⚖️ Amazon Ring: FTC order seeks $5.8M over employee video access

Amazon's Ring drone camera is trending in search today, so here is the paperwork on the company's privacy record instead of the spec sheet. The headline entry: on May 31, 2023, the Federal Trade Commission filed a complaint and a stipulated final order against Ring LLC in federal court in Washington, DC. The FTC's press release says the proposed order requires Ring to pay $5.8M for consumer refunds. Ring said in a blog post, quoted by Ars Technica, that it disagrees with the FTC's allegations and denies violating the law.

What the FTC says Ring did

The complaint, filed as Case No. 1:23-cv-1549, alleges that before September 2017 Ring gave every employee, and hundreds of Ukraine-based third-party contractors, full access to every customer video, whether or not they needed it. It adds that the videos were stored unencrypted and that Ring ran no privacy or security training before May 2018.

The complaint also alleges that between June and August 2017 one employee viewed thousands of recordings belonging to at least 81 unique female users. The FTC's press release says the employee was stopped only when another employee discovered the conduct. It adds that Ring could not determine how many other employees inappropriately accessed videos, because it had not implemented basic monitoring.

On security, the complaint says Ring failed to implement multifactor authentication until 2019 despite credential-stuffing attacks in 2017 and 2018. It says approximately 55,000 US customers suffered serious account compromises. Ars Technica, summarizing the complaint, reported that fewer than 2 percent of customers adopted the optional feature in 2019. These are the FTC's allegations. No court has tested them.

The money and what the order requires

The $5.8M is earmarked for consumer refunds, the FTC says. The proposed order also requires Ring to delete customer videos and face embeddings it obtained before 2018, and any work products derived from them. It requires a privacy and security program with new safeguards on human review of videos, including multifactor authentication for employee and customer accounts. Ring must alert the FTC to incidents of unauthorized access and notify consumers about the FTC's action. The Commission voted 3-0 to authorize the complaint and order.

A stipulated final order has the force of law only once a district court judge approves and signs it, the FTC's release notes. Ars Technica reported that the settlement was pending a judge's approval and that Amazon did not admit any wrongdoing. For scale, Ars also noted that Amazon reported net income of $3.2 billion in the first quarter. You can do the division yourself.

Separate matter, same day: Ars reported that the FTC and the Department of Justice charged Amazon under COPPA, the US children's privacy law, over Alexa voice recordings. A pending settlement in that case would carry a $25 million fine.

The response and the earlier warnings

An Amazon spokesperson told Ars Technica that Ring "promptly addressed the issues at hand on its own years ago, well before the FTC began its inquiry." Ring's blog post, as quoted by Ars, said the complaint "mischaracterizes our security practices."

The access question predates the order. The Intercept reported in January 2019, citing an anonymous source, that Ring gave its Ukraine-based research team access to a folder holding every video from every Ring camera. A Ring spokesperson told the outlet that videos came only from publicly shared Neighbors posts and from users who gave explicit written consent. VentureBeat reported that Ring separately denied employees ever had access to livestreams.

In January 2024, Bloomberg reported that Ring would disable its Request for Assistance tool. Police and fire departments would then have to seek a warrant or show evidence of an emergency to get footage from users. That is a separate matter from the FTC order.

Which brings us back to the drone. TechCrunch reported in 2020 that the Always Home Cam would cost $249, and that Ring said the lens is physically blocked while the unit is docked and that it hums while flying, features the company says help ensure it operates with privacy in mind. A company with a $5.8M privacy line on the record has every reason to lead with that.