Nest Competitor Ring Reportedly Gave Employees Full Access To Customers' Live Camera Feeds (9to5google.com) 120
Amazon-owned Ring allowed employees to access customers' live camera feeds, according to a report from The Intercept. "Ring's engineers and executives have 'highly privileged access' to live camera feeds from customers' devices," reports 9to5Google. "This includes both doorbells facing the outside world, as well as cameras inside a person's home. A team tasked with annotating video to aid in object recognition captured 'people kissing, firing guns, and stealing.'" From the report: U.S. employees specifically had access to a video portal intended for technical support that reportedly allowed "unfiltered, round-the-clock live feeds from some customer cameras." What's surprising is how this support tool was apparently not restricted to only employees that dealt with customers. The Intercept notes that only a Ring customer's email address was required to access any live feed.
According to the report's sources, employees had a blase attitude to this potential privacy violation, but noted that they "never personally witnessed any egregious abuses." Meanwhile, a second group of Ring employees working on R&D in Ukraine had access to a folder housing "every video created by every Ring camera around the world." What's more, these employees had a "corresponding database that linked each specific video file to corresponding specific Ring customers." Also bothersome is Ring's reported stance towards encryption. Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access." In response to the report, Ring said: "We have strict policies in place for all our team members. We implement systems to restrict and audit access to information. We hold our team members to a high ethical standard and anyone in violation of our policies faces discipline, including termination and potential legal and criminal penalties. In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."
According to the report's sources, employees had a blase attitude to this potential privacy violation, but noted that they "never personally witnessed any egregious abuses." Meanwhile, a second group of Ring employees working on R&D in Ukraine had access to a folder housing "every video created by every Ring camera around the world." What's more, these employees had a "corresponding database that linked each specific video file to corresponding specific Ring customers." Also bothersome is Ring's reported stance towards encryption. Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access." In response to the report, Ring said: "We have strict policies in place for all our team members. We implement systems to restrict and audit access to information. We hold our team members to a high ethical standard and anyone in violation of our policies faces discipline, including termination and potential legal and criminal penalties. In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."
Duh (Score:5, Insightful)
What did you think would happen?
Re:Duh (Score:5, Insightful)
What did you think would happen?
That some (perhaps most) of these companies would cut corners and do the wrong thing was inevitable. But the implication of your question is that it's inevitable everywhere, which is not true. It's perfectly possible to construct a system so that no employees have access to the content other than those who need it to troubleshoot specific problems at customer request, and even those are closely audited and monitored. Yes, even the sysadmins can be disallowed access, through use of encryption and separation of responsibilities applied both to the system architecture and to the groups of administrators who manage different elements of the system.
I know this can be done because I've seen it done (and participated in doing it), including regular pen testing and ongoing security analysis to ensure it's tight and stays tight. It's not even that expensive to do on a large scale. It's challenging for startups to do well, but can be done even there; liberal use of cloud computing helps because it's easy to put the bulk data processing in a location where it's physically inaccessible to all of your employees, and logical access can easily be partitioned among admins. Appropriate use of encryption is essential, to ensure that no system in isolation (and therefore the managers of that system) has access to sensitive data in plaintext. Then you just need to carefully architect, control and audit the ways in which ciphertext and decryption keys can be brought together.
Re: (Score:2)
That some (perhaps most) of these companies would cut corners and do the wrong thing was inevitable. But the implication of your question is that it's inevitable everywhere, which is not true. It's perfectly possible to construct a system so that no employees have access to the content other than those who need it to troubleshoot specific problems at customer request, and even those are closely audited and monitored.
The fact that your data is stored on their servers guarantees that these kinds of things can happen. They even say WHY they keep that data: To monetize it!
I don't think people realize what the real trade is here. People who buy (why do they have to pay for it?) these devices are essentially allowing an external entity to place a camera in their home to monetize any data that the camera can capture, things such as routines, demographics, etc. It just so happens that the person purchasing this device can also
Re: (Score:2)
That some (perhaps most) of these companies would cut corners and do the wrong thing was inevitable. But the implication of your question is that it's inevitable everywhere, which is not true. It's perfectly possible to construct a system so that no employees have access to the content other than those who need it to troubleshoot specific problems at customer request, and even those are closely audited and monitored.
The fact that your data is stored on their servers guarantees that these kinds of things can happen.
This need not be true, though it takes deliberate effort and discipline on the part of the company. The company as a whole certainly has access to your data, but they can structure things so that no employee does, and that the ways in which the data can be used by the systems and people are limited to the ways that customers know and expect.
They even say WHY they keep that data: To monetize it!
This also need not be true. Nest, for example, explicitly says that it does not.
commentsubject (Score:2, Insightful)
phonehome device owners shocked to learn device is phoning home
welcome to the future
welcome to Cloudthing, Smartproduct, and Alwaysonline
this is for your safety
this is for your convenience
this is for your user experience to be reliable and carefully controlled
this is not for our sake
Re: (Score:3, Insightful)
Wait, wot? Having a camera on your porch is the same as harassing black citizens and wasting police resources? I don't see it. I think you're simple and/or upset about something unrelated.
