Ring, Google and the Police: What to Know About Emergency Requests for Video Footage

Ring, the Amazon-owned video doorbell and home security company, came under renewed criticism from privacy activists this month after disclosing it gave video footage to police in more than 10 cases without users' consent thus far in 2022 in what it described as "emergency situations." That includes instances where the police didn't have a warrant.

"So far this year, Ring has provided videos to law enforcement in response to an emergency request only 11 times," Amazon vice president of public policy Brian Huseman wrote. "In each instance, Ring made a good-faith determination that there was an imminent danger of death or serious physical injury to a person requiring disclosure of information without delay."

The disclosure, released in response to questioning from Sen. Ed Markey, a Democrat from Massachusetts, comes after years of extensive and controversial partnerships between Ring and various police institutions. Now privacy advocates at organizations like the Electronic Frontier Foundation say that warrantless footage requests endanger civil liberties.

"There is no process for a judge or the device owner to determine whether there actually was an emergency," EFF analysts Jason Kelley and Matthew Guariglia wrote in a post on July 15. "This could easily lead to police abuse: There will always be temptation for police to use it for increasingly less urgent situations."

Max Isaacs, a staff attorney with New York University's Policing Project and co-author of a 2021 audit of the Ring Neighbors app, says such fears are understandable.

"On the one hand, if there really is an emergency, if there's an armed shooter or if there's someone who's absconded with a child and time is of the essence, then disclosing the data without user consent to law enforcement could save lives," Isaacs said. "Those circumstances are very rare, but I think they exist. Another way of looking at it is, often when you give police an inch, they take a mile."

The issue raises key questions about consumer privacy rights and the proliferation of smart home data. But without the guidance of any meaningful federal privacy regulations, clear answers are difficult to come by. Still, here's everything you should know about the matter, along with a look at how the rest of the smart home industry handles law enforcement requests for user data.

Enlarge Image

What Ring is saying now -- and what it's not saying

As a company spokesperson explained it in a call and series of emails over the last week, Ring underscores a distinction between law enforcement requests for footage as part of an ongoing, nonurgent investigation, what it calls Requests for Assistance, and emergency requests that might be extraordinarily time-sensitive. 

"Law enforcement requests, including emergency requests, are directed to Ring (the company), the same way a warrant of subpoena is directed to Ring (and not the customer)," the spokesperson explained. "Every company is subject to receive an ER made by law enforcement -- the federal law allows law enforcement to make these requests."

Ring also told me that all requests from law enforcement, including emergency requests, are reviewed by dedicated members of the Ring legal team. For emergencies, Ring requires requesting police officers to fill out a two-page form (PDF) providing details about the emergency situation, including who is in immediate danger, what information they believe Ring to have, and how that information can assist in responding to the emergency.

"We also require officers to explain why there is not sufficient time to get a valid and binding legal demand like a search warrant," the spokesperson added. "We deny emergency requests when we believe that law enforcement can swiftly obtain and serve us with such a demand."

Of the 11 emergency requests Ring has complied with so far in 2022, the company said they include cases involving kidnapping, self-harm and attempted murder, but it won't provide further details, including information about which agencies or countries the requests came from.

We also asked Ring if it notified customers after the company had granted law enforcement access to their footage without their consent.

"We have nothing to share," the spokesperson responded.

A lack of transparency

It's been barely a year since Ring made the decision to stop allowing police to email users to request footage. Facing criticism that requests like those were subverting the warrant process and contributing to police overreach, Ring directed police instead to post public requests for assistance in the Neighbors app, where community members are free to view and comment on them (or opt out of seeing them altogether).

"Public safety agencies will only be able to request information or video from their communities through a new, publicly viewable post category on Neighbors called Request for Assistance," Ring said last June, when it announced the change via blog post. "All Request for Assistance posts will be publicly viewable in the Neighbors feed, and logged on the agency's public profile."

That post made no mention of a workaround for the police during emergency circumstances. I asked Ring why it left that out.

"When we introduced Request for Assistance posts, we deprecated our previous Video Request tool and made all 'requests for information or video from their communities' publicly viewable, as we noted in the blog," a company spokesperson explained. "Law enforcement requests, including emergency requests, are directed to Ring (the company), the same way a warrant or subpoena is directed to Ring (and not the customer), which is why we treat them entirely separately."

Additionally, while Ring has included its emergency request policy in its guidelines for working with law enforcement and its privacy policy, the same can't be said of Ring transparency reports about law enforcement requests from past years. For example, Ring's 2020 report on law enforcement requests details the number of search warrants, court orders and subpoenas Ring received, along with national security-based requests for user data filed under the Foreign Intelligence Surveillance Act, as well as how Ring responded to all of them – but there's no mention of warrantless emergency requests that lack independent oversight.

Ring had no response when I asked if the emergency request policy was in place when that report was released, and if so, why emergency requests were omitted from it. However, the emergency request process is mentioned in the NYU's Policing Project's audit of the Ring Neighbors app.

"We were aware of the exception," Isaacs told CNET when asked about the audit process, which began in 2020.

Not just a Ring thing

While Ring stands alone for its extensive history of police partnerships, it isn't the only name I found with a carve-out clause for sharing user footage with police during emergencies. Google, which makes and sells smart home cameras and video doorbells under the Nest brand, makes as much clear in its terms of service.

"If we reasonably believe that we can prevent someone from dying or from suffering serious physical harm, we may provide information to a government agency -- for example, in the case of bomb threats, school shootings, kidnappings, suicide prevention and missing persons cases," Google's TOS page on government requests for user information reads. "We still consider these requests in light of applicable laws and our policies."

