporting that would tie Ring cameras to arrests. The report says none of the 40 departments contacted collect data that might indicate whether or not the increased installation of cameras has reduced crime or resulted in more arrests.

Ring cameras may be everywhere, but their contribution to combating crime is apparently no greater than its competitors. Any other camera company could boast it's contributed just as much as Ring has, all without blurring the line between public and private by aggressively courting law enforcement agencies. The list of criminals taken down by Ring footage reads like a small town paper's police blotter:

Of the arrests that police connected to Ring, most were for low-level non-violent property crimes, according to interviews and police records reviewed by NBC. These arrests detailed the theft of a $13 book, the theft of a Nintendo Switch video game console (and several items, including two coffee mugs, purchased from the Home Shopping Network valued at $175. In Parker County, Texas, two people were arrested for allegedly stealing a dachshund named Rufus Junior, valued at $200.

These are the success stories. And that's from agencies that actually have success stories to relate. Most don't have anything to talk about or are only reporting a very small number of arrests in relation to their cities' overall property crime rate.

But it has opened a dialog of sorts between citizens and law enforcement. Some people view their cameras and the law enforcement portal as a "may I speak to the manager" connection.

Ring makes it so frictionless to share footage with police that some residents submit videos of anything they find displeasing, even when there is no indication that a crime has been committed, Lt. Santos, of Winter Park, said.

“We’ve gotten videos of racoons in the yard, with people saying, ‘Hey, can you deal with these racoons?’” he said. “That’s the type of people we’re dealing with. They’re constantly sending us video clips.”

Ring continues to insist its hundreds of law enforcement partnerships makes citizens safer. But outside of a handful of arrests related to small property crimes, there's nothing in the data that suggests the thousands of cameras and hundreds of partnerships has actually increased public safety.

Filed Under: doorbells, law enforcement, overhype, policy, ring, security
Companies: amazon, ring

Ring Updates Privacy Dashboard Again, Allows Users To Preemptively Block All Law Enforcement Requests For Footage

from the 'get-a-warrant'-functionality dept

After months of negative publicity, Ring is finally taking a few small steps towards not being completely awful. The company clearly would rather be a government contractor than a supplier of consumer products, but has repeatedly gotten in its own way by selling products to consumers rather than surveillance tech to government agencies.

Trying to have it all, Ring welcomed police departments into the fold, offering steep discounts on cameras to agencies that played along with its PR pitches and distribution tactics. Citizens could get cameras for almost nothing from local cops with the implicit suggestion they share their recordings with cops whenever law enforcement asked.

That was the initial wave of bad press: the co-opting of police departments to turn consumer security cameras into extensions of law enforcement surveillance networks. The second wave was almost worse. It involved the hijacking of Ring cameras by malicious jerks who used lists of credentials taken from security breaches to take control of the connected devices.

Ring shifted the blame for these hijackings to the end users. While Ring does encourage the use of "strong" passwords and two-factor authentication, it did not -- until recently -- make either of these the default. A recent update to its "privacy dashboard" finally allowed users to easily control access to their cameras by providing lists of all IP addresses/devices currently logged in. It also nudged users in the direction of 2FA a bit more firmly, making this opt-out, rather than opt-in.

The latest update goes further. And it must have been painful to implement, since it undercuts part of the company's sales pitches to law enforcement agencies. Ring has played up the advantages of cops handing cameras to citizens, creating portals that give officers maps of Ring camera locations and coaching cops on the finer points of obtaining footage without a warrant. This addition to Ring's privacy dashboard is going to make it a bit more difficult for cops to bypass the warrant process when seeking to obtain camera footage from Ring users.

In the new update, users will be able to see an "Active Law Enforcement Map" clarifying which local institutions are part of the Neighbor Portal network. They will also be able to disable requests for video from officials, whether or not they have received one in the past. (This feature was available previously, but an account had to have received one request for the opt-out option to appear.)

Ring's blog post on the dashboard update not-so-subtly hints that users shouldn't do this by telling readers about a couple of times the video request tool was used to solve crimes. Even if this PR nudge proves ineffective, cops aren't completely out of luck. Ring is happy to turn over footage stored in its cloud to law enforcement without notifying users, even as it claims this footage still belongs to the end users.

This is a move in the right direction for Ring. Unfortunately, it still seems focused on becoming an appendage of law enforcement, rather than a producer of consumer goods. As long as it spends more time trying to figure out how it can best assist government middlemen, it's going to keep disappointing the actual users of its cameras.

Filed Under: doorbell, law enforcement, preferences, privacy, ring, ring doorbell, surveillance
Companies: amazon, ring

Amazon Tells Ukraine Publication To Alter Its Article After It Links The Company To Ring's Problematic Ukraine Branch

from the burnt-by-your-own-source dept

An extremely-problematic wing of an extremely-problematic company is back in the news. Ring's Ukraine division made headlines last fall when the presence of a "Head of Facial Recognition Tech" in the Ukraine office appeared to contradict Ring's claims it was not interested in adding facial recognition to its cameras.

