Infuriatingly, as a non-well-connected victim of a boring (not going to be good PR) crime, I’ve found it is completely impossible to get the police to pull data for my own yard, warrant or no.
In my experience, these capabilities are only used to protect the politically connected or for oppression.
I’d be less skeptical if the program allowed any homeowner to pull any nest footage that included their property, and also allowed individuals to pull any footage that included them.
I gave the police a 4k camera video of a crime happening and they did nothing with it. This is pretty standard police laziness in the US, individual cops might care but departments overall give zero shits for small people except as revenue sources.
Data ownership issues like this in the US will never be pushed by existing political interests, hopefully we'll see more EFF-ish PACs in the future that take a page from the fascists and provide the written laws and bills they would like enacted to state and municipal governments so local representatives can edit the title block and get back to harassing their interns.
When I was younger our house was robbed and some prescription drugs stolen. Not only did we know who did it, we had text messages where they admitted it and a witness who came forward. The police refused to do anything about it, and told us that if we wanted them to do anything at all we should consider voting for a different mayor.
If the police refuse to subpoena the security company, in the US you can get a civil attorney to file a "John Doe warrant" and use that lawsuit against that unknown defendant to subpoena whoever has the footage you need.
> I’d be less skeptical if the program allowed any homeowner to pull any nest footage that included their property, and also allowed individuals to pull any footage that included them.
I don't know how exactly it's in the US, but in EU security cam footage is considered to be personal information and as result of that GDPR applies. So whoever controls the security camera is the data controller and is required to e.g. provide access to people who were recorded. In this case it would likely be the home owner and unless Google was acting as data processor for the home owner they wouldn't be allowed to process that data.
Since when does police issue warrants? A warrant is issued by a judge, unless it somehow works differently in the US. I assume police just didn't do anything with that warrant.
For this reason, I just cancelled my nest doorbell order. I will gladly share access with the police if the situation warrants it but I don't accept that Google (or any company) should be able to make that decision without my consent.
1984 was overly optimistic about people, government didn't even need to enforce putting spying devices in homes. Instead a huge chunk opted in voluntarily with doorbell cameras, Alexa, and other smart devices
There's absolutely nothing wrong with the technology, and it obviously makes peoples lives better to have it. I think the issue is that there are only a handful of vendors that happily operate like the monopolies they are and provide you with zero differentiation or choice within the market.
The government isn't particularly interested in ending this problem either, I suspect this is due to a combination of industry capture and intelligence agency interest in these products.
This is not limited to Alexa or seemingly unnecessary tech gadgets.
This includes ALL your data. Gmail, Google, Android.
So unless you're opting for iOs (provided they're not doing the same as Google here) and not using Gmail or Google you're still falling under "Surveilled by the gov via tech company who serves their interests and not yours, even if you pay money for their services".
Fahrenheit 451 has a part where they get the entire city to go to their doors to try and spot a fugitive, this action is coordinated by the radios that everyone wears.
With these cameras and recognition algorithms, you don't even need people to go to the doors. Just pull the feeds.
I think Larry Brin's "The Transparent Society" is the best read on the topic. Not predictive of all outcomes, but many aspects of modern surveillance he did see coming.
TikTok could be a spyware (lol) that requires your SSN and people would STILL download it and defend it just because it brings them mindless 10 second videos. I remember reading 1984 as a kid and thought it was so far fetched, that nobody would willingly let society get to that point... but it just only made more sense as I got older... people really just don't care...
Now if only you could get your neighbors to quit too. The ones that have it are all still recording you. You really only need one or two per block to monitor everyone on the street. ML should easily be able to work out "Silver Corolla with license plate ABC123 left 1200 Sunnyside St at 4:32pm and headed East." Then another one 3 blocks away can report the same car turning North on 127th, and then another can report...
To be fair, though, there's a flip side. My neighbors seem to get more utility from my driveway feed than I do. Every couple of months, I get a text from a neighbor asking if I got footage of some such thing. Everybody knows who has cameras, and those people are invaluable whenever something nefarious happens (mail theft, break in, kids running amok, etc).
Note that this is already in-line with their policy, you've already agreed to hand over your data and allowed them to share it, so I don't understand why this single article suddenly changed your mind.
> To me, a Nest or Ring is pointed at a basically public space. So what if the cops can look at the feed?
Perpetual and pervasive surveillance completely changes the human expectation of public spaces.
