Forgot your password?
Close
typodupeerror
Encryption Security

Ring Says New Encryption Limits What It Can Give Police (theverge.com) 36

Posted by BeauHD from the throw-away-the-key dept.
Ring is rolling out a new default encryption system called TAKE, or "Throw Away the Key Encryption," that rotates video keys every five minutes and permanently deletes Ring's copy after 24 hours. The system is designed to preserve cloud features such as smart alerts and AI video search while limiting what Ring can provide under legal process to non-video account information and encrypted footage. The Verge reports: Ring says TAKE uses unique, rotating encryption keys for your footage, stored in a secure enclave and accessible only under strict conditions -- based on the features you enable on your account. Currently, footage captured by Ring cameras is encrypted in transit to the cloud and at rest, and then decrypted for Ring to process for those smart features. With TAKE, the encryption keys change for every five minutes of footage. Ring stores copies of those keys to decrypt the footage, but throws away each copy within 24 hours, "leaving you with the keys and full control of your videos," according to Ring.

TAKE was developed using Messaging Layer Security, an open standard from the Internet Engineering Task Force, according to Ring. The company says it is "inspired by the privacy principles of E2EE (end-to-end encryption)," which Ring offers on some of its cameras. However, the two systems work differently. With E2EE, Ring never has the keys and can't process your video for cloud-based features. Both options are available on newer cameras that encrypt on-device, and you can switch between the two. Older cameras encrypt at cloud ingress and only support TAKE.

According to a white paper the company published today, Ring's copy of those keys is managed inside an AWS Nitro Enclave, to which Ring's access is restricted by "access controls, cryptography, and hardware isolation." The company claims there is no persistent storage and no way for a Ring employee to access it. The stored keys can only be unlocked by the enclave through cryptographic attestation that proves it's running the exact software image Ring approved. The enclave releases a temporary key when an enabled service requests it. When asked about what happens if Ring is subpoenaed by law enforcement, a spokesperson for the company said: "Where TAKE is enabled, Ring will only be able to provide non-video information (such as basic subscriber information) and encrypted video files in response to the valid legal process. We have updated our Law Enforcement Guidelines to reflect this change."

Ring Says New Encryption Limits What It Can Give Police More | Reply

Ring Says New Encryption Limits What It Can Give Police

Comments Filter:
  • They still have the keys.
  • Now that "Ring" is known to collect surveillance data on such a massive scale, they probably just want to invent some "reasons" why future buyers of that data will have to pay a higher price... like "because somebody has to copy the keys to the customer before they are deleted on Ring's servers".

  • Still plenty of time to utilize in a manhunt for diss^H^H^H^H escaped convicts.

    • How often does that happen? Meanwhile stranger-initiated outdoor or home-invasion rapes and street murders are happening at tens of thousands annually most of them going unsolved and barely mentioned in the police blotter let alone news (which 99% of people dont watch anyway).

      Reference: https://bjs.ojp.gov/library/pu... [ojp.gov]

      • Re: (Score:2)

        by SeaFox ( 739806 )

        How often does that happen?

        How often do political dissidents disappear? Something tells me they don't make records for that public, unlike all the crimes they like to blame "illegals" for (ignoring the majority of arrests for these crimes are of Caucasians [fbi.gov]).

      • Did you miss the last year and a half of the news where dear leader has had his ICE brownshirts rampaging round the country? Did you miss all the news where the scum have NOT been limiting their presence and interactions solely to darkening the days of immigrants; but have also targeted, approached, tried to question, attacked, detained, "deported," and even murdered CITIZENS for refusing to bend the knee and love big brother? Did you miss the news where they didn't even wait a whole week, but were going

        • Sounds like more reasons we should have more surveillance not less. Or do you reckon the brownshirts won't surveillance to their own ends?

  • Almost like you own it (Score:4, Insightful)

    by gurps_npc ( 621217 ) on Thursday August 27, 2026 @05:20PM (#66310275) Homepage

    Wow, a couple more changes like this and RING uses will have almost as much rights as people that do not connect their hardware to other company's businesses.

  • Sure you do. Just like the USPS deletes their scans for routing instead of sending them to the feds

  • Seems reasonable (Score:5, Informative)

    by swillden ( 191260 ) <shawn-ds@willden.org> on Thursday August 27, 2026 @05:28PM (#66310293) Journal

    Companies should, in general, avoid keeping any user data one second longer than they legitimately need it. Data should be viewed as a liability more than an asset, and every company that achieves significant scale with user data soon realizes this, though some take longer than others to learn the lesson.

    The reason it's a liability is because it exposes the company to an endless stream of warrants and subpoenas, and contrary to popular belief, the government does not pay for that data. In some cases the government might pay a portion of the expenses the company incurs in responding, but it's always still a net loss, and most of the time the government just shows up with a court order and says "Hand it over or be held in contempt of court". What makes it even worse is if companies actually want to be good stewards of the data and not hand over more than they should, they'll often get overly-broad requests and then have to go to court to fight to narrow or quash the requests.

    This all gets very expensive. It's just a cost of doing business... but it's a cost that can be avoided if you don't have and can't get the data.

    Encrypt everything, and arrange to destroy the keys when you no longer need the data is the best way to do it, too. Scrubbing large databases quickly and effectively is hard. Deleting a set of AES keys is a lot easier. This also means that you can focus your internal access controls on controlling which systems and employees can get the keys.

    I'd encourage Ring to find ways to close the window of access even more.

