How Ring is rethinking privacy and security

Ring is now a major player when it comes to consumer video doorbells, security cameras — and privacy protection.

Amazon acquired the company and promotes its devices heavily on its e-commerce websites. Ring has even become a cultural phenomenon with viral videos being shared on social networks and the RingTV section on the company’s website.

But that massive success has come with a few growing pains; as Motherboard found out, customers don’t have to use two-factor authentication, which means that anybody could connect to their security camera if they re-use the same password everywhere.

When it comes to privacy, Ring’s Neighbors app has attracted a ton of controversy. Some see it as a libertarian take on neighborhood watch that empowers citizens to monitor their communities using surveillance devices.

Others have questioned partnerships between Ring and local police to help law enforcement authorities request videos from Ring users.

In a wide-ranging interview, Ring founder Jamie Siminoff looked back at the past six months, expressed some regrets and defended his company’s vision. The interview was edited for clarity and brevity.

---

TechCrunch: Let’s talk about news first. You started mostly focused on security cameras, but you’ve expanded way beyond security cameras. And in particular, I think the light bulb that you introduced is pretty interesting. Do you want to go deeper in this area and go head to head against Phillips Hue for instance?

Jamie Siminoff: We try not to ever look at competition — like the company is going head to head with… we’ve always been a company that has invented around a mission of making neighborhoods safer.

Sometimes, that puts us into a place that would be competing with another company. But we try to look at the problem and then come up with a solution and not look at the market and try to come up with a competitive product.

No one was making — and I still don’t think there’s anyone making — a smart outdoor light bulb. We started doing the floodlight camera and we saw how important light was. We literally saw it through our camera. With motion detection, someone will come over a fence, see the light and jump back over. We literally could see the impact of light.

So you don’t think you would have done it if it wasn’t a light bulb that works outside as well as inside?

For sure. We’ve seen the advantage of linking all the lights around your home. When you walk up on a step light and that goes off, then everything goes off at the same time. It’s helpful for your own security and safety and convenience.

The light bulbs are just an extension of the floodlight. Now again, it can be used indoor because there’s no reason why it can’t be used indoor.

Following Amazon’s acquisition, do you think you have more budget, you can hire more people and you can go faster and release all these products?

It’s not a budget issue. Money was never a constraint. If you had good ideas, you could raise money — I think that’s Silicon Valley. So it’s not money. It’s knowledge and being able to reach a critical mass.

As a consumer electronics company, you need to have specialists in different areas. You can’t just get them with money, you kind of need to have a big enough thing. For example, wireless antennas. We had good wireless antennas. We did the best we thought we could do. But we get into Amazon and they have a group that’s super highly focused on each individual area of that. And we make much better antennas today.

Our reviews are up across the board, our products are more liked by our customers than they were before. To me, that’s a good measure — after Amazon, we have made more products and they’re more beloved by our customers. And I think part of that is that we can tap into resources more efficiently.

And would you say the teams are still very separate?

Amazon is kind of cool. I think it’s why a lot of companies that have been bought by Amazon stay for a long time. Amazon itself is almost an amalgamation of a lot of little startups. Internally, almost everyone is a startup CEO — there’s a lot of autonomy there.

The one thing that really interested me in the announcement earlier this week is the control center that you talked about. When did you come up with the idea and thought, okay, we need to have a dedicated menu about security and privacy and focus more on that?

So we’ve been looking at this for a long time. We redid our privacy policy. We’ve been on this sort of concept of trying to bring more digestible transparency to our customers. It’s not that we’re changing the way we do things, it’s that we’re trying to make it so that our customers can understand it easier.

When you go to a privacy page, it’s 30 pages long with legal jargon — you have to do that as a company. But from a customer point of view, you want to take and put sentences that they can read and then five sentences see the main things and understand what you’re going to do with their video.

The control center is the next extension of that. We want people to be able to make sure they’re doing all the right security things and that they understand what is happening on there — who’s logged into their account, what is linked to their account, is two factor authentication enabled.

And then on our Neighborhoods side, we do work with law enforcement. We want our customers to understand that they are protected and that they have the choice of how to interact with that.

Let’s talk about security first. Do you think you are responsible in a way for people who are re-using passwords, not enabling two-factor authentication?

I look at security as two things. First, making sure that Ring was secure — and Ring was secure. From all the investigations we had, we were not breached. Then, you offer your customers all the tools that they could need to be safe.

At this point, I realized that you need to go one step further as a company whose mission is to make neighborhoods safer. I’m not making someone’s neighborhood safer if I’m not ensuring that they are doing the right things. So now, we’re going one step further, which is for two-factor authentication. We really want to make it an opt-out, not an opt-in.

You still want to let people opt out of it because there are people that just don’t want it. You don’t want to force it, but you want to make it as forceful as you can be without hurting the customer experience.

As for passwords, we would have never told people you have to use a different password for every place around the internet. Because to me, that’s outside of Ring’s circles. Every company has to decide what it does for a customer. And I’ve decided that that it is now part of our job.

If your username and password show up on the dark web, we’re going to send you an email. It’s not just about us being breached. We care if it’s Ring, but we actually care more about telling you that it is something that’s going to happen to you and hurt you.

