Amazon subsidiary Ring, which manufactures home surveillance equipment and cameras, has "partnered" with more than 600 law enforcement agencies across the country, giving police access to users' footage. And while Ring says they set conditions on how and when they want to share that footage with the police, everything the police do with it is in retrospect completely out of their hands, the company says.
The cooperation between the Ring and the police, and the terms of the agreements, have not been transparent to the public. Instead, they have come out in bits and pieces in media outlets throughout the year. Sen. Ed Markey (D-Mass.) In September demanded clearer answers from Amazon about Ring and published the company's response this week.
In the response pair (PDF 1[ads1], PDF 2), Ring repeatedly derives responsibility for the content of captured footage to consumers who catch it and the police departments that procure it.
Who else is watching on viewers?
Amazon last week in August agreed to publicly share a list of where it has police cooperation. At that time there were 405 such agreements. However, as of November 15, the map now has 630 police cooperation, an increase of more than 50%.
Customers who buy ring systems for their homes can connect to an app called Neighbors. Police working in partnership with Ring have a companion app for neighbors that allows them to solicit user input in a given geographic area when relevant to an investigation.
What the police do after that, however, is a mystery where Ring says it has no part.
"Call does not require law enforcement to delete material shared through a video request after a certain time," the company said. Law enforcement departments set their own record-keeping conditions in accordance with the laws of their jurisdiction and can retain it as long as they see fit.
Amazon and Ring also have no minimum security requirements for user recording. Partners use their own "requirements, protocols and security measures" to protect all Ring data they obtain. And they can share it with whomever they want: "If videos are downloaded by law enforcement, Ring does not require police departments to consent to further restrictions," the company said, citing potential law on public records and police investigation.
"Call continuously seeks ways to maximize transparency and user control, including adding additional information on how video recording can be used when a customer agrees," the company added.
"Voluntary" data and privacy
Amazon has repeatedly said throughout the year that Ring users must volunteer to share their footage in response to a police request. In August, the company told Ars that participating law enforcement agencies must go through Ring to request admission, adding, "Customers can choose to opt out or reject any request, and law enforcement agencies have no visibility into which customers have received a request and who have opted out or rejected. "
The minimum area for requesting admission is 0.025 square miles, Call told Markey most recently, to prevent police from targeting certain people. Maximum region is 0.5 square miles to prevent wide carpet. The maximum time frame for data the police can request is 12 hours, and they can only receive recordings that are less than 45 days old.
In some neighborhoods, homes may be dense enough to effectively mask the identity of someone within a radius of a few blocks. But in lower-density neighborhoods that are zoned for detached houses, it can be trivial for police to determine which home within a 0.025 square mile radius uses a camera, regardless of whether they share footage willingly, and which residents they may wish to speak to with.
However, Ring said it believed that "state and federal procedures, regulations and statutes serve to ensure that police departments do not open investigations or seek information for improper purposes."
Respecting users and non-users' privacy is also the camera owner's problem, Amazon said.
"The Amazon Ring guidelines are an open door for privacy and freedom violations," Markey said in a statement after Amazon's response. "If you are an adult walking with your dog or a child playing on the sidewalk, you should not have to worry about Rings products gathering footage of you, and law enforcement can keep that footage indefinitely or share that footage with someone third parties. "
Especially the Children
And yet it seems that Ring itself has no result from displaying images under 13 years of age if it is good for their marketing. For example: 15.8 million ring door bells were ringed during 24-hour Halloween, the company said in a blog post.
The company shared some harmless data about all these tricks-or-treaters. (The east coast peak time was around 6:30 pm, while the west coast kids peaked about 20 minutes later, but apparently.) But the company also released a promotional video using captured Halloween footage, including several very clear pictures of children both with and without their parents present.
The website Mashable asked Ring about the parents' consent to their children's appearance in the promotional video, but the company did not respond.
Ring's Terms of Service allow, BuzzFeed pointed out earlier this year:
You grant Ring and its licensors an unlimited, irrevocable, fully paid and royalty-free, perpetual, worldwide right to reuse, distribute, store, delete, translate, copy , modify, display, sell, create derivative works from and otherwise exploit such shared content for any purpose and in any media format in any media channel without compensation to you.
All Your Face Belongs to Us
Markey Press Also Call several times about using face recognition technology. The company replied that it does not use any face recognition yet, but may do so in the future.
What Ring users choose, however, affects not only homeowners who purchase the systems, but also everyone who comes close to their house for one reason or another.
"Associated door bells are well on their way to becoming a mainstay for American households, and the lack of privacy and civil rights protection for innocent residents is nothing short of relaxing," Markey said in his statement – a sentiment reflected by civil liberties organizations and advocates.
"Through consumer products such as Ring, Amazon collects images and all the data needed to build a nationwide surveillance network," Fight for the Future deputy Evan Greer said in a statement. "They are leveraging government relations to market their own products, gain consumer confidence and secure their position in the market. This is a unique attack on our security, constitutionally protected rights and communities," Greer added, asking Congress to launch an investigation.
The American Civil Liberties Union and the Electronic Frontier Foundation have also repeatedly expressed concern about Ring, about face recognition and about both of them.
State Attorney Mohammad Tajsar of the Southern California ACLU told the Associated Press that the potential for face recognition in Ring products raised significant concerns. "Even if you don't sell data or provide data for law enforcement, you create a mechanism where people can express latent biases and racism and classism in a portal that encourages it," he said.
We're Not Through
A group of senators, including Markey, found Amazon's response inadequate. Senators Ron Wyden (D-Ore.), Chris Van Hollen (D-Md.), Chris Coons (D-Del.) And Gary Peters (D-Mich.) Joined Markey in a new letter (PDF) dated in today with questions about pointed follow-up questions, especially about Amazon's handling of consumer data.
"Ring's emphasis on security and security has not always extended to the vast amount of data it collects, retains and shares," the senators wrote, citing a vulnerability that sent passwords for WiFi networks in plain text.
In addition, the senators wrote, Amazon has reportedly sent recordings to entrepreneurs in Ukraine and apparently still does. "Please describe the process that US data is accessed by employees or contractors in Ukraine or any other country" outside the United States, the letter asks.
Amazon is also told to provide data on how many consumers own Ring devices; what kind of encryption call uses for the data; what data storage or deletion policy is applied to the data; what employees, and where, have access to what content, and why; which consumer-identifying data may be included in the content; and what the company plans to do with face recognition in the future.
Amazon has until January 6 to respond to the latest round of questions.