Nest Competitor Ring Reportedly Gave Employees Full Access To Customers' Live Camera Feeds (9to5google.com)

Amazon-owned Ring allowed employees to access customers' live camera feeds, according to a report from The Intercept. "Ring's engineers and executives have 'highly privileged access' to live camera feeds from customers' devices," reports 9to5Google. "This includes both doorbells facing the outside world, as well as cameras inside a person's home. A team tasked with annotating video to aid in object recognition captured 'people kissing, firing guns, and stealing.'" From the report: U.S. employees specifically had access to a video portal intended for technical support that reportedly allowed "unfiltered, round-the-clock live feeds from some customer cameras." What's surprising is how this support tool was apparently not restricted to only employees that dealt with customers. The Intercept notes that only a Ring customer's email address was required to access any live feed.

According to the report's sources, employees had a blase attitude to this potential privacy violation, but noted that they "never personally witnessed any egregious abuses." Meanwhile, a second group of Ring employees working on R&D in Ukraine had access to a folder housing "every video created by every Ring camera around the world." What's more, these employees had a "corresponding database that linked each specific video file to corresponding specific Ring customers." Also bothersome is Ring's reported stance towards encryption. Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access." In response to the report, Ring said: "We have strict policies in place for all our team members. We implement systems to restrict and audit access to information. We hold our team members to a high ethical standard and anyone in violation of our policies faces discipline, including termination and potential legal and criminal penalties. In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."

Comments

Duh

[sexconker]

What did you think would happen?

Re: Duh

[Anonymous Coward]

Reasons why you dont but them in bedrooms and bathrooms. Lol.

I assume if they ever leaked a video, there would be either a new owner or new executives

Re:Duh

[swillden]

What did you think would happen?

That some (perhaps most) of these companies would cut corners and do the wrong thing was inevitable. But the implication of your question is that it's inevitable everywhere, which is not true. It's perfectly possible to construct a system so that no employees have access to the content other than those who need it to troubleshoot specific problems at customer request, and even those are closely audited and monitored. Yes, even the sysadmins can be disallowed access, through use of encryption and separation of responsibilities applied both to the system architecture and to the groups of administrators who manage different elements of the system.

I know this can be done because I've seen it done (and participated in doing it), including regular pen testing and ongoing security analysis to ensure it's tight and stays tight. It's not even that expensive to do on a large scale. It's challenging for startups to do well, but can be done even there; liberal use of cloud computing helps because it's easy to put the bulk data processing in a location where it's physically inaccessible to all of your employees, and logical access can easily be partitioned among admins. Appropriate use of encryption is essential, to ensure that no system in isolation (and therefore the managers of that system) has access to sensitive data in plaintext. Then you just need to carefully architect, control and audit the ways in which ciphertext and decryption keys can be brought together.

Re:Duh

[strikethree]

That some (perhaps most) of these companies would cut corners and do the wrong thing was inevitable. But the implication of your question is that it's inevitable everywhere, which is not true. It's perfectly possible to construct a system so that no employees have access to the content other than those who need it to troubleshoot specific problems at customer request, and even those are closely audited and monitored.

The fact that your data is stored on their servers guarantees that these kinds of things can happen. They even say WHY they keep that data: To monetize it!

I don't think people realize what the real trade is here. People who buy (why do they have to pay for it?) these devices are essentially allowing an external entity to place a camera in their home to monetize any data that the camera can capture, things such as routines, demographics, etc. It just so happens that the person purchasing this device can also access the video feed for their purposes, such as who is ringing their doorbell. Of course, only the "security" aspect of the device is mentioned.

Honestly, this shit feels soooo slimy. Disgusting even. There is a clear lie through misrepresentation here.

Re:Duh

[swillden]

That some (perhaps most) of these companies would cut corners and do the wrong thing was inevitable. But the implication of your question is that it's inevitable everywhere, which is not true. It's perfectly possible to construct a system so that no employees have access to the content other than those who need it to troubleshoot specific problems at customer request, and even those are closely audited and monitored.

The fact that your data is stored on their servers guarantees that these kinds of things can happen.

This need not be true, though it takes deliberate effort and discipline on the part of the company. The company as a whole certainly has access to your data, but they can structure things so that no employee does, and that the ways in which the data can be used by the systems and people are limited to the ways that customers know and expect.

They even say WHY they keep that data: To monetize it!

This also need not be true. Nest, for example, explicitly says that it does not.

Re: Duh

[Anonymous Coward]

New executives maybe. It's not like they are going to hand Amazom over to someone. It's publicly owned.

Re:Duh

[Anonymous Coward]

> The fact that your data is stored on their servers guarantees that these kinds of things can happen.

