Whistleblower: Amazon Ring stores your doorbell and home video feeds unencrypted and grants broad "unfettered" access to them

Sources "familiar with Ring's practices" have told The Intercept that the company -- a division of Amazon that makes streaming cameras designed to be mounted inside and outside your home -- stores the video feeds from its customers' homes in unencrypted format and allows staff around the world to have essentially unfettered access to these videos.

Of particular note is a team of Ukrainian researchers who are charged with improving the product's facial recognition tools as part of the company's push to turn Ring doorbells into a private surveillance grid that conducts continuous streetwide surveillance and alerts homeowners of undesirable strangers near their homes (Ring's description of this program omits any mention of facial recognition, but leaked internal images clearly show facial recognition in action).

Since 2016, this team has had "virtually unfettered" access to every Ring customers' camera videos, which are stored in Amazon's S3 cloud without encryption.

In the USA, a broad group of engineers and executives are able to call up any customer's videos with no access controls, merely by searching on the customer's email address. The Intercept's source claims that Ring employees used this to spy on each others' romantic evenings, teasing each other about the people they'd brought home and exposed to a Ring camera.

Storing data in the clear means that a single unethical employee -- or security failure -- could expose every Ring customer in the world to privacy breaches. Granting broad internal access to this video significantly increases the likelihood of a breach. Read the rest