For most of human history, even the most public of spaces was effectively mostly private most of the time. A few decades back you could be in, say, Times Square between thousands of people and yet your actions and presence was completely private. Because unless you did something particularly attention-grabbing, nobody would notice or much less remember. Even if you did do something that people took notice, few of them would really remember you individually a day later (let alone years later). If the cops wanted to interview people about your presence they'd have to find those few that noticed and remembered you, nearly impossible. Thus even public spaces were for most practical purposes private space, and that is the expectation human minds has.
You might say even decades back they could assign people to watch you. And they did. But only for select people so there had to be some cause and selectivity (sometimes unjust, but still). It was literally impossible to watch everyone everywhere all the time.
That's what changes now. It is possible to track everyone everywhere all the time. And not just at the moment, but recorded for posterity for future ML queries.
I rented a house 2 years ago and it had some cloud trash with camera and mic in it. I said I will move out unless they remove it. They simply removed it as it was there only to appease prospective tenants.
This just seems extreme to me, considering how you've likely never been in this scenario and will in all likelihood not ever be in a scenario where you wouldn't give the police this information but Google would (e.g. your own home being robbed or a masked stranger ringing your doorbell).
Sometimes I think people covet privacy for its own sake, and don't think about the practicalities. The whole point of living in a collective society is that we give up some freedoms for the sake of overall increased prosperity, that's always been the tradeoff, and this is just one of those tradeoffs.
We already have that tradeoff. It’s called a warrant. If the police get one, you are forced to give them access to your otherwise-private affects.
This is a step beyond that. Warrants are granted at the discretion of a judge, the bar is high, the scope is narrow and you (theoretically) have recourse if it’s abused. Here, the discretion is Google’s, the bar is nonexistent, the scope is unlimited and you have zero recourse if you think you’ve been wronged.
This wouldn’t be an issue if people trusted Google or the police. But they don’t, and it’s pretty easy to imagine ways in which this could be abused to harm people.
Let’s say you live in Texas and get abortion pills in the mail. If the police have a warrant to search your house for something unrelated, they (theoretically) can’t see the pills and decide to charge you with an unlawful abortion (unless they were “in plain view”, etc). But if Google gives police access to footage of your house extrajudicially, police can use anything they see as evidence against you. And make no mistake — things like that will happen as a result of this policy.
In the vein of principals, yes, privacy for its own sake is valuable to me.
In the vein of practicalities, both Google and the justice system (USA for me) are monstrously large bureaucracies known to make difficult-to-redress errors. Google's capricious account banning, police raiding incorrect addresses, eg. The decision to share with them more information than the law requires is one I'd prefer to make myself.
> “If we reasonably believe that we can prevent someone from dying or from suffering serious physical harm, we may provide information to a government agency — for example, in the case of bomb threats, school shootings, kidnappings, suicide prevention, and missing person cases,” reads Google’s TOS page on government requests for user information. “We still consider these requests in light of applicable laws and our policies.”
So this is just an article pointing out something in the TOS.
National security requests are common for any big company[0-2] since they'd rather play ball today, under their own terms, than resist and trigger new legislation that forces them to hand over information in any warrantless circumstance.
Maybe this would just make me a bad service admin, but if I believed that I would be literally saving someone's life by sharing data from one of my users with law enforcement, I would be hard pressed to hold their privacy above another's life.
Exactly what it takes to be reasonably convinced that I would be saving someone's life is of course not a simple question, but in at least some situations it seems like it would be worth the tradeoff.
One that I've run into several times is suicide. Most of the time, the person isn't in immediate danger. I've been around when people were.
I'm not going to go into any detail for people's privacy, but it took over an hour to figure out who a regular member of a community was in real life and then get emergency services in another country to them. Got independent confirmation they got dragged to a hospital in time. They weren't exactly grateful afterwards, but they stayed in the community and didn't repeat the attempt.
I think you're probably right in your analysis of their thought process, but I'd almost rather they force legislation's hand. Then there's a chance to hold elected officials accountable if they pass it, and there's a chance (IANAL) for a Supreme Court to throw it out as violation of the 4th amendment to the US Constitution.
Even in the worst case (law passes, court upholds, and people re-elect the politicians) at least we have a definition somewhere on what is and what isn't ok. Today where it's ambiguous and "Company X may or may not" leaves a person to wonder.
I suspect because Google and Amazon want to use the data from the video feeds for their own purposes. I think using it for CV modeling and advertising can make them more money than not using it.
Also, they can charge police for these data.
I won’t buy their products because of their decision to monetize over privacy. What I find interesting is that their products aren’t cheaper than other privacy preserving products from Wyze and Apple so this extra revenue is pure profit or gravy. This isn’t some essential need of their business model, they just don’t respect user privacy enough to avoid this extra revenue.
