The FTC Says Ring Home Cameras Let Employees Watch

The Federal Trade Commission says Ring home cameras gave employees and contractors a way to watch customers, and gave hackers a way to take the camera over. In May 2023 the FTC charged Ring with letting any employee or contractor reach private video, with using customer video to train algorithms without consent, and with security gaps that let attackers control accounts, cameras, and videos. A federal order entered on 16 June 2023. The FTC's press release is the public record. The case file is still the place to read the complaint and the order.

Trust is a camera whose operator is the person who mounted it. Security is a clip that never sits where a stranger with a company login can open it. Incentive is a porch that still rings without a monthly seat in someone else's video library. Ring camera footage in a vendor account is the opposite shape. The person paid for the doorbell. The company kept the file.

Era 4 is the Home Companion: the doorbell stays, the vendor cloud does not. DLDeploy is how a local ESP32 camera is being built to talk to the Home Computer. This page is the public case for why that path matters.

What The FTC Charged About Ring Home Cameras

The complaint says access was wide on purpose. A customer-service agent who needed one household's video to fix a ticket could also open video belonging to thousands of people who never called. An engineer working on a floodlight camera could open footage from inside bedrooms. Employees and contractors could view, download, and transfer that video for their own purposes.

The FTC says Ring also used customer videos to train algorithms, among other purposes, without consent. After the company later narrowed who could look, it still could not say how many other people had looked. It had not built the basic record that would show an inappropriate view. The consumer alert puts the same facts in plain language: employees spied through cameras in bedrooms and bathrooms, and the same failures left videos of kids open to attackers.

The order requires a privacy and security program, deletion of customer videos and face embeddings obtained before 2018, deletion of work products made from those videos, notice to customers, and notice to the FTC when video is accessed or exposed without authorization. It also requires $5.8 million, to be used for consumer refunds. In April 2024 the FTC said it was sending those refunds.

How Ring Camera Footage Left The House

Ring camera footage had more than one door. Staff could open the library. Attackers could take the account. Police could ask the company for the file. Each door assumes the clip lives with Ring, not with the household.

One Employee Searched Ring Home Cameras By Room Name

The FTC complaint describes a single employee, from June through August 2017, viewing thousands of recordings belonging to at least 81 female users. The users included customers and Ring employees. The searches favored camera names that marked an intimate room: "Master Bedroom," "Master Bathroom," and "Spy Cam." On hundreds of occasions across those three months he looked through the videos, often for an hour or more in a day.

Ring did not catch it with a control. Another employee noticed and reported it. The complaint says a supervisor first called that volume of viewing normal for an engineer. The viewing stopped when the supervisor saw that the cameras being opened were of "pretty girls." The people on the cameras had named the rooms for their own house. Those names became a search index for someone they had never met.

Hackers Reached Children Through Ring Camera Footage

The same complaint says weak protections let hackers take control of accounts, cameras, and videos. The FTC's consumer alert is specific about what followed. Hackers harassed, insulted, and propositioned children and teens through the cameras. Some livestreamed customer video. A doorbell sold as a way to see the porch became a speaker in the room, pointed the wrong direction.

That is the cost of a camera that must sign in to a vendor before it can do its job. The account is a second set of keys. Whoever holds the account holds the lens and the speaker. NIST's Zero Trust guidance treats every device as its own boundary. A Ring login sits outside that boundary, in a region the household does not operate.

Police Received Ring Camera Footage Without The Owner

The Electronic Frontier Foundation reported that Ring had given police video, without a warrant and without the owner's consent, 11 times already in 2022. The stated reason was an emergency involving imminent danger of death or serious physical injury. There was no judge, and no owner, in the decision that the emergency was real. The same article records a different, larger practice: in 2020, police requested videos from Ring owners more than 20,000 times, as bulk asks across a neighborhood.

In January 2024 Ring said it would stop facilitating those warrantless requests to users. EFF called that a real change and kept the warning: police can still ask the person at the door, and a company that holds the file can still be told to keep a path open. Ring camera footage stored by the company is footage the company can be asked to hand over.

Where Ring Home Cameras Can Send The Clip Instead

The porch camera is a useful object. The failure is the address book. A clip that is a file on the Home Computer can still buzz the phone in the house. It does not need a library that customer support, an engineer, a hacker, and a police portal can all reach by different doors.

The Home Companion is that household. The Home Computer is where the file sits. The two other public cases on this site are the TRENDnet baby monitor and the Eufy no-cloud cameras.

The Clip From Ring Home Cameras Can Stay In The House

MATA Home is the computer in the house, not a region you rent. A sensor that can only call that computer has nowhere to put a second copy. The Freedom Guide walks the household through bringing files home. A doorbell clip is one of those files. The phone in the kitchen can still show it. The showing happens because the house has the file, not because a vendor account is awake.

A Capability Beats A Shared Ring Login

Callers on MATA present a capability: a signed grant, scoped, expiring, and revocable. A support agent does not inherit every camera in the product. An engineer on a floodlight does not inherit the bedroom. Revocation is the owner withdrawing the grant. That is the access story in what a distributed cloud is. Ring home cameras failed because one login was treated as a reason to see the whole library.

DLDeploy Keeps The Next Porch Camera On The LAN

DLDeploy is the house path for an ESP32 that should never open a vendor cloud. We are building the direct integrations so a board flashed that way can talk to the Home Computer. A porch camera on that path still rings. The clip stays a file at home. Janus is the doorway between the pins and the house, and a camera without a cloud is the same idea in the firmware. The FTC record is the reason to want the clip to have only one address.