More disturbing news surfaced earlier this month, when it was discovered this office had allowed its employees to view Ring camera footage uploaded by users. Ring doesn't just produce doorbell cameras. It also sells in-home cameras, making this revelation particularly worrying.

Beginning in 2016, according to one source, Ring provided its Ukraine-based research and development team virtually unfettered access to a folder on Amazon’s S3 cloud storage service that contained every video created by every Ring camera around the world. This would amount to an enormous list of highly sensitive files that could be easily browsed and viewed. Downloading and sharing these customer video files would have required little more than a click. The Information, which has aggressively covered Ring’s security lapses, reported on these practices last month.

Not only did the R&D team have complete access to customers' recordings, so did Ring's US-based engineers and executives. And who knows how many other people have accessed these recordings illicitly? When this access was granted to an untold number of Ring employees, Ring did not encrypt uploaded recordings. The company apparently felt encryption was too expensive to implement and would possibly limit revenue opportunities for the company as it aggressively moved into the home security market.

It turns out the company was using customers' footage to train its AI to recognize faces and other objects. This would be the same facial recognition Ring swears it isn't going to be implementing anytime soon.

Apparently, this abuse of trust has resulted in growth opportunities for Ring-Ukraine. A recent article by Ukranian publication Vector stated the office would be lending its expertise to other Amazon products, which possibly includes Rekognition, Amazon's homegrown facial recognition program.

But that story was buried by Amazon PR shortly after it appeared, according to Sam Biddle of The Intercept.

I asked multiple Amazon representatives and Ring’s head of communications about the Vector article, including specifically what were the “many other Amazon projects” Ring’s Ukrainian staff now worked on.

Although Amazon ignored repeated requests for comment and Ring refused to discuss the subject on the record, it seems that the company did take action: Within hours of my inquiries, the text of the Vector piece was quietly edited to remove references to Amazon. Most notably, the entire quoted sentence about the “many other Amazon projects” the Kyiv office was working on was excised.

The author of the story told The Intercept he had nothing to do with the belated deletion. In fact, he was not aware of any editing until The Intercept brought it to his attention. An email from Vector's editor-in-chief explained the situation, although not all that satisfactorily.

We published a news about rebranding, later pr-manager of Ring Ukraine called me and asked to take Amazon mention out from the article. Since I had a good relationship with manager, the article got just several dozens of views and I understood that everyone know that Ring is part of Amazon anyway, I didn’t even asked questions, said ok and took Amazon part out

It appears Amazon doesn't want people to know it has given a problematic division even more responsibility. It also may be trying to head off another Ring-related PR nightmare by removing any text that might suggest Ring customer recordings are being used to train facial recognition software used by government agencies.

But it's too late to change public perception. The scrubbing may keep Amazon from being linked to unfettered access to Ring camera recordings in search results, but there's no separating Amazon from Ring. And there's nothing here that suggests either company is moving away from leveraging user-generated content to fine-tune AI for the customers they really want: law enforcement agencies.

Filed Under: journalism, ring, ukraine
Companies: amazon, ring

Ring Throws A Moist Towelette On Its Dumpster Fire With A Couple Of Minimal Security Tweaks

from the [yelling-over-the-roaring-flame]-WE-CARE-DEEPLY-ABOUT-OUR-USERS dept

Things have gotten worse and worse for Amazon's Ring over the past several months. Once just the pusher of a snitch app that allowed city residents to engage in racial profiling from the comfort of their homes, Ring is now synonymous with poor security practices and questionable "partnerships" with hundreds of law enforcement agencies around the nation.

Ring owners recently discovered how easily their cameras could be hijacked by assholes with no moral compass and too much time on their hands. Using credentials harvested from security breaches, online forum members took control of people's cameras to entertain a podcast audience who listened along as hijackers verbally abused Ring owners and their children.

Ring is now being sued for selling such an easily-compromised product. Ring's response to the original reports of hijackings was to blame customers for not taking their own security more seriously. Ring does recommend two-factor authentication but that's about all it does. It does not inform users when login attempts are made from unrecognized IP addresses or devices, and does not put the system on lockdown after a certain number of failed attempts are made.

Yes, users should use strong passwords (and not reuse passwords), but blaming customers for engaging in behavior most customers will engage in is unproductive. Instead of making two-factor authentication a requirement before deployment, Ring has just repeatedly pointed to its prior statements about its "encouragement" of 2FA -- an "encouragement" that is mostly comprised of defensive statements issued in response to another negative news cycle.

Since it can't keep blaming its millions of customers for its own failings, Ring is taking a very, very small step in the direction of actually taking its customers' security seriously. [Please hold your tepid applause until the end of the announcement.]