Not even remotely true or common. Most services that store sensitive data do so with encryption and security compliance standards that include internal policies and practices. FedRAMP / HIPAA / SOC 2 etc are just a few of the major compliance standards that exist for such purposes. The fact that Ring does not encrypt this data in ways that allow limited access under specific situations with a complete audit trail is awful, but not an intrinsic property of storing your data on a remotely owned server.

I have worked for several companies where no individual had access to sensitive data and requests for access required multiple levels of approval, and coordination between two or more people in order to carry out access. The last two companies I worked for had no means of accessing your data at all because the customer was responsible for the encryption keys.

Yes theoretically we could have implemented software to intercept the decrypted content on the customer's end and send it back home for us to read, but that would have invalidated our security compliance and the audit trail would have proved it either way (as in either the audit trail showed the modifications or the signatures of the source code would not have matched the values recorded in the audit trail.)

And most major services are used by other companies that employ equally stringent security protocols including endpoint monitoring for suspicious network activity - so even if we had sent our data back encrypted with our own keys at least one of our customers would have noticed and reported the issue.

commentsubject

[Anonymous Coward]

phonehome device owners shocked to learn device is phoning home

welcome to the future

welcome to Cloudthing, Smartproduct, and Alwaysonline

this is for your safety
this is for your convenience
this is for your user experience to be reliable and carefully controlled
this is not for our sake

Re:commentsubject

[Anonymous Coward]

Wait, wot? Having a camera on your porch is the same as harassing black citizens and wasting police resources? I don't see it. I think you're simple and/or upset about something unrelated.

Re:commentsubject

[Anonymous Coward]

A society for the cowards, by the cowards, and of the cowards. Devices like Ring and indoor Nestcams are for the same kind of cowards who call the cops if someone of the wrong color is walking in their neighborhood.

No, you're just a stupid SJW cunt whose worldview is childishly simple.

Re: commentsubject

[Anonymous Coward]

I think there should be no privacy, especially for those in power.

Re: commentsubject

[b0s0z0ku]

Privacy is a good thing as long as we have stupid social/religious norms.

Re:commentsubject

[HornWumpus]

WTF?

All SJWs are authoritarian assholes. Your post makes no sense.

Re:commentsubject

[thesupraman]

Are those different from the kind of cowards who rob someone of the wrong colour walking in the neighborhood?

Just wondering.

Re:commentsubject

[suutar]

wanting to know which of my cats is walking on the countertop makes me a busybody?
wanting to know when the UPS guy drops off a package on my front porch makes me a busybody? ... I'm still not seeing it.

Re:commentsubject

[Anonymous Coward]

Why do you think of "black citizens" when someone mentions "someone of the wrong color"?

Re:commentsubject

[zugmeister]

Funny, I always thought the phrases "authoritarian asshole" and "SJW cunt" belonged together.
Before you get upset, name me three SJW causes that don't attempt to assert control over others.

Re:commentsubject

[Anonymous Coward]

symptoms of being a busybody cunt.

Another symptom is making arbitrary, ill-informed assumptions based on your own narrow-minded views. Does that make you a racist, too? Pretty sure it does by your own rules.

Re:commentsubject

[Anonymous Coward]

It's not about what they do (it's certainly not fighting injustice). It's how they do it. They use authoritariand and downright facist methods to push their ideology on others.

Re: commentsubject

[Anonymous Coward]

Probably because he equates black dudes with the guys who gave him swirlies and took his lunch money in high school

Re: commentsubject

[Anonymous Coward]

SJW answer to everything - government control. Social control when they do not have sufficient political power.

How is that not authoritarian?

Re: commentsubject

[Anonymous Coward]

mate you can't even identify an actual human SJW, and your cherrypicking makes it obvious the people you think are SJWs are just people who make you feel emotionally uncomfortable... sometimes just because they've got the female equivalent of your own social status.

Why do you think the whole NPC thing backfired?

Re:commentsubject

[Anonymous Coward]

yeah yeah keep retreating and conflating it with diplomacy

Maybe one day you'll be a real victim.

So bloody sick of your childish misunderstanding of your own belief that you should have authority without having to do anything for it.

Re: commentsubject

[Anonymous Coward]

That was definitely white dudes for me.

Re:commentsubject

[Anonymous Coward]

" It's how they do it." - It's not about what large swaths of the population you thoughtlessly pretend are guilty of something because they want justice, it's the Libertarian-bent you attempt to do it from, ironically.

You're a moron making generalizations. I don't judge all other morons by yours though.

Re:commentsubject

[Anonymous Coward]

The she's are the authority and these days bro.

