Ring Enhances Camera Encryption to Address Privacy Issues
Ring has introduced a new method to safeguard your video footage called TAKE, which stands for Throw Away the Key Encryption. This innovative approach aims to protect your videos without relying on traditional end-to-end encryption. With TAKE, access to your videos by Amazon’s cloud is limited, while still allowing features like smart alerts for people and packages, AI-driven video search, and video descriptions.
The rollout of TAKE began in September and will be the default encryption for all Ring users, regardless of subscription status.
This development comes at a time when Ring is under significant scrutiny due to its connections with law enforcement and the privacy concerns surrounding its AI-powered Search Party feature. According to a Ring spokesperson, TAKE alters the type of information the company can provide to law enforcement, allowing only non-video data and encrypted video files to be shared. However, it doesn’t completely eliminate the privacy concerns associated with cloud-based cameras.
TAKE employs unique, rotating encryption keys for your footage, which are stored securely and can only be accessed under strict conditions based on your account settings. Currently, Ring footage is encrypted during transmission to the cloud and while stored, but it is decrypted for processing smart features. With TAKE, the encryption keys change every five minutes, and while Ring keeps copies of these keys for decryption, they are discarded within 24 hours, ensuring you maintain control over your videos.
The encryption method is based on Messaging Layer Security, an open standard developed by the Internet Engineering Task Force. While inspired by the privacy principles of end-to-end encryption (E2EE), TAKE operates differently. E2EE means Ring has no access to the keys and cannot process your video for cloud features. Newer cameras support both TAKE and E2EE, while older models only support TAKE.
Ring’s white paper details the management of these keys within an AWS Nitro Enclave, which is designed to restrict access through various security measures. The keys are permanently deleted after 24 hours, allowing for the processing of current cloud features without retaining backups. To access older footage, an authorized device must request the keys for that session, and key delivery is push-only, meaning Amazon’s servers cannot remotely access your keys.
If you lose access to your device, Ring offers several recovery options, all of which are customer-controlled, including cloud backup, passphrases, and camera-based recovery. However, if all recovery methods fail, access to encrypted content will be lost.
The white paper explains how keys are generated and emphasizes that old keys are continuously discarded. Ring is committed to enhancing this architecture.
While TAKE provides a level of security, it is not as robust as E2EE. Ring retains access to the keys for up to 24 hours and can retrieve them when you access older videos. You can also share keys with authorized users, which is not possible with E2EE. The primary goal of TAKE is to maintain cloud-based features that would otherwise be lost with E2EE, but this still involves the privacy trade-offs associated with cloud processing.
Competitors like Reolink and Eufy offer local storage and processing options, which eliminate the need for cloud involvement. Ring does provide local processing through its Ring Alarm Pro hub, but this is not compatible with E2EE.
Many of Ring’s features rely on cloud processing, including Unusual Event Alerts and Video Search, which cannot function locally on camera hardware.
When asked about privacy concerns related to law enforcement access, Ring clarified that with TAKE enabled, only non-video information and encrypted video files can be provided in response to valid legal requests. The Community Requests program remains unchanged, allowing customers to choose whether to respond to requests for footage.
Ring also confirmed that there are no backdoors for government access to TAKE, as such a feature would compromise the security and privacy that TAKE aims to provide. The company only trains on publicly available recordings or those for which users have given explicit permission.
While TAKE has not undergone independent evaluation, it is built on a recognized standard, and Ring has published a detailed technical white paper explaining its functionality.
Overall, Ring’s TAKE seeks to balance security, privacy, and convenience, offering a middle ground between the robust privacy of E2EE and the cloud features that users expect from their cameras. However, since TAKE involves trusting Ring and Amazon with the key management process, users should weigh their options carefully.
