Amazon finally admits giving cops Ring doorbell data without user consent | Ars Technica

More than 10 million people rely on Ring video doorbells to monitor what's happening directly outside the front doors of their homes. The popularity of the technology has raised a question that concerns privacy advocates: Should police have access to Ring video doorbell recordings without first gaining user consent?

Ring recently revealed how often the answer to that question has been yes. The Amazon company responded to an inquiry from US Senator Ed Markey (D-Mass.), confirming that there have been 11 cases in 2022 where Ring complied with police "emergency" requests. In each case, Ring handed over private recordings, including video and audio, without letting users know that police had access to—and potentially downloaded—their data. This raises many concerns about increased police reliance on private surveillance, a practice that has long gone unregulated.

Ring says it will only "respond immediately to urgent law enforcement requests for information in cases involving imminent danger of death or serious physical injury to any person." Its policy is to review any requests for assistance from police, then make "a good-faith determination whether the request meets the well-known standard, grounded in federal law, that there is imminent danger of death or serious physical injury to any person requiring disclosure of information without delay."

Critics say it shouldn't be left up to Ring and the police to decide when data can be accessed or how long that data can be stored.

"There are always going to be situations in which it might be expedient for public safety to be able to get around some of the usual infrastructure and be able to get footage very quickly," says Matthew Guariglia, a policy analyst for Electronic Frontier Foundation, a nonprofit dedicated to protecting civil liberties online. "But the problem is that the people who are deciding what constitutes exigent circumstances and what constitutes the type of emergency, all of these very important safeguards, are Ring and the police, both of whom, as far as I know, don't have a great reputation when it comes to deciding when it's appropriate to acquire a person's data."

To improve the situation, Guariglia wants regulators to lay more ground rules limiting how much police can rely on private surveillance. He also wants companies like Ring to take more steps to protect users from potentially unlawful surveillance by changing the doorbell's default settings to turn audio recording off and automatically store data to prevent third parties, including the police and Ring, from accessing it.

Ring refused to commit to doing either. The company says that it only stores data for users with subscription plans, and those users can easily choose to use higher security settings if desired. Responding to Ars' request for comment, Ring would not share whether 11 cases of sharing data without user consent in 2022 was higher or lower than average; the company supplied a prior statement pushing back against media reports that question Ring's judgment on when to share data with police:

"It's simply untrue that Ring gives anyone unfettered access to customer data or video, as we have repeatedly made clear to our customers and others. The law authorizes companies like Ring to provide information to government entities if the company believes that an emergency involving danger of death or serious physical injury to any person, such as a kidnapping or an attempted murder, requires disclosure without delay. Ring faithfully applies that legal standard."

Markey is counted among Ring's biggest critics, seeming to suggest in a statement that Ring might be sharing data with police in less high-stakes circumstances by referring to Ring's law enforcement policy as having a "so-called 'emergency circumstance exception.'" In his response, Markey agreed with Guariglia that changing Ring default settings would immediately enhance data security for potentially millions of users. Absent those changes, the senator says Ring leaves its users open to threats, which could include potential invasions of privacy, self-surveillance risks, surveillance of First Amendment activities, and coercion, among other risks.

"As my ongoing investigation into Amazon illustrates, it has become increasingly difficult for the public to move, assemble, and converse in public without being tracked and recorded," Markey said.