A lot of people simply don’t trust Ring or its parent company Amazon, and the entire TAKE system relies on users’ trusting both entities to adequately restrict access and to destroy encryption keys without making any backups of them or user footage.
We took a hard look at the concept of the initial 24-hour window during which Ring retains a copy of each decryption key, and we wondered in particular why the time period was so long. After all, Ring delivers “person is detected” notifications in roughly three seconds, so why hold on to access for a full day?
A Ring spokesperson told us that’s standard for processing the company’s current cloud-based features. We also consulted Tillson Galloway, a cybersecurity expert at Georgia Tech, who explained that while some sort of simple processing could be done faster and even locally on the camera, it would require a more powerful processor, which would raise the overall cost of the camera. Galloway noted that local AI processing may come at a cost in quality and value, as well. “Running on-device isn’t a free lunch, since your AI detections are probably lousier,” he said. “Sure, local AI is more ‘secure,’ but if it has enough false positives so that you can’t trust it, are you actually better off in the grand scheme of things?”
The other issue that concerned us regarding the 24-hour window was whether it would create a loophole for law enforcement or other parties to access user footage. A Ring spokesperson confirmed that wouldn’t be possible. “Where TAKE is enabled, Ring will only be able to provide non-video information (such as basic subscriber information) and encrypted video files in response to the valid legal process, even within the 24-hour period.”
Overall we’re cautiously optimistic about this new encryption system as a step in the right direction — a compromise between privacy and convenience.
For more information on TAKE, E2EE, and Ring’s privacy policies, check out Ring’s Privacy page.
This article was edited by Jon Chase and Grant Clauser.