Re: commentsubject

[Anonymous Coward]

"SJW answer to everything - government control." - As opposed to hiring hitmen? Yes they seek a legislative and judicial, regulated solution to the problem of justice. Which would you prefer?

If you want to propose a non-government solution to achieving justice for the poor, the weak, the old, the young, the vulnerable, I'm sure the world would listen. If however you've got nothing? Then stop whining.

Re: commentsubject

[HornWumpus]

Your argument would carry more weight if their wasn't a sib poster that was exactly what you claim doesn't exist.

Re:commentsubject

[Anonymous Coward]

Funny, I always thought the phrases "authoritarian asshole" and "SJW cunt" belonged together.
Before you get upset, name me three SJW causes that don't attempt to assert control over others.

The only people that can name a single SJW cause are the same people that invented the term SJW, because it's just a big straw man.

Re:commentsubject

[Anonymous Coward]

Is that the terrible secret of space? (Maybe terrible secret of IoT?)

https://www.youtube.com/watch?v=7E0ot9iJm_k

Re:commentsubject

[Anonymous Coward]

It's almost like the people that call them Social Justice Warriors put that in the name? Social? I mean if they were called Individual Justice Warriors and trying to influence the social/individual rights discussion towards social, maybe you would have a point worth making? Seems like you are amused by tautology.

And I think reasonable minds can disagree that rule of law in democracies and authoritarian rule are the same thing.

Re:commentsubject

[Anonymous Coward]

wanting to know which of my cats is walking on the countertop makes me a busybody?

The obvious answer is every single one of them.

These are cats we are talking about here, after all.

Re:commentsubject

[serviscope_minor]

First give a definition of of SJW that actually encompasses any people and isn't applicable to moe or less anyone of any politicial orientation you don't like.

Re:commentsubject

[Anonymous Coward]

wanting to know when the UPS guy drops off a package on my front porch makes me a busybody?

Why would they drop it on your porch? Don't they require signatures?

Re:commentsubject

[Anonymous Coward]

Not everyone lives in the inner city, bub.

Re:commentsubject

[Anonymous Coward]

Wait, wot? Having a camera on your porch is the same as harassing black citizens and wasting police resources? I don't see it. I think you're simple and/or upset about something unrelated.

He was referring to the fact that the average Slashdotter with an IoT doorbell is going to hysterically call the police the first time they see a black person walking up their drive.

Re:commentsubject

[Anonymous Coward]

I'm still not seeing it.

no, but they are...

Re:commentsubject

[Anonymous Coward]

Ironically your comment is modded insightful, but the problem you pose... is rather stupid. When you word the question like that you shove away a large grouping of people under a answer that makes it seem like they are wrong because they can't name any. While quite a few problems that get shoved as "SJW" are in my eyes ridiculous. Things like equal rights for everyone can be shoved under the guise of SJW as well. Of course equal rights also attempt to assert control over others, these other mainly being slave owners and such. The only fair way to judge every cause is therefor separately. And not with bullshit arguments like yours. Because just disagreeing with most, or virtuallly every. Does not mean all.

Re:commentsubject

[crypticedge]

Wanting to know who is at the door without having to go up to the door is not "being a busy body"

It's also far safer. The person on the other side can't shoot through the door and hit you if you're not near the door. They also can't use a key fob scanner on you because you won't be in range. Plus, you can see if someone is stealing your packages, and have proof of it.

Re:commentsubject

[Anonymous Coward]

Funny, I always thought the phrases "authoritarian asshole" and "SJW cunt" belonged together.
Before you get upset, name me three SJW causes that don't attempt to assert control over others.

With that, many SJWs were triggered and screamed at the sky!

Re:commentsubject

[L. J. Beauregard]

SJW

Aah, shaddap.

cunt

Misogynist much?

Re:commentsubject

[Anonymous Coward]

Things like equal rights for everyone can be shoved under the guise of SJW as well

No, it cannot. As GP already pointed out, "authoritarian asshole" belongs under the SJW umbrella. Authoritarians by definition have more rights than others/can override the rights of others. Ergo, you logically cannot have "equal rights for everyone" in the same umbrella as "authoritarian asshole"

The people who would put them both under the SJW umbrella are usually the very people trying to cast doubt on the definition of SJW. It's a form of gaslighting. They're the ones injecting doubt and vagueness into the definition, and then they tell you that you're the one using vague definitions.

Of course equal rights also attempt to assert control over others, these other mainly being slave owners and such.

A slave owner by definition is someone who is violating equal rights for everyone. Stopping them is not an "attempt to assert control over others", it is stopping somebody from asserting control over others.