Ring has announced that it is adding a new privacy dashboard to its mobile apps that will let Ring owners manage their connected devices, third-party services, and whether local police partnered with Ring can make requests to access video from the Ring cameras on the account. The company says that other privacy and security settings will be added to the dashboard in the future. This new Control Center will be available in the iOS and Android versions of the Ring app later this month.

It's barely enough to make any one feel whelmed, much less overly so. There are two small additions that put this ahead of what Ring offered prior to the newsworthy camera hijackings. First, the app will allow users to see who's logged in at any given time and logout unrecognized IP addresses or locations from within the app.

The second addition finally puts some (baby) teeth into Ring's 2FA recommendation:

[R]ing is continuing to inform its customers of the importance of two-factor authentication on their accounts and will be making it an “opt-out” thing for new account setups, as opposed to the opt-in setup it currently is.

Swell. So that's kind of… fixed. I guess. Now Ring just needs to work on all the other problematic things about itself, like the fact that it's still not going to notify users when new IP addresses, devices, or locations attempt to access their cameras. And it's not going to stop using cop shops as Ring marketing street teams. And for all of its insistence footage is never handed over to cops without the proper paperwork, it still deals from the bottom of the deck by claiming end users own all their footage even as it's handing this footage to law enforcement without the end user's permission or involvement.

Ring has a lot to fix if it's ever going to make its way out of the PR pit it's dug for itself. This is something, but it's just barely something. It's not enough. And it says Ring still isn't serious about protecting its customers -- not from law enforcement and not from malicious idiots who've found a new IoT toy to play with.

Filed Under: cybersecurity, dashboard, doorbells, police, ring doorbell, security
Companies: amazon, ring

Shocking Absolutely No One, Ring Admits Employees Improperly Accessed Customers' Data

from the who-could-have-seen-this-coming dept

Ring never fails to disappoint. And by "disappoint," I mean never fails to be disappointing. This pleases me. So, I guess Ring never fails to please… by being incessantly disappointing.

I realize this is beginning to resemble a beating that continues long past the point the victim has lapsed into unconsciousness. But if Ring hadn't made itself such an inviting punching bag, I would not continue to rain down printed blows on its oh so very soft body.

Ring first grabbed our attention by offering up a snitch app that encouraged neighbors to start talking about suspicious people in their neighborhood. This app also happened to be a portal for the voluntary sharing of footage captured by Ring cameras, most of which were built into Ring's "smart" doorbells.

From there, things went from bad to worse to godawful to horrendous to PR-team-on-constant-suicide-watch. It has been super-enjoyable for me (and hopefully for Techdirt readers) for two reasons:

1. Ring promiscuously got in bed with over 600 law enforcement agencies, selling them "free" cameras to hand out to homeowners with some implicit/not-so-implicit strings attached. In return, law enforcement agencies gave up their authority and autonomy, granting Ring permission to write their press releases and statements for them.

2. Ring does not care about its customers. It enjoys a commanding lead in the market, but it has produced yet another internet-connected thing that it does not bother to secure properly. When breaches happen -- and they are unimaginably horrifying breaches that involve hijacked cameras -- the company says customers should have done more to secure their devices, rather than accept any responsibility for doing as little as possible to prevent this sort of thing from happening.

So, the latest news is more fuel for the dumpster fire. It's not just cops grabbing footage without bothering with the Fourth Amendment niceties. There's also abuse happening internally -- the sort of abuse you'd expect when you give people access to a wealth of personal information.

The doorbell-camera giant Ring has terminated employees in recent years for improperly accessing users’ video data, parent company Amazon told lawmakers this week, an admission that could increase pressure on the firm to prove it protects customer privacy.

The company has investigated four complaints regarding employees abusing their access to camera data over the past four years, Brian Huseman, a vice president of public policy at Amazon, wrote in a letter to five senators this week.

The company did not provide any detail about the data that was improperly accessed, but considering how much data Ring collects -- along with footage from millions of cameras -- the imagination is free to run wild.

This is the latest unsurprising development for Ring. Give enough people access to intimate recordings and data, and abuse is bound to happen. Maybe the Ring employees were just following the lead of their law enforcement partners, who also have access to a great deal of personal info and abuse this access with alarming frequency.

I'm sure Ring will weather this news cycle as it has every other over the past 12 months: by claiming it takes everyone's security seriously and sending out tweets to anyone tagging the company with the latest bad news saying the coverage is inaccurate. But no one believes Ring, especially when its defensive tweets talk their way around direct questions and link to talking points delivered by Ring reps.

Ring is no longer just a dumpster fire d/b/a a security camera company. Its flaming dumpster existence is mounted to every flatbed car on a never ending train wreck. It can't pull the plug on its thousands of buddy cops. And it appears to be far more interested in market growth than properly serving the customers it already has. Things will get worse. That's it. There's no "before it gets better." At best, Ring can only hope to fade from the public eye before it alienates any more of its past and future customers.

Filed Under: abuse, doorbells, employees, police, surveillance, video
Companies: amazon, ring