Google's page also notes that the company will notify users when it receives a government or law enforcement request for their info unless legally prohibited from doing so.

"We might not give notice in the case of emergencies, such as threats to a child's safety or threats to someone's life," the policy adds, "in which case we'll provide notice if we learn that the emergency has passed."

A Nest spokesperson explained that the company reserves the right to make these emergency disclosures to law enforcement even in cases where there isn't a warrant, subpoena or other legal imperative compelling it to do so.

"Consistent with our terms of service and this site, we do make limited disclosures in the context of emergencies," the spokesperson said. "This legal basis for doing so is set forth in the Electronic Communications Privacy Act, which provides that a provider like Google may disclose information to law enforcement without a subpoena or a warrant 'if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency.'"

Note the wording there: "A provider like Google may disclose information." The company isn't required to disclose user information during emergencies, but it may choose to do so. After this story was originally published, Google told CNET that it never has.

"If there is an ongoing emergency where getting Nest data would be critical to addressing the problem, we are, per the TOS, allowed to send that data to authorities," a Google spokesperson said. "To date, we have never done this, but it's important that we reserve the right to do so."

That draws a contrast with Ring's disclosure of 11 emergency shares thus far in 2022, but the company uses a similar legal basis as Google. Isaacs explained that Ring's policies are written in alignment with the Stored Communications Act, which limits what Ring can share with law enforcement, but includes an exception for emergency requests of user data in cases of imminent death or serious bodily harm.

"That doesn't mean that Ring couldn't impose stricter obligations," Isaacs noted. "The Stored Communications Act says that Ring may provide that data in response to emergency requests -- but they're not obligated to."

What about the rest of the industry?

In addition to Google and Ring, I spoke with other key makers of smart home cameras, including Arlo, Eufy and Wyze, as well as Apple, which processes smart home video footage according to its HomeKit Secure Video protocols. Most manufacturers reserve the right to share user footage with law enforcement when served with a warrant or other compelling legal action -- but unlike Ring, they draw the line there. 

"We have used the reasoning that if a situation is urgent enough for law enforcement to request a warrantless search of Arlo's property then this situation also should be urgent enough for law enforcement or a prosecuting attorney to instead request an immediate hearing from a judge for issuance of a warrant to promptly serve on Arlo," a spokesperson for Arlo said. "Consequently, it is our policy to NOT produce videos to law enforcement no matter the situation, unless we are compelled to do so by a valid warrant or court order."

"Video or audio cannot be accessed without permission by anyone besides the owner, except when required by law," a Wyze spokesperson said, adding, "We only share if the police provide a valid subpoena or warrant."

Others, most notably Apple, use end-to-end encryption as the default setting for user video, which blocks the company from sharing that video at all.

Despite recent privacy missteps of its own, Eufy, which makes smart home cameras and video doorbells, tells CNET that it uses end-to-end encryption as well, and adds that its products store video locally as another enhanced privacy measure.

"[The] Eufy Security team doesn't hold footage in the cloud," a spokesperson said. "Consumers have footage locally so they would have to share directly with the law enforcement if needed."

Ring enabled end-to-end encryption as an option for users in 2021, but it isn't the default setting, and Ring notes that turning it on will break certain features, including the ability to view your video feed on a third-party device like a smart TV, or even Amazon devices like the Echo Show smart display. It's worth noting that through its HomeKit Secure Video standard (and because of its generally more locked-down HomeKit ecosystem), Apple has developed a way to maintain end-to-end encryption for cameras that support it, while also allowing you to view their footage on external devices.

The takeaway

Google, Ring and other companies that process user video footage have a legal basis for warrantless disclosure without consent during emergency situations, and it's up to them to decide whether or not to do so when the police come calling. That makes this a difficult philosophical question for smart home brands that process user video -- and consumers have a choice to make about what they're comfortable with, too. You might prefer a product capable of granting law enforcement quick access to potentially life-saving data during an emergency.

That said, you can't make informed choices when you aren't well-informed to begin with, and the brands in question don't always make it easy to understand their policies and practices. Ring published a blog post last year walking through its new, public-facing format for police footage requests, but there was no mention of emergency exceptions granted without user consent or independent oversight, the details of which only came to light after a Senate probe. Google describes its emergency sharing policies within its Terms of Service, but the language doesn't make it clear that those cases include instances where footage may be shared without a warrant, subpoena or court order compelling Google to do so. 

For now, the best bet for anyone concerned about police access to their smart home footage is to use products that transmit user data using end-to-end encryption. That's the default for cameras transmitting via Apple's HomeKit Secure Video protocols, for instance, and it's an option that Ring users can enable, too. We'll continue to make those options clear as we continue to test and review smart home cameras and video doorbells.

Still, no matter the maker or device, your digital footprint will always be subject to subpoena, and companies that process user data will always be subject to police requests for access to it. Ring's policies and partnerships might facilitate that process more than some people would like, and with less transparency than some people would be comfortable with, but the law doesn't compel Ring to act otherwise. Sweeping federal privacy regulations similar to Europe's GDPR provisions or the CCPA in California could potentially help create stronger standards for disclosure and bring better transparency to the industry, but without them, you'll need to decide for yourself which brands, if any, you want to trust with a place in your home.

Update, July 27: This piece has been updated with new context from Google, which says it reserves the right to comply with warrantless requests for user data during emergencies but, to date, has never actually done so.