Now, how you go about stopping slavery also matters, as if you are too forceful or violate the slave owner's rights in the process, then you indeed become authoritarian yourself, and you may very well be called out as an "SJW".

But assuming you're doing it right, stopping slavery is not an SJW cause. The next time you're advocating equal rights and you get called that, instead of kneejerk dismissing them as only saying that because don't like your politics, reconsider that your position may very well contain flaws that could lead to more authoritarianism.

The only fair way to judge every cause is therefor separately.

And where did GP not do that? He asked for three SJW causes that don't try to exert control over others. You tried one with the slave owner thing. I have judged it separately as insufficient. So try again.

Re:commentsubject

[fropenn]

Many issues of social justice are about empowering the powerless to regain control over their lives. This is the explicit goal of these efforts, rightfully so. Take, for example, #metoo. It's about giving victims of sexual assault the power to regain control over their lives and (finally) achieve some level of justice against the perpetrators.

How about black lives matter? It's about decreasing police violence against blacks by empowering people to challenge excessive police violence and take action in their communities.

Another example? How about anti-bullying campaigns to empower LGBTQ individuals to lead lives free of harassment, bullying, and violence, and empowering them to fully access health care and other services that all humans need.

For sure, all of these campaigns can go too far - innocent men can see their lives destroyed if they are "found guilty" in the court of public opinion, police officers can have their lives threatened and careers crushed by just being in the wrong place at the wrong time, and anti-bullying campaigns can be viewed as limiting the free expression of certain viewpoints. Proponents of social justice issues must take care to avoid the negative consequences from over-zealous action; however, it is quite clear that the intent of these efforts is worthwhile (empowering sexual assault victims, victims of police violence, and bullying victims, for example).

Amazon owns Ring.

[Anonymous Coward]

Just so you know who's watching you fuck, it's Jeff Bezos. Think I'm kidding? Look at him.

Re: And Google Admins Read Your Email...

[Anonymous Coward]

I used to watch DildoCam in the late 90s on a Real Video stream. People used to be cool about stuff, and it's a shame how downhill things have gone.

Let me fix that for you.

[taustin]

In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."

I think you mean "if we get caught with bad actors."

The worst acting here is pretending this wasn't all done intentionally.

Re:Let me fix that for you.

[Anonymous Coward]

Law of averages says this has already happened, and has or has not been caught by their systems.

So the next question would be "How many bad actors have you caught? And please define what you consider to fall under 'bad actor' and show me an audit trail of your system that provides reasonable proof that you can detect this"

Another thing worth thinking about is that this kind of article doesn't get on a news site unless someone has actually seen enough abuse of a system to say "This is wrong, something needs to be done". So the question from that is, what have they seen?

And all this boils down to you can't trust other people to keep /your/ data safe on /their/ computers (the 'cloud').

Call me a shitposting troll if you must,

[HotNeedleOfInquiry]

But anyone that trusts their privacy to Ring gets what they deserve.

Re:Call me a shitposting troll if you must,

[Anonymous Coward]

I just passed up an opportunity to comment myself so you and others could get modded up.

Hot Needle of Inquiry

Just call me "Lying Bastard". Scream and leap if you must. It's all quite a conundrum prison, isn't it? xD

Re:Call me a shitposting troll if you must,

[Mordaximus]

But anyone that trusts their privacy to Ring gets what they deserve.

Similarly Alexa, though this privacy violation far exceeds the former as far as creepiness is concerned.

What a shame...

[SirAstral]

It's almost as if people are just begging to be taken advantage of.

Here, let me pre-order this game, for this console I cannot control from this company that really abused their customers last time.
Here, let me buy this product or service that has been repeatedly reported in the news as being used to spy on me.
Here, let me keep using this website, service, or institution that sells my private information for money.
Here let me keep voting for this lying son-of-a-bitch because that other liar is somehow worse than that other liar.

Just wondering when are people going figure out why this saying holds true...

"Fool me once, shame on you! Fool me twice, shame on me!!"

Most victims are actually not victims, but the very perpetrators of their own miseries!

News at 11

[Anonymous Coward]

Engineers have access to the system they created...

BMW

[Anonymous Coward]

Rumor has it, that BMW service can watch the 360 degree cameras of all cars remotely. A growing surveillance system on public roads. Even in areas where the EU GDPR is applicable.

Re:BMW

[Anonymous Coward]

Even if systems like this are designed not to do that - guess what? Firmware upgrade! Now it can stream live over your car's 3G.

Nice!!!!

[Anonymous Coward]

Can I watch too? no laws seem to have been broken

Re: And Google Admins Read Your Email...