    • Re: (Score:2)

      by abulafia ( 7826 )
      and contrary to popular belief, the government does not pay for that data

      It really depends. ATT makes substantial amounts [reason.com] on their LEO customers. I understand Verizon has a similar program, and after Worldcom, all smaller the telecom companies fell in line.

      Give Google and Zuckerbook and the others a decade of mature market profits and it'll get around to optimizing lines of business like that, too. They just make more money on other stuff now so they don't bother.

  • Surveillance protects us all. It is a keystone in keeping our nation safe and free. Think about how you never have a package stolen off your porch anymore. And how our bicycles are totally safe in San Francisco, no need to double lock and remove the seat anymore. And let us not forget that mass surveillance prevents terrible crimes like summary executions out at sea [pbs.org]. And even prevented a pedophile and adjudicated rapist from being elected President. GOD BLESS THE USA!

    • Re:The benefits of the surveillance state (Score:4, Insightful)

      by Powercntrl ( 458442 ) on Thursday August 27, 2026 @06:11PM (#66310360) Homepage

      If your packages were walking off, or people repeatedly were crashing into your parked cars in your driveway (that has happened to me no less than 4 times), you'd probably want to put up a camera, too. Hell, at this point I'd be half okay with installing a God damned Flock camera pointed at my driveway.

      I'd love to live in a society where we didn't need to put up cameras everywhere to hold people accountable for their bad behaviors, but all those examples you gave actually serve to further reinforce that we're clearly not living in such a society.

      • Putting in a camera is one thing, connecting it to the Internet is another, having it be cloud-connected is still another thing

      • If your packages were walking off, or people repeatedly were crashing into your parked cars in your driveway (that has happened to me no less than 4 times), you'd probably want to put up a camera, too.

        No less than fou...OK, if you don't have a PPV livestream set up by the end of this sentence, you're doing it wrong. Pass the popcorn and the 12-guage packing box triggers.

        Hell, at this point I'd be half okay with installing a God damned Flock camera pointed at my driveway.

        OK, let's not get all crazy now. Orwell is already up to 18,000RPM in the grave. Bastards saw his heat signature from space and decided to put it to use. He now powers a series of 144 Flock cameras. Fucking gross. I know.

      • Have you ever actually got charges filed from your footage of those people walking off with your packages or crashing into your parked cars? Or was it just to fulfill your sick curiosity?

        Sometimes there's an advantage to "whatever will be" and not obsessing over it.

        • There's an Oxford comma in there, so it's the car crashing thing that's happened four times, not package theft. Yes, thanks to the camera the responsible parties were held accountable.

          1. I had a 3rd party Amazon driver hit my car while turning around. They drove off, but it was caught on camera. Amazon covered the damages.
          2. The neighbor's teenage kid backed into my vehicle. Again, another driver who thought they could just play it off like nothing happened, but the camera caught them. There wasn't act

      • When I lived in San Jose a big Mexican dude would look out for my house when I was at work and once beat up a porch pirate. Later I found out it was his cousin he beat up.

  • It does, does it? (Score:4, Insightful)

    by MachineShedFred ( 621896 ) on Thursday August 27, 2026 @05:48PM (#66310329) Journal

    Seems their new encryption only limits what they can give law enforcement, until they are motivated to do otherwise.

    It's not like they can't push an update to the device to have it dump it's encryption key back to the mothership.

    If you don't want other people looking at it, get it off the cloud. Period.

    • It's not like they can't push an update to the device to have it dump it's encryption key back to the mothership.

      Yeah, or go back to the company-wide IT Disaster Recovery policy that likely enables data recovery for years to cover a myriad of compliance excuses coming from a legal department operating under America, Inc. laws within CONUS.

      (EFF Auditor) "OK, so yooou're saying it was your [air quotes] 'random' 'number' 'generator', that somehow scheduled a DR snapshot of the key database every 23 hours and 55 minutes, and copied it into 3,650 VMs for..'data' 'integrity' 'purposes'..."

  • Ring is rolling out a new default encryption system

    Interesting: Amazon-owned Ring is able to have new 'default' enabled (read: auto opt-in - the hard path) in an existing product/feature.

    Extra interesting: Also Amazon-owned Twitch somehow cannot figure out automatic opt-out [slashdot.org] (read: leaving it 'off' by doing nothing - the easy path -, and only enabling it when users turn it on - the harder path) on existing product service.

    • Ring is rolling out a new default encryption system

      Interesting: Amazon-owned Ring is able to have new 'default' enabled (read: auto opt-in - the hard path) in an existing product/feature.

      Extra interesting: Also Amazon-owned Twitch somehow cannot figure out automatic opt-out [slashdot.org] (read: leaving it 'off' by doing nothing - the easy path -, and only enabling it when users turn it on - the harder path) on existing product service.

      Settings are often derived from two trains of corporate thought; Fuck Yeah Profit or Legal Made Me Do It.

      'Easy' only comes into play if the lawyers remembered to budget for biodegradable water-based lube and not that double-whammy silicone-based shit the EPA loves to nail people for.

  • The stored keys can only be unlocked by the enclave through cryptographic attestation that proves it's running the exact software image Ring approved

    Hence they cannot update the software?

  • Trust Me Bro (TM) privacy.

  • and a gag order.

    Ring is no better than Flock. Expect Ring to soon support ALPR and facial recognition, it's inevitable.

  • This seems like a response to the public backlash against Flock. Good business move I suppose.
  • Or course they delete the video.. after extraction of metadata (events, key frames w/ identification), storing the video is only what they do for paid accounts

  • We all fully trust you!

  • They encoded it with base64?

Slashdot Top Deals

The only person who always got his work done by Friday was Robinson Crusoe.

Close