Re: commentsubject (Score:2, Insightful)
I think there should be no privacy, especially for those in power.
Re: (Score:3, Insightful)
Re:commentsubject (Score:5, Informative)
wanting to know which of my cats is walking on the countertop makes me a busybody? ... I'm still not seeing it.
wanting to know when the UPS guy drops off a package on my front porch makes me a busybody?
Re: (Score:3)
Wanting to know who is at the door without having to go up to the door is not "being a busy body"
It's also far safer. The person on the other side can't shoot through the door and hit you if you're not near the door. They also can't use a key fob scanner on you because you won't be in range. Plus, you can see if someone is stealing your packages, and have proof of it.
Re: (Score:2, Insightful)
WTF?
All SJWs are authoritarian assholes. Your post makes no sense.
Re: (Score:2, Insightful)
It's not about what they do (it's certainly not fighting injustice). It's how they do it. They use authoritariand and downright facist methods to push their ideology on others.
Re: (Score:1)
yeah yeah keep retreating and conflating it with diplomacy
Maybe one day you'll be a real victim.
So bloody sick of your childish misunderstanding of your own belief that you should have authority without having to do anything for it.
Re: commentsubject (Score:2, Insightful)
SJW answer to everything - government control. Social control when they do not have sufficient political power.
How is that not authoritarian?
Re: (Score:1)
Your argument would carry more weight if their wasn't a sib poster that was exactly what you claim doesn't exist.
Re: (Score:1)
"SJW answer to everything - government control." - As opposed to hiring hitmen? Yes they seek a legislative and judicial, regulated solution to the problem of justice. Which would you prefer?
If you want to propose a non-government solution to achieving justice for the poor, the weak, the old, the young, the vulnerable, I'm sure the world would listen. If however you've got nothing? Then stop whining.
Re: (Score:3, Insightful)
Before you get upset, name me three SJW causes that don't attempt to assert control over others.
Re: (Score:1)
Funny, I always thought the phrases "authoritarian asshole" and "SJW cunt" belonged together.
Before you get upset, name me three SJW causes that don't attempt to assert control over others.
The only people that can name a single SJW cause are the same people that invented the term SJW, because it's just a big straw man.
Re: (Score:3)
First give a definition of of SJW that actually encompasses any people and isn't applicable to moe or less anyone of any politicial orientation you don't like.
Crackhead moderators (Score:2)
The above is not "Score 4, Insightful." It is "Score -1, Idiot."
Re: (Score:2)
How about black lives matter? It's about decreasing police violence against blacks by empowering people to challenge excessive police violence and take action in the
Re: (Score:2)
SJW
Aah, shaddap.
cunt
Misogynist much?
Re: (Score:3, Interesting)
Are those different from the kind of cowards who rob someone of the wrong colour walking in the neighborhood?
Just wondering.
Let me fix that for you. (Score:5, Insightful)
In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."
I think you mean "if we get caught with bad actors."
The worst acting here is pretending this wasn't all done intentionally.
Call me a shitposting troll if you must, (Score:5, Interesting)
Re: (Score:2)
But anyone that trusts their privacy to Ring gets what they deserve.
Similarly Alexa, though this privacy violation far exceeds the former as far as creepiness is concerned.
What a shame... (Score:1)
It's almost as if people are just begging to be taken advantage of.
Here, let me pre-order this game, for this console I cannot control from this company that really abused their customers last time.
Here, let me buy this product or service that has been repeatedly reported in the news as being used to spy on me.
Here, let me keep using this website, service, or institution that sells my private information for money.
Here let me keep voting for this lying son-of-a-bitch because that other liar is somehow worse
Not just Nest (Score:2)
Re:Not just Nest (Score:5, Insightful)
Re: (Score:2)
Can you provide any further detail about your set-up? Under what contexts are you able to see the camera feed? I'm particularly interested in whether you can receive notifications offsite, and if so, how.
Get the DEBARK Smart Video Doorbell (Score:5, Informative)
I recommend that instead of Ring, people should get the DEBARK Smart Video Doorbell.
It's less expensive (~$78 on Amazon) and it can record to SD card, SDVR, or a cloud service of your choosing (optional). Comes with a free remote indoor chime, and from what I understand, it's easy for it to connect to your old doorbell chime. Can be used wired or wireless. Two-way audio, and very good night vision capability.
Ring is waaaaaay overpriced and they force you to use their paid cloud service. Yes, it's only $3 a month, but why be forced to pay anything? The cheaper models won't let you do anything besides receive alerts and watch live video.
And, for the record, I have no connection to DEBARK, I just think their wireless doorbell is FAR better than the crap that Ring puts out.
Re: (Score:2)
I am more interested in this model, after dealing with the RING for my parents.
Looks like a solid Chinese clone of the RING, and the SD card and de-mount notifications are appreciated.
I've not heard of SDVR, and was wondering if it can dump stuff to a NAS on the same network? I just don't know what the heck SDVR means. Google wasn't much help.
