Nest Competitor Ring Reportedly Gave Employees Full Access To Customers' Live Camera Feeds (9to5google.com)

Amazon-owned Ring allowed employees to access customers' live camera feeds, according to a report from The Intercept. "Ring's engineers and executives have 'highly privileged access' to live camera feeds from customers' devices," reports 9to5Google. "This includes both doorbells facing the outside world, as well as cameras inside a person's home. A team tasked with annotating video to aid in object recognition captured 'people kissing, firing guns, and stealing.'" From the report: U.S. employees specifically had access to a video portal intended for technical support that reportedly allowed "unfiltered, round-the-clock live feeds from some customer cameras." What's surprising is how this support tool was apparently not restricted to only employees that dealt with customers. The Intercept notes that only a Ring customer's email address was required to access any live feed.

According to the report's sources, employees had a blase attitude to this potential privacy violation, but noted that they "never personally witnessed any egregious abuses." Meanwhile, a second group of Ring employees working on R&D in Ukraine had access to a folder housing "every video created by every Ring camera around the world." What's more, these employees had a "corresponding database that linked each specific video file to corresponding specific Ring customers." Also bothersome is Ring's reported stance towards encryption. Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access." In response to the report, Ring said: "We have strict policies in place for all our team members. We implement systems to restrict and audit access to information. We hold our team members to a high ethical standard and anyone in violation of our policies faces discipline, including termination and potential legal and criminal penalties. In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."

Comments

Duh

[sexconker]

What did you think would happen?

Re:Duh

[swillden]

What did you think would happen?

That some (perhaps most) of these companies would cut corners and do the wrong thing was inevitable. But the implication of your question is that it's inevitable everywhere, which is not true. It's perfectly possible to construct a system so that no employees have access to the content other than those who need it to troubleshoot specific problems at customer request, and even those are closely audited and monitored. Yes, even the sysadmins can be disallowed access, through use of encryption and separation of responsibilities applied both to the system architecture and to the groups of administrators who manage different elements of the system.

I know this can be done because I've seen it done (and participated in doing it), including regular pen testing and ongoing security analysis to ensure it's tight and stays tight. It's not even that expensive to do on a large scale. It's challenging for startups to do well, but can be done even there; liberal use of cloud computing helps because it's easy to put the bulk data processing in a location where it's physically inaccessible to all of your employees, and logical access can easily be partitioned among admins. Appropriate use of encryption is essential, to ensure that no system in isolation (and therefore the managers of that system) has access to sensitive data in plaintext. Then you just need to carefully architect, control and audit the ways in which ciphertext and decryption keys can be brought together.

Re:commentsubject

[Anonymous Coward]

Wait, wot? Having a camera on your porch is the same as harassing black citizens and wasting police resources? I don't see it. I think you're simple and/or upset about something unrelated.

Let me fix that for you.

[taustin]

In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."

I think you mean "if we get caught with bad actors."

The worst acting here is pretending this wasn't all done intentionally.

Call me a shitposting troll if you must,

[HotNeedleOfInquiry]

But anyone that trusts their privacy to Ring gets what they deserve.

Re:commentsubject

[suutar]

wanting to know which of my cats is walking on the countertop makes me a busybody?
wanting to know when the UPS guy drops off a package on my front porch makes me a busybody? ... I'm still not seeing it.

Get the DEBARK Smart Video Doorbell

[JustAnotherOldGuy]

I recommend that instead of Ring, people should get the DEBARK Smart Video Doorbell.

It's less expensive (~$78 on Amazon) and it can record to SD card, SDVR, or a cloud service of your choosing (optional). Comes with a free remote indoor chime, and from what I understand, it's easy for it to connect to your old doorbell chime. Can be used wired or wireless. Two-way audio, and very good night vision capability.

Ring is waaaaaay overpriced and they force you to use their paid cloud service. Yes, it's only $3 a month, but why be forced to pay anything? The cheaper models won't let you do anything besides receive alerts and watch live video.

And, for the record, I have no connection to DEBARK, I just think their wireless doorbell is FAR better than the crap that Ring puts out.

Opps, they are selling the videos

[theCat]

OP: Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access."

Translation: They are selling the videos to 3rd-parties.

Goddamn.

Re:commentsubject

[zugmeister]

Funny, I always thought the phrases "authoritarian asshole" and "SJW cunt" belonged together.
Before you get upset, name me three SJW causes that don't attempt to assert control over others.

Re:Not just Nest

[JaredOfEuropa]

Done and done. I found having a doorbell with a camera in it is very useful (we don’t have Ring though), but you can be sure that sucker shares a separate VLAN with the other security cameras, with no access to the internet. And when we are at home, the indoor cameras have their power cut physically. Until we see CEOs in jail for such blatant unsafe practises, I’ll always double down on privacy measures when using IoT devices. And after that day... I’ll continue to do so. It is not hard to enjoy a little convenience without sacrificing or risking your privacy.

Re:“NOPE!”

[JaredOfEuropa]

To be fair, it sounds like Amazon had little to do with this snafu. Not malice, not a desire for customer data, but simple negligence combined with bone shattering stupidity. Even so I agree with your sentiment: connected products that belong to data mining firms like Amazon and Google are doubly tainted. A voice assistant would make a great addition to my smart home setup but I am not adding one until they can be run off the cloud.