Amazon finally admits giving cops Ring doorbell data without user consent

More than 10 million people rely on Ring video doorbells to monitor what's happening directly outside the front doors of their homes. The popularity of the technology has raised a question that concerns privacy advocates: Should police have access to Ring video doorbell recordings without first gaining user consent?

Ring recently revealed how often the answer to that question has been yes. The Amazon company responded to an inquiry from US Senator Ed Markey (D-Mass.), confirming that there have been 11 cases in 2022 where Ring complied with police "emergency" requests. In each case, Ring handed over private recordings, including video and audio, without letting users know that police had access to—and potentially downloaded—their data. This raises many concerns about increased police reliance on private surveillance, a practice that has long gone unregulated.

Ring says it will only "respond immediately to urgent law enforcement requests for information in cases involving imminent danger of death or serious physical injury to any person." Its policy is to review any requests for assistance from police, then make "a good-faith determination whether the request meets the well-known standard, grounded in federal law, that there is imminent danger of death or serious physical injury to any person requiring disclosure of information without delay."

Critics say it shouldn't be left up to Ring and the police to decide when data can be accessed or how long that data can be stored.

"There are always going to be situations in which it might be expedient for public safety to be able to get around some of the usual infrastructure and be able to get footage very quickly," says Matthew Guariglia, a policy analyst for Electronic Frontier Foundation, a nonprofit dedicated to protecting civil liberties online. "But the problem is that the people who are deciding what constitutes exigent circumstances and what constitutes the type of emergency, all of these very important safeguards, are Ring and the police, both of whom, as far as I know, don't have a great reputation when it comes to deciding when it's appropriate to acquire a person's data."

To improve the situation, Guariglia wants regulators to lay more ground rules limiting how much police can rely on private surveillance. He also wants companies like Ring to take more steps to protect users from potentially unlawful surveillance by changing the doorbell's default settings to turn audio recording off and automatically store data to prevent third parties, including the police and Ring, from accessing it.

Ring refused to commit to doing either. The company says that it only stores data for users with subscription plans, and those users can easily choose to use higher security settings if desired. Responding to Ars' request for comment, Ring would not share whether 11 cases of sharing data without user consent in 2022 was higher or lower than average; the company supplied a prior statement pushing back against media reports that question Ring's judgment on when to share data with police:

"It's simply untrue that Ring gives anyone unfettered access to customer data or video, as we have repeatedly made clear to our customers and others. The law authorizes companies like Ring to provide information to government entities if the company believes that an emergency involving danger of death or serious physical injury to any person, such as a kidnapping or an attempted murder, requires disclosure without delay. Ring faithfully applies that legal standard."

Markey is counted among Ring's biggest critics, seeming to suggest in a statement that Ring might be sharing data with police in less high-stakes circumstances by referring to Ring's law enforcement policy as having a "so-called 'emergency circumstance exception.'" In his response, Markey agreed with Guariglia that changing Ring default settings would immediately enhance data security for potentially millions of users. Absent those changes, the senator says Ring leaves its users open to threats, which could include potential invasions of privacy, self-surveillance risks, surveillance of First Amendment activities, and coercion, among other risks.

"As my ongoing investigation into Amazon illustrates, it has become increasingly difficult for the public to move, assemble, and converse in public without being tracked and recorded," Markey said.

Preventing Ring from sharing data with police

Politico reported that Ring's response to Markey was the first time the company admitted to sharing information without a user's consent, so it's likely many users are unaware of these vulnerabilities.

There are higher security settings that Ring users can change on their devices to stop recording audio and start using end-to-end encryption for data storage, though. By changing these settings, users can ensure that no third parties (like Ring or the police) can access their recordings and know they're not recording any protected free speech that happens within 30 feet of their front doors.

Ring told Markey that its customers like the audio-recording feature and would be inconvenienced if it was disabled by default. They also said that end-to-end encryption was considered an advanced setting that limited user access to videos and disabled certain features, making it less desirable to all users. "User control is foundational at Ring, and we recognize this advanced feature may not be right for all customers," wrote Brian Huseman, Ring's vice president of public policy.

Just as there are few regulations on how police use private surveillance technologies, there is also not much data about whether the controversial partnership between police and tech companies is making communities safer. However, it has become undeniable that police view video doorbell technology as a free law enforcement tool, even partnering with Ring in the past to install doorbells in communities for that purpose.

Meanwhile, it's still unclear how people generally feel about police relying on public surveillance. Guariglia says unregulated agreements between companies like Ring and police help keep the topic out of public debate. Ring has only recently begun regularly sharing data that shows how often police have requested data (approximately 20,000 requests in 2021) but still declines to say how often the users shared data of their own accord.

Markey asked Ring to commit to changing how it operates without regulation. On his wish list were promises from Ring to: never accept financial contributions from or provide financial contributions to police; never allow immigration or federal law authorities to request Ring data; and never participate in police-sting operations.

In its response, Ring did not address any item directly; instead, it referred to similar recommendations made during an audit of Ring conducted by The Policing Project at New York University School of Law. "Ring stands by the commitments we have made both prior to and during the audit," Huseman wrote.

That audit specified which regulations policymakers should consider to address the public's many privacy concerns. Suggestions for lawmakers included providing substantive protections that would define threshold limitations and prohibit uses of private surveillance by law enforcement. The audit also recommended procedural protections like defining warrant requirements, establishing mandatory use policies, and clearly defining reporting and enforcement procedures.

When it comes to sharing private data with police, Ring's audit agreed that more regulations were needed, with the Policing Project reporting, "one of our central conclusions is that it is time policymakers pay attention to and regulate the ways that policing agencies rely on commercialized private surveillance." Until lawmakers catch up, Markey says he'll "continue to exercise oversight of these harmful corporate practices."

Between Ring's audit and Markey's ongoing inquiries, the public will continue slowly gaining more data on whether video doorbells provide more security for users—or if the lack of "privacy-enhancing" updates could be leaving them open to more threats. Those include, as Gizmodo reported, "the potential for blackmail, stalking, and other forms of invasion," should their private data get into the wrong hands.