Amazon’s Ring video doorbell allows you to see who is at (or near) your doorstep. Under a semi-secret program called “Neighbors” it also allows the police to see the same thing. The program incentivizes police to “sell” the Ring device to consumers (even giving the police free surveillance devices themselves) and creates a network whereby consumers can “voluntarily” share the results of their video with the police, who in turn can use this data, access or share it with others.
But is the opt in sharing truly “voluntary?” That’s not really clear.
Amazon’s website promoting the Ring Neighborhood Watch says that participants can “Get real-time crime and safety alerts from your neighbors and local law enforcement.” The site says the system can “create stronger communities. Or more accurately more paranoid ones?
“Only the content that a user chooses to make publicly available on Neighbors (by posting it to the App) can be viewed via the Neighbors App or by local law enforcement. … Only content that a Neighbors user chooses to share on the Neighbors App is publicly accessible through the Neighbors App or by your local law enforcement. Ring does not view or share a user’s videos that are not posted to the App without the user’s express permission or a valid and binding legal demand properly served on us.”
So, my first question, as a lawyer is, “what the heck is a ‘valid binding legal demand, properly served on us?” A subpoena? A search warrant? What about a search warrant issued by a magistrate in Kansas City to Amazon in Seattle? Is that “properly served on [Amazon?]” And what if there’s an exigency – a kidnapping, etc., and the data is needed immediately? No video for the police cause no “valid binding legal demand?” Typically, when you write confidentiality agreements, you explain under what circumstances you will be compelled to produce someone else’s records (and these ARE someone else’s records) AND you give THEM notice and an opportunity to object to the disclosure of their records. Not here. A “legal demand” and a warrant or a subpoena are not the same thing. And does this impose on Amazon a duty to challenge and appeal the demand? When does the demand become “binding?” Technically, a subpoena is not self-enforcing. If you ignore it, the issuer has to move to either enforce the subpoena with a court order (a motion to compel), or to have some sanction (a motion for contempt). So is a subpoena in and of itself “binding?” I think not. It’s quite possible that your video will be accessible to the police without your knowledge or consent.
So much for privacy.
But you can still “opt out,” right? Not so fast.
Whenever a person refuses to “cooperate” with a law enforcement demand, they run the potential for criminal prosecution. For example, in Virginia, the obstruction of justice law says that “If any person without just cause knowingly obstructs any law-enforcement officer in the performance of his duties as such ..” they are guilty of a crime. Virginia courts have interpreted this statute broadly to include refusal to cooperate with police, or a refusal to obey an officer’s directions or “orders” as long as that refusal impedes the investigation.
In fact, TechData has reported that law enforcement agencies either have access to (or had access to) or can extrapolate from data available to them, the identity of individuals who have refused to cooperate with a request (demand) for footage. Couple this with threats of prosecution for “obstruction” or “interference” (even if not really supported by what the law provides) and you have the potential for a surveillance state. In fact, even if Amazon is NOT providing refusal data to the police, if they have such data, it’s available to the police by subpoena or other demand.
So, if you are a Ring user, you should assume that your data stream CAN be hacked by bad guys, and if you are a neighborhood watch participant, you should assume that it WILL be obtained by your neighbors and probably by the police. Just like your cell phone data, your GPS data, an all of the myriad other bits of digital detritus you create every day.
The Ring device is pretty cool, and helpful in a lot of situations. The real problem is that you THINK you have control, when you probably don’t. A better approach would be that the stream is encrypted with YOU holding the key. Then you really get to control who has access. Unless you get subpoenaed yourself. Perhaps the best approach is to let people knock on the door. No chimes, no doorbell, no camera. And then you can choose to open the door or hide and hope they go away.
Mark Rasch is an attorney and author of computer security, Internet law, and electronic privacy-related articles. He created the Computer Crime Unit at the United States Department of Justice, where he led efforts aimed at investigating and prosecuting cyber, high-technology, and white-collar crime.