[Anonymous Coward]

Lag from your mom's room wasn't a problem, even in the 90s.

This news is so chilling

[Anonymous Coward]

That it made 1000 year old ocean water get colder.

Not just Nest

[Ichijo]

...but any network-connected camera with proprietary firmware might phone home without your knowledge. The only sure way to prevent this with untrusted firmware is by isolating those cameras on their own network with no Internet access.

Re:Not just Nest

[JaredOfEuropa]

Done and done. I found having a doorbell with a camera in it is very useful (we don’t have Ring though), but you can be sure that sucker shares a separate VLAN with the other security cameras, with no access to the internet. And when we are at home, the indoor cameras have their power cut physically. Until we see CEOs in jail for such blatant unsafe practises, I’ll always double down on privacy measures when using IoT devices. And after that day... I’ll continue to do so. It is not hard to enjoy a little convenience without sacrificing or risking your privacy.

Re:Not just Nest

[q4Fry]

Can you provide any further detail about your set-up? Under what contexts are you able to see the camera feed? I'm particularly interested in whether you can receive notifications offsite, and if so, how.

Get the DEBARK Smart Video Doorbell

[JustAnotherOldGuy]

I recommend that instead of Ring, people should get the DEBARK Smart Video Doorbell.

It's less expensive (~$78 on Amazon) and it can record to SD card, SDVR, or a cloud service of your choosing (optional). Comes with a free remote indoor chime, and from what I understand, it's easy for it to connect to your old doorbell chime. Can be used wired or wireless. Two-way audio, and very good night vision capability.

Ring is waaaaaay overpriced and they force you to use their paid cloud service. Yes, it's only $3 a month, but why be forced to pay anything? The cheaper models won't let you do anything besides receive alerts and watch live video.

And, for the record, I have no connection to DEBARK, I just think their wireless doorbell is FAR better than the crap that Ring puts out.

Re:Get the DEBARK Smart Video Doorbell

[winphreak]

I am more interested in this model, after dealing with the RING for my parents.
Looks like a solid Chinese clone of the RING, and the SD card and de-mount notifications are appreciated.

I've not heard of SDVR, and was wondering if it can dump stuff to a NAS on the same network? I just don't know what the heck SDVR means. Google wasn't much help.

Or, if it's the other way, does it just keep the SD card network shared so you can review videos whenever?

Re:Get the DEBARK Smart Video Doorbell

[Miamicanes]

If you're not at home when somebody rings the doorbell, will you get the notification and be able to launch the viewer app on your phone in time to see who rang the bell before they're in their car backing out of your driveway?

It's not entirely Ring's fault (Google kind of pulled the rug out from under them with regard to push notification timing post-Marshmallow), but the real-world massive time lag was probably the biggest disappointment when I got mine 2 years ago. From my own experience, if you aren't at home & connected to the same wifi network as the doorbell the moment someone presses the button, you'll be lucky if your phone plays the "doorbell" notification within 20-30 seconds. Add another 10-20 seconds to unlock your phone and launch Ring's viewer app, and your likelihood of getting a chance to even SAY anything to whomever rang the doorbell before they're already gone is pretty low.

Even if you're at home & connected to the same wifi network as the doorbell, you almost have to have the phone in your hands & already unlocked to have any chance of getting the "Ring" app launched before whomever rang the doorbell turns around and walks away.

Re: Get the DEBARK Smart Video Doorbell

[houghi]

Or how about a raspberry zero W woth a camera and a button.

Re:Get the DEBARK Smart Video Doorbell

[JustAnotherOldGuy]

I've not heard of SDVR, and was wondering if it can dump stuff to a NAS on the same network?

SDVR just means "security DVR", it's just the box that connects all the cameras and stuff together in a security system.

I don't know about dumping stuff to a NAS, but I would think that it could be done one way or another.

Re: Get the DEBARK Smart Video Doorbell

[JustAnotherOldGuy]

Or how about a raspberry zero W woth a camera and a button.

I think it would be a fair bit of work to achieve the same functionality with a Pi, but I'm no expert on the Raspberry Pi stuff.

Maybe someone else here can tell us if that would be a practical solution or not.

Pants around their ankles

[Anonymous Coward]

I wonder how many of those 'executives' were caught by their assistants with their pants around their ankles, watching those live video streams, jacking off to partially-clad housewives?

Re: Pants around their ankles

[Anonymous Coward]

Dark mirror style. Preparing us for the next reality. What comes after that?

Ring TV!

[Zorro]

It is a new Netflix Reality Show.

Re:Ring TV!

[Anonymous Coward]

Don't watch it! Or at least don't pick up the phone.

Want a camera at home?