It’s probably because it’s somewhat more complex to implement encrypted end of end video and storage, with a slightly more complex user experience. So they cut corners, knowing most people don’t care about encryption.
Has Wyze ever provided privacy guarantees on their cloud service? Their privacy policy says they will gladly share data.
> In response to a request for information if we believe disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements;
IANAL but that sure sounds to me like they will provide data in cases where they aren't legally required to (as in a warrant) as long as they believe it's "in accordance with" the law. Which could mean almost anything other than a clearly illegal request.
I like Wyze and think they are acting in good faith, but I wouldn't assume they would say no to a request from government/police. They may offer local recording and RTSP, but AFAIK they are still cloud connected unless you otherwise block them or use alternate firmware and hence not private.
Probably because of the ML processing (event recognition), which is the only good reason to subscribe to Nest/Google home in the first place. Otherwise, you just have streams of video without much context. If the analysis could be done on device, then that would be a different story.
Unfortunately, either Ring or Nest is required in my neighborhood given our property crime issues.
>> either Ring or Nest is required in my neighborhood given our property crime issues
What do you do with that footage? I have a full resolution video of a dude stealing $300 worth of crabbing equipment from my porch. What’s next? Police is not going to do anything about it even though there’s probably technically a way to track him down.
How do you expect Ring to provide live notifications that are processed server side if you enable e2e encryption? If Ring.com can decrypt the data, they can always share the feed with 3rd parties.
It's a sensible design choice given the current constraints of the hardware.
Because Apple's HomeKit stuff is significantly inferior. HN privacy nattering aside, consumers clearly want cloud-accessible home surveillance. It's what they pay for. And if you can get to it from that website using only your Amazon or Google account, so can Amazon or Google.
I have a hub (multiple actually thanks to a few HomePods and Apple TV's) for HomeKit. I can control all of my HomeKit devices remotely and I can view any video remotely.
Yet it is still end to end encrypted because the processing happens locally on device (on the hub) instead of on a cloud server.
I have the ability to detect people, animals, vehicles, and packages and set recording settings based on that. In addition to if I am home or not based on the existing detection round that built into HomeKit.
This narrative around Apple's products missing major features is no longer true and has not been for a while.
You can still store the data on the cloud and access it anywhere. I think the only features that probably need to be limited are video-analysis features such as who is at your door and what is moving across the lawn.
Knowing the car your neighbor(s) drive and what times they come and go are very valuable marketing tools, to someone. Just like knowing what they search for and the content of their emails tells them other things about you, and your neighbor who didn't sign up for this service.
I'd find this much more acceptable if the system told people when their data was provided to police without a warrant. There's less potential for abuse if they're transparent about it.
Then you might want to read the linked article and not the headline, because CNET asked that question and... got an affirmative response, that Google will try to notify users whose data has been shared.
Really almost all the top comments on this topic are people overreacting to the headline without realizing that the circumstances involved are emergencies and not just routine LE requests. Clickbait has ruined everything.
> the circumstances involved are emergencies and not just routine LE requests.
Fine, every routine LE request is now an emergency. Because one thing US LEOs are known for is their reserve in only requesting just the absolute minimum to do an investigation.
They will try but can be legally prohibited from notifying you. A server you control and have the keys to can be compelled by the police, but not without your knowledge.
Every supposed attempt to protect you is really just an attempt to justify an inherently unethical business model because it is profitable.
"A robot may not injure a human being or, through inaction, allow a human being to come to harm."
“A provider like Google may disclose information to law enforcement without a subpoena or a warrant ‘if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency,'”
s/provider like Google/robot/
s/may disclose.*if the provider/may act to protect any person if the robot/
s/requires disclosure without delay of communications/requires action/
“A robot may act to protect any person if the robot believes that an emergency involving danger of death or serious physical injury to any person requires action without delay of communications relating to the emergency,'”
It's funny how things like this surprise people, as if the legal system is a trustworthy blob on their architecture graph. One fundamental thing about it is that it's made up of different people and a huge amount of people, all with differing levels of competence (so not only is it untrustworthy, but it can't even consistently do whatever its goals are) as opposed to having any coherent goal or ideology.
> “If we reasonably believe that we can prevent someone from dying or from suffering serious physical harm, we may provide information to a government agency — for example, in the case of bomb threats, school shootings, kidnappings, suicide prevention, and missing person cases,” reads Google’s TOS page on government requests for user information. “We still consider these requests in light of applicable laws and our policies.”
Another article pointed out that most other cloud based offerings will still provide it if there is a warrant.