Have you made some changes on the login front when it comes to rate-limiting, IP addresses — alerts when it’s a new IP address, for instance?

So we’ve always had the best things in place. We don’t disclose what we’re doing just because that also enables hackers to look at different ways of getting around. But I can tell you that we have lots of teams focused on this and looking at, not just best in class, but really industry-leading things.

Our view now is that we are the industry leader in IoT and that we now need to actually invent new things and then bring those back into the industry.

Let’s talk about privacy now and Neighborhoods in particular. You’ve attracted a ton of attention over the past few months — let’s put it this way. Do you think a lot of people raised red flags because you’re part of Amazon? Or do you think it’s just because people are not ready for that concept yet?

I think a lot of people wrote a lot of articles that included a lot of misinformation around how we do things. We had been very clear with what we were doing.

And so I do think that that was a problem with the law enforcement stuff. There were a lot of articles that came out that insinuated that we were giving law enforcement video. It is not true. We have never had a system that would give law enforcement video without you not knowing.

Here’s the way our system works, which we built, which I think is a good thing for society. Currently, if a police officer needs video to help solve a crime, they would have to go into your neighborhood and knock on your door and they’re going to ask you: “Hey, that camera there, can I get the video from that?”

It’s inefficient for the police. You don’t want your police officers spending their time doing that. You want them doing things that make society better and it’s not a very good use of a police officer’s time.

We created a system where police could ask in an area when something happens and say: “Hey, do you have any video from this?” You get the request. It’s anonymous so they don’t see who they’re requesting, too. You say “no,” they have no idea that you said “no.” You can say: “I never want to see one of these again.”

When you say “yes,” in that case you are giving them video. They know who you but you are opting into that. I think that system is actually very good for society. We’ve seen great examples of it used in areas that have helped solve crimes across the country.

What is the ratio between people saying, “okay, that’s alright, I’d like to share video,” and people saying “no?”

We don’t release that ratio because that would actually be invading the privacy of the customer. We release how many requests have been made by the police. We release which police are on the system. But I can tell you that our customers overall seem to be very pleased with what we are doing and very happy to work with their local law enforcement to solve crimes.

So you talked about opting out of receiving requests. I believe this is not live yet?

That’s been live since we launched the first law enforcement agency on the system. When you would get the first request is when you could opt out of it. But you weren’t able to proactively opt out of it. So we’ve been doing emails and campaigns and saying, if you want to opt out of it, you can opt out.

We had a middle ground and now it’s going in Control Center where you can just see it and just opt out.

It feels like you’re one step closer to switching to opting in…

Yeah, I think we’re one step closer of that.

And why didn’t you choose opting in?

First of all, it’s a new system that no one has ever seen before. And secondly, we weren’t giving your information to anyone. It really came down to that first request.

For this one, we’ll keep it as an opt-out but it’s going to be very transparent in the Control Center.

Let’s talk about Neighborhoods in general. What has been the reaction so far from communities?

It’s been a hugely popular thing for us. To me, the success of it is stories like Salem getting kidnapped in Texas. It was caught on a Ring video doorbell. That video then led to her being brought back to her family in less than 24 or 48 hours.

Do you think by empowering communities to track what’s happening in a neighborhood, there’s a risk that local police is not going to invest as much time and effort to patrol around the neighborhood?

To me, it’s the opposite. Even if you patrol 12 times a day, that’s maybe 12 minutes in front of the houses on a 24-hour day. What we’re doing is helping police and neighbors and communities come together. So when something happens, they can now see it and use that information to be more efficient in how they go about things. And that’s really my goal — to make it all more efficient.

There are some players like Apple who are promoting end-to-end encryption for video feeds. Have you thought about that?

We can get back to you on that with the specifics of our encryption and stuff. [Update: Ring tells me it encrypts video footage both in storage and transmission. Ring also stores video on encrypted Amazon Web Services servers.]

Are videos encrypted at rest on the server, who owns the keys?

We might not be at that level because we don’t own the device. I think those are interesting things though. The way our products work in terms of sharing with other people in your house, some of those key things break down pretty quickly because you can’t have multiple users on an account and have a key.

But I do think those are the things we need to keep looking. I think that, you know, security, privacy and control are things we just have continue to build on for the next 20-30 years. Apple’s done a great job on it and I think we need to become industry leading and even invent for the industry.

Going back to Neighborhoods, given the reaction that that has been going on for the past year, do you think you would have launched it the same way as as you did?

Whenever you have a controversial reaction to something you’re doing, I think you would like to go back and say: “How could we have had people understand this better?”

But I honestly don’t know how we could have done that differently because we haven’t changed the systems at all. Everyone deserves scrutiny, especially important and powerful companies, people, devices, brands that are doing things that aren’t… especially in areas of security, privacy, this kind of areas.

The Control Center is a good one for us to say that we do recognize the fact that we are an important company or brand for our customers. I think the only things I’d ever like to do differently is when I’ve done something wrong. And I really believe, not only did we not do anything wrong here, but Salem getting back to her family is enough for me to say: “I’ll take some scrutiny.”