[AHuxley]

Make sure its a USB webcam that only gets used when needed.
Build your own CCTV network.
Network your own CCTV to a wider network you designed, understand and trust.
Don't let camera and microphones connect to network you did not set up.

“NOPE!”

[Sebby]

Once considered a Nest thermostat, then Google bought them out, and decided “NOPE!”

Same thing when Amazon bought Ring: “NOPE!”

Today I feel validated in my decisions.

Re:“NOPE!”

[JaredOfEuropa]

To be fair, it sounds like Amazon had little to do with this snafu. Not malice, not a desire for customer data, but simple negligence combined with bone shattering stupidity. Even so I agree with your sentiment: connected products that belong to data mining firms like Amazon and Google are doubly tainted. A voice assistant would make a great addition to my smart home setup but I am not adding one until they can be run off the cloud.

Re:“NOPE!”

[Anonymous Coward]

That is, you will never use one. The speech recognition thingie is really just uploading everything you say to the GAFAs servers that are the machines that have the horsepower to decrypt what you said and answer appropriately.

That kind of "AI" cannot be an offline machine. Sweet dreams, Jared.

Re:“NOPE!”

[Anonymous Coward]

Sufficiently advanced malice is indistinguishable from incompetence.

Re:“NOPE!”

[Anonymous Coward]

The Nest (and Hive) systems can both only control a single heating zone - ie. all of your house at once. It's really not much smarter than an old bi-metallic strip, other than it's connected to the Internet.

If you're thinking of ditching the old bi-metallic strip, then find a system that actually does a bit more than the one you're replacing. Extra points for getting some of the non-functional improvements like phone/app control, or whatever.

Re:“NOPE!”

[strikethree]

Not malice, not a desire for customer data, but simple negligence combined with bone shattering stupidity.

Looking for the best in people and situations is usually a good quality to exhibit. Unfortunately, if you are not diligent enough, you may find yourself excusing terrible and fully intentional behaviour....

This is in the summary:
Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access."

Note the words, "lost revenue opportunities".

Have a nice day Mr. Europa. :)

Stop trusting Amazon, Google, Facebook, et al

[Anonymous Coward]

If you are a technologist, then lead the way. Gently educate your family and friends that *everything* is tracked by these companies, especially by the large tech firms that offer "free" services. These companies do not respect privacy or personally identifying information (PII) because it's a big reason how they make money. The US has no laws to protect individuals' personal data. The US has no restrictions on what data can be collected and stored beyond the weak and easily bypassed age checks.

Non-technical people have no real understanding about how easy and effortlessly it is to log, store, and analyze every keystroke, mouse movement, mouse click, touch gesture, search query, location, picture, video, audio, document, email, phone call, website visit, instant message, etc. And they have no concept that the largest tech companies also buy personal data from smaller companies to supplement their own.

The US needs protections for privacy now.

Re: Stop trusting Amazon, Google, Facebook, et al

[Anonymous Coward]

Authoritarian regimes are the new black

Re: And Google Admins Read Your Email...

[Anonymous Coward]

On those rinky dink systems?

But they hold their employees to a HIGH STANDARDS!

[laxr5rs]

Well, I'm sure they have people watching employees all the time and none of the files ever escape. Right?

Stable door. Horse.

[Anonymous Coward]

"In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."

Newsflash: if you allow your employees unfettered access of this sort, you have already lost the game. It's too late once you "find bad actors". You need to set things up so that as much as possible, bad actors can't do these things.

Or in other words: preventative measures, not reactive measures, are what you want. Sure, there will be some employees who need that sort of access. So you lock it down to the maximum you can manage.

This is privacy 101. That they got this stuff wrong does not speak well for the rest of their systems.

Opps, they are selling the videos

[theCat]

OP: Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access."

Translation: They are selling the videos to 3rd-parties.

Goddamn.

Re:Opps, they are selling the videos

[Anonymous Coward]

You can check if your videos were included in the leak here

Re:“NOPhttps://yro.slashdot.org/comE!”

[Anonymous Coward]

Yeah, this seems like a "step 1: install cameras everywhere" for your "convenience" or "security". Step 2: allow law enforcement to have access, monitor when someone is home, etc.. I fear we will look back on this decade as when the groundwork was laid for the rest of our privacy to be taken away. So many of us willingly.

IF ONLY

[Laserfuzz]

If only there were some way they could WATCH their employees remotely......any ideas anyone?

Badly titled post

[Anonymous Coward]

Why say "Nest competitor Ring" ? Doesn't everybody on Slashdot already know who Ring is, for better or worse? Also, Ring was in this space long before Nest. Having just dealt with a service nightmare on my Nest thermostat, where I was given entirely inaccurate information by the Nest support representatives, I don't think they deserve headline status on this posting (which I suspect may have been put there by a Googler).