Or, if it's the other way, does it just keep the SD card network shared so you can review videos whenever?
Re: (Score:2)
I've not heard of SDVR, and was wondering if it can dump stuff to a NAS on the same network?
SDVR just means "security DVR", it's just the box that connects all the cameras and stuff together in a security system.
I don't know about dumping stuff to a NAS, but I would think that it could be done one way or another.
Re: (Score:3)
If you're not at home when somebody rings the doorbell, will you get the notification and be able to launch the viewer app on your phone in time to see who rang the bell before they're in their car backing out of your driveway?
It's not entirely Ring's fault (Google kind of pulled the rug out from under them with regard to push notification timing post-Marshmallow), but the real-world massive time lag was probably the biggest disappointment when I got mine 2 years ago. From my own experience, if you aren't a
Re: (Score:2)
Re: (Score:2)
Or how about a raspberry zero W woth a camera and a button.
I think it would be a fair bit of work to achieve the same functionality with a Pi, but I'm no expert on the Raspberry Pi stuff.
Maybe someone else here can tell us if that would be a practical solution or not.
Ring TV! (Score:2)
It is a new Netflix Reality Show.
Want a camera at home? (Score:3)
Build your own CCTV network.
Network your own CCTV to a wider network you designed, understand and trust.
Don't let camera and microphones connect to network you did not set up.
“NOPE!” (Score:2)
Once considered a Nest thermostat, then Google bought them out, and decided “NOPE!”
Same thing when Amazon bought Ring: “NOPE!”
Today I feel validated in my decisions.
Re:“NOPhttps://yro.slashdot.org/comE!” (Score:1)
Yeah, this seems like a "step 1: install cameras everywhere" for your "convenience" or "security". Step 2: allow law enforcement to have access, monitor when someone is home, etc.. I fear we will look back on this decade as when the groundwork was laid for the rest of our privacy to be taken away. So many of us willingly.
Re:“NOPE!” (Score:4, Insightful)
Re: (Score:2)
Not malice, not a desire for customer data, but simple negligence combined with bone shattering stupidity.
Looking for the best in people and situations is usually a good quality to exhibit. Unfortunately, if you are not diligent enough, you may find yourself excusing terrible and fully intentional behaviour....
This is in the summary:
Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access."
Note the words, "lost revenue opportunities".
Have a nice day Mr. Europa. :)
Stop trusting Amazon, Google, Facebook, et al (Score:2, Informative)
If you are a technologist, then lead the way. Gently educate your family and friends that *everything* is tracked by these companies, especially by the large tech firms that offer "free" services. These companies do not respect privacy or personally identifying information (PII) because it's a big reason how they make money. The US has no laws to protect individuals' personal data. The US has no restrictions on what data can be collected and stored beyond the weak and easily bypassed age checks.
Non-technica
But they hold their employees to a HIGH STANDARDS! (Score:1)
Re: (Score:2)
Possibly; after all, they've got all the gear at hand that's necessary!
Stable door. Horse. (Score:1)
"In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."
Newsflash: if you allow your employees unfettered access of this sort, you have already lost the game. It's too late once you "find bad actors". You need to set things up so that as much as possible, bad actors can't do these things.
Or in other words: preventative measures, not reactive measures, are what you want. Sure, there will be some employe
Opps, they are selling the videos (Score:5, Insightful)
OP: Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access."
Translation: They are selling the videos to 3rd-parties.
Goddamn.
IF ONLY (Score:2)
If only there were some way they could WATCH their employees remotely......any ideas anyone?
Re: (Score:2)
No, but neither did/do I know what Nest is. At least now I know that they compete in whatever they do.
So what's the problem? (Score:2)
Better than what it was (Score:2)
Quite honestly, we will be switching to Nest doorbell in the near future. I want to be able to see my doorbell from Google Assistant, as well as I like the constant circular recording.
Any good RTSP camera options? (Score:2)
Just wondering if anyone has experience with a roll your own system using RTSP cameras. Any cheap cameras you can recommend that are usable without sending data to the cloud? I tried my hand hacking a couple of the cheap XiaoFang cameras ( https://github.com/samtap/fang... [github.com]) but haven't been successful to date.
Would love 2-3 such low powered cameras I could get to record locally using VLC or similar. Just a basic set-up.
Re: (Score:2)
It depends on what you want. A doorbell that shows you who's at the door?
Literally anything.
If you can get an RTSP stream (which virtually all cameras, and even the cheapest of NVRs will do, even if they have custom apps), you can make your own, and better.
The cheapest NVR off Amazon will give you a bunch of cameras, a RTSP stream address to access each, network connectivity, H264 recording, and an "alarm" interface (which you literally wire to the doorbell so when it's pushed the "alarm" activates which c
It's Amazon. Of course they do. (Score:2)
I'd assume they always had access. (Score:2)
Arlo, Ring, Nest, etc. Probably the same from our own government like NSA! :P
Let's connect the dots... (Score:2)
The home IoT device model is broken (Score:1)