Ring’s Enhanced Encryption: Restricting Police Access

Ring has a new way to protect your videos. It’s developed an encryption method called TAKE, short for Throw Away the Key Encryption, that the Amazon-owned company says will protect your videos without traditional end-to-end encryption. TAKE limits when and why Amazon’s cloud can access those videos, while still providing features like smart alerts for people and packages, AI-powered video search, and video descriptions.

The feature is rolling out gradually starting in September, regardless of whether you have a subscription, and will become the default encryption for all Ring customers.

TAKE arrives during a year of intense scrutiny for Ring, driven by its ties to law enforcement and the privacy implications of its AI-powered Search Party feature. Ring says TAKE changes what the company can hand over to law enforcement. “Ring will only be able to provide non-video information … and encrypted video files in response,” Ring spokesperson Sam McGee said in an email to The Verge. However, it doesn’t completely eliminate the privacy trade-off of cloud-based cameras.

Ring says TAKE uses unique, rotating encryption keys for your footage, stored in a secure enclave and accessible only under strict conditions — based on the features you enable on your account. Currently, footage captured by Ring cameras is encrypted in transit to the cloud and at rest, and then decrypted for Ring to process for those smart features. With TAKE, the encryption keys change for every five minutes of footage. Ring stores copies of those keys to decrypt the footage, but throws away each copy within 24 hours, “leaving you with the keys and full control of your videos,” according to Ring.

TAKE was developed using Messaging Layer Security, an open standard from the Internet Engineering Task Force, according to Ring. The company says it is “inspired by the privacy principles of E2EE (end-to-end encryption),” which Ring offers on some of its cameras. However, the two systems work differently. With E2EE, Ring never has the keys and can’t process your video for cloud-based features. Both options are available on newer cameras that encrypt on-device, and you can switch between the two. Older cameras encrypt at cloud ingress and only support TAKE.

According to a white paper the company published today, Ring’s copy of those keys is managed inside an AWS Nitro Enclave, to which Ring’s access is restricted by “access controls, cryptography, and hardware isolation.” The company claims there is no persistent storage and no way for a Ring employee to access it. The stored keys can only be unlocked by the enclave through cryptographic attestation that proves it’s running the exact software image Ring approved. The enclave releases a temporary key when an enabled service requests it.

Each key is permanently deleted after 24 hours — a window McGee told The Verge The content encryption keys in CMMS rotate every five minutes, and as each key ages past 24 hours, the corresponding intermediary secret in the key derivation hierarchy is ratcheted forward. This process applies a one-way key derivation function to overwrite a managed secret with its derived output and discards the original, making it cryptographically infeasible to reconstruct. The CMMS database is configured with no backups, making this deletion irreversible.