Re:Badly titled post

[dromgodis]

No, but neither did/do I know what Nest is. At least now I know that they compete in whatever they do.

Re: USA needs GDPR

[Anonymous Coward]

When my American saas company had to make changes to deal with GDPR I thought it sucked st first but after reading key sections of the gdpr and summaries of the rest I realized the EU was right about something for once and we should follow them in this regard.

My data is mine. Fuck Zuckerberg and Page and Gates and Bezos and the rest of the fat bastards making money buying and selling me. Who I am and what I do, like, hate, eat, talk to, travel to, buy, sell, think about or anything else is none of your god damned business.

I want to be anonymous, unknown, and forgotten. GDPR for USA.

(And no my company does not track people, we are help other companies manage their finances but still got caught up in GDPR compliance).

So what's the problem?

[Jason1729]

This is why I (and likely most people around here) refuse to buy these cloud cameras. For all the people who did buy into it, they were warned and warned that this sort of thing was almost a given. Now what are they upset about?

Better than what it was

[WindBourne]

They were/possibly still are giving China full access to our rings.
Quite honestly, we will be switching to Nest doorbell in the near future. I want to be able to see my doorbell from Google Assistant, as well as I like the constant circular recording.

Any good RTSP camera options?

[edi_guy]

Just wondering if anyone has experience with a roll your own system using RTSP cameras. Any cheap cameras you can recommend that are usable without sending data to the cloud? I tried my hand hacking a couple of the cheap XiaoFang cameras ( https://github.com/samtap/fang...) but haven't been successful to date.

Would love 2-3 such low powered cameras I could get to record locally using VLC or similar. Just a basic set-up.

Re:Any good RTSP camera options?

[ledow]

It depends on what you want. A doorbell that shows you who's at the door?

Literally anything.

If you can get an RTSP stream (which virtually all cameras, and even the cheapest of NVRs will do, even if they have custom apps), you can make your own, and better.

The cheapest NVR off Amazon will give you a bunch of cameras, a RTSP stream address to access each, network connectivity, H264 recording, and an "alarm" interface (which you literally wire to the doorbell so when it's pushed the "alarm" activates which can be used to alert you / send a text/email / etc. to your phone, trigger recording.

If you want to talk-back... you just buy a GSM door entry panel with voice. When they press the button it rings a phone number. You answer and talk to them. Or if someone has rung your doorbell, you ring it and speak to the guy. Press # (or whatever) and you can configure it to activate a relay / maglock to open the door if you like.

Commodity stuff, available everywhere, dirt cheap, used by businesses the world over.

The "glue" to make it all work nicely together isn't complex at all, and that's really all these companies are selling you, for an ongoing monthly payment, with all kinds of privacy and data issues (think: If these guys can monitor your cameras, they can disable them too... especially if they have a friend in the area, know which house is the rich guys, and can see everything and everyone coming and going into the house... turn off camera, phone your friend, keep an eye out for the fuzz... maybe it's in an audit log somewhere but you and I both know that such logs will miss a lot, and could be rendered useless by someone just using the new-guy's PC / login when he's having a day off).

Re:The white supremacist is upset about blacks aga

[Anonymous Coward]

How many times have white supremacists killed someone for exactly that reason, you cowardly faggot? Just wondering how ready to die for the nazi cause you are. Wanna find out? Pussy little inbreds, lol.

Remember kids, always resort to name calling to get your point across.

It's Amazon. Of course they do.

[DogDude]

I'd be shocked, SHOCKED if there was a part of Amazon that didn't collect all of the data that they could. That's what they do. That's how they make money. Of course they're looking at your stuff. You're PAYING THEM TO.

former Ring-er here

[Anonymous Coward]

it's true. If you have a Ring, you're an unwitting cam whore. We often passed around funny clips (mostly people tripping, getting hurt, getting hit in the balls, etc). I saw more than one video of a woman blowing the delivery guy. (or maybe it was just role play?). I saw some snuff films, too. Can't really forget that. It was an open secret that some people were collecting fuck videos, people walking around naked, etc. Some of the shit I saw just creeped me out.

I'd assume they always had access.

[antdude]

Arlo, Ring, Nest, etc. Probably the same from our own government like NSA! :P

Re:The white supremacist is upset about blacks aga

[Anonymous Coward]

How many times have white supremacists killed someone for exactly that reason, you cowardly faggot?

Thanks for asking.
Over the last 200,000 years, as of January 9, 2019, 34 people of the wrong color were killed by white supremacists for walking in the neighborhood.

