Ring, the Amazon-owned security company, has agreed to pay $25 million to settle federal charges it misused consumers' doorbell video.
Back in the day when we weren’t living in an Internet of Things-driven world, about the only interactions we had with the front door at our house was a traveling salesman or some kids ringing the doorbell and running off.
But then, Ring and video doorbells came to town and before we knew it, we could watch things like porch thieves grab our Christmas presents or strangers appearing out of nowhere.
However as those video doorbells become more commonplace, a different kind of trouble could come knocking: people spying on you or hacking into your private doorbell videos.
The Federal Trade Commission (FTC) thinks that Ring has been a little too sloppy in that regard, that its poor privacy and lax security have let its own company employees spy on customers through their cameras.
And it’s not just the front door, either – it’s the Ring cameras in bedrooms and bathrooms. In the FTC’s mind, that was a step too far that made customers' videos, including videos of kids, susceptible to online attacks.
Where Ring went too far
Those “attacks” were another step over the line with the agency. It claims that hackers exploited Ring’s security flaws and “harassed, insulted, and propositioned” both young children and teens through their Ring cameras. Some hackers even did the unthinkable by live-streaming customers’ videos.
“During a three-month period in 2017, a Ring employee viewed thousands of videos of female users in their bedrooms and bathrooms, including videos of Ring’s own employees,” is how the FTC’s Lesley Fair narrated one particularly disturbing instance.
“Rather than detecting what the employee was up to through its own technical controls, Ring only learned about the episode after a female employee reported it. That’s just one example of what the FTC calls Ring’s “dangerously overbroad access and lax attitude toward privacy and security.”
Ring agrees to settle this fight. Is Amazon next?
Ring has cut a deal with the FTC to put all of this to rest. In a settlement announced by the agency, Ring has agreed to create a privacy and security program and delete every single video that it shouldn’t have in its possession. Plus, the company has agreed to pay $5.8 million to affected customers for its wrongdoing.
In a separate move, the FTC is taking action against Amazon for pretty much the same thing. The agency says that Amazon failed to protect Alexa users’ or children’s privacy.
“Amazon promised parents they could ‘manage their content and devices’ and delete their children’s voice recordings, but [in the FTC’s way of thinking], the company didn’t always fulfill parents’ deletion requests, kept children’s sensitive voice data indefinitely, and put people’s data at risk of harm from unnecessary access,” Jim Kreidler, a consumer education specialist, said.
She added that the agency feels that Amazon also failed to fulfill Alexa users’ requests to delete their voice and geolocation information. Instead, Amazon kept using that information for their algorithms.
The FTC has proposed an order that would, among other things, require Amazon to pay $25 million, change its deletion practices, and implement strong privacy safeguards.
Do you have a video camera at home? Here’s how to keep prying eyes away.
The FTC is taking action against companies that do not protect your private information, especially sensitive biometric information, like videos and voice recordings, that are tied to who you are.
Until it wrestles all the culprits to the floor, though, consumers are going to have to do some work of their own to protect themselves. If you have video cameras at home, here’s what else to know and do.
Look at the settings: Check if you’ve taken the FTC’s seven essential steps to secure your home security cameras. If you use an app to manage your access, review the privacy settings and permissions.
Ask that your data be deleted: You may reside in a state that gives you the right to tell companies to delete your data. Use the U.S. State Privacy Legislation Tracker to find out if your state is one of them.
Parental rights: “As a parent, you have control over the personal information companies collect online from your kids under 13,” Kreidler said. “Any site attempting to collect personal information from your child has to get your consent, and it has to honor your choices about how that information is used.”
Concerned parents can learn how to protect their child’s privacy online here.