"Ring" of ...spies? TL/DNR

[Anonymous Coward]

"Trust Us! What could POSSIBLY go wrong?!?"

(In response to the report, Ring said: "We have strict policies in place for all our team members. We implement systems to restrict and audit access to information. We hold our team members to a high ethical standard and anyone in violation of our policies faces discipline, including termination and potential legal and criminal penalties. In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them.")

Let's connect the dots...

[SethJohnson]

• Amazon owns Ring
• Jeff Bezos owns Amazon
• Jeff Bezos installs Ring cameras in his epic mansion
• News coverage reveals MacKenzie Bezos, spouse of 25 years is divorcing husband Jeff Bezos
• News coverage reveals security lapse regarding Amazon internal access to Ring recordings
• New Bezos girlfriend announced: Lauren Sanchez!
• MacKenzie Bezos becomes wealthiest woman in the world
• Jeff Bezos no longer wealthiest man in the world

Re:But they hold their employees to a HIGH STANDAR

[demon driver]

Possibly; after all, they've got all the gear at hand that's necessary!

Ahh you work for Google

[Anonymous Coward]

And are but hurt they kicked you out of China.

Even worse

[Anonymous Coward]

And even worse, I heard that Russia has full access to our president's anus and they can watch anytime they want.

Re: Even worse

[Anonymous Coward]

No no, this is fake news. There is no camera there.. in there. Only remotely controller vibrating butt plug that Putin can personally turn on when he is happy with The Donald.

And this is why I don't use any cloud services.

[Anonymous Coward]

Esp Microsoft - Think Windows 10 isn't a cloud service? In this case, Telemetry. Your Samsung TV, Onkyo recvr with horrifying privacy policies similar to google? Yup, horrifying privacy policy. If you don't care about your data, use a cloud service. Think you're ok even if you pay for it? Hahaha, that's adorable.

Re:“NOPhttps://yro.slashdot.org/comE!”

[Anonymous Coward]

Don't get me wrong; I think this Ring shit is creepy as all get out, especially with this latest news.

But I did have one thought where -- in one particular situation -- having cameras around your house accessible by law enforcement *might* be desirable. What if someone was swatting you and instead of the cops busting down your door and shooting your dog, they tuned into your home's cameras and realized they were being fooled.

Of course, this devil's advocate scenario could be rendered moot with some sensible reform to police procedures so they can't be manipulated as easily, but realistically I don't think our society is anywhere close to being capable of demilitarizing the police.

Crackhead moderators

[L. J. Beauregard]

The above is not "Score 4, Insightful." It is "Score -1, Idiot."

What is surprising is

[Anonymous Coward]

That people thought this wasn't going to happen.

It probably even says in the ToS that the company has access to the camera "for technical support and other" reasons.

People if you put a live streaming device in your home (camera, mic, other sensors) you are in fact bugging your home. As soon as that device is connected to the interwebs you must understand that its not who, not if, not how, but WHEN will it be used to spy on me. And that answer is typically, at the exact time you didn't want it to.

This connected world we live in is ridiculous.
People, we are knowingly fulfilling the big brother state prophecy and we can't seem to do it fast enough.

Dump Ring

[Anonymous Coward]

So Ring doesn't dispute that their employees invaded customer privacy!?!

Dump Ring. Don't trust companies which make you access video from their servers. Only buy devices which still work even when disconnected from the Internet, and which store video files locally.

Own your data.

The best part

[Anonymous Coward]

Ring’s software has for years struggled with these fundamentals of object recognition. [] Ring used its Ukrainian “data operators” as a crutch for its lackluster artificial intelligence efforts [] Behind all the computer sophistication was a team of people drawing boxes around strangers, day in and day out, as they struggled to grant some semblance of human judgment to an algorithm.

So they're not spying on people because they're creeps, they're doing it to pretend they have AI. And in the accompanying screenshot you see a person in full view tagged as "vehicle 3".

The home IoT device model is broken

[GaryBright]

This sort of behavior from device makers is just abhorrent. Is there any decent camera setup that can allow only the user to access features? I mean I want to be able to check the video from my phone, but I want to use a firewall in front of any device so that it can't talk outbound to ANYTHING else including the vendor's networks. My phone isn't likely to have a consistent IP address and I don't know if any company offers security camera's that don't depend on any vendor interaction for the features to work. We have got to push the IoT industry to have LAN side only access and user only interaction, where no trust is given to the device vendor and there is little or no opportunity for remote exploit, but we need to have decent ways to interact securely when we want to interact with IoT devices remotely. Maybe allow LAN and VPN allowed, but no public internet in or out?