But it seems like Apple is the only cloud based offering that cannot actually respond to these requests even if they get one?
I just checked my HomeKit Secure Video camera and it seems like it isn't just the default setting, but the only setting. I see no way to tell it to not encrypt the data when storing it in iCloud (not sure why they would give that option at all TBH)
> “If we reasonably believe that we can prevent someone from dying or from suffering serious physical harm, we may provide information to a government agency — for example, in the case of bomb threats, school shootings, kidnappings, suicide prevention, and missing person cases,” reads Google’s TOS page on government requests for user information. “We still consider these requests in light of applicable laws and our policies.”
This is in line with the reasons cops can do things that otherwise normally require a warrant. This is generally 'a good thing.' The issue, for me, is in the abuse and interpretation of these exemptions.
Right, exactly. Google could have this and make it perfectly accountable. Just surface a user notification that X entity accessed your camera's data for Y time range, ideally with a reference to a case number. People will push back if the police abuse their power. They won't become as complacent, because they'll know when the cops are spying.
Illinois actually has some of the strongest privacy legislation in the country. I got a $350 check from Facebook for running facial recognition on my photo without permission, and Google owes me a similar amount when it's class action gets approved.
Check out the Illinois BIPA, it's the reason tech companies are trying to get federal privacy legislation that preempts state law.
FWIW, Illinois sometimes does crazy things the other way too. They banned facial recognition altogether, so Nest (and other cameras) can't offer the "familiar faces" feature, like to not alert you when a spouse comes home instead of a stranger.
Facebook also paid me several hundred dollars because they were auto tagging faces for Illinois users.
For those of you old enough to answer: 30 years ago, did you foresee people spending significant amounts of money to install spy cameras in their homes and tracking devices in their pockets?
30 years ago (which was the early 1990s, eek!), analog CCTV was all the rage. Costs for cameras and VCR units plummeted, tapes became cheap commodities, and multiplexing video became trivial. With time-lapse and multiplexing, you only needed one VCR for four cameras, which could record for 24-48h on a single tape. It became cheap enough for businesses, hotels, apartment complexes, and the like to install them everywhere. Private CCTV became a staple of police procedural shows like Law and Order (1st season was 1990), which made people expect to be able to "check the tapes" after an alleged crime.
Edit: This same issue was also a problem in the 1990s with private CCTV! If a police officer or detective tells a business owner that a crime has been committed and there might be evidence on the tape, the owner doesn't have to show the police the tape without a warrant. But they usually did, because it looks suspicious if they don't.
Here's a quote from Max Headroom (of Pepsi commercial fame, for people old enough to remember Pepsi), from 1987:
Edison Carter: Security Systems has its tendrils into every element of our society - the government, our homes, the police, the courts - I'm not gonna spike this story just because it deals with dollar amounts beyond your comprehension! It's too important!
Murray: ...cerebral...
Theora Jones: Murray, we're trying to play this takeover as a threat to our average viewer. Nobody knows who's doing it. I mean, we all deal with SS every day - what if some really dangerous people got control of it?
Actually yes. 30 years ago I was 8 and the first home CCTV setups were just coming out. People loved that shit. But then Im a brit and we're all nosey neighbours...
There were 7 instances in the entire year where this happened.
Folks - while it's definitely disturbing from a legal perspective and needs to be addressed 'proportionality' is also something we have to consider.
If this only happened '7 times' in a year, I'm doubtful this is arbitrary handing over of data.
'Real Life' is complicated, and sometimes processes don't line up as we would like. Neither Google nor the Police are corrupted institutions, rather, they can in some instances do things we don't want them to or that are actually bad. Meaning, I suggest in all likelihood there was likely some kind of material reason fore these '7 disclosures'. They used the term 'emergency' and I buy it.
What we need to do is close the loophole and adapt the judicial process so as to be able to accomodate such situations.
People are yelling about 'Orwell' - well that Dysoptia takes more than '7 times a year' in a nation of 350M to have surveillance abused on them. Again, needs to be sorted out, but we have to contextualise this.
So glad I ditched Gmail several months ago. I have a single Google Home device that was gifted to me by a friend, but I’m tempted to just unplug it at this point.
If you have a hosted website, check your provider. I have my domain at Dreamhost and they have IMAP included at my tier.
I moved off Gmail to them about 9 months ago and it's be good.
The worst part is that Dreamhost's spam filtering is abysmal compared to Google's. But my desktop is always on and I just keep Thunderbird running on it. TB's spam filtering is pretty good after training.
I figure some of the dedicated email hosting services do a better job with spam.
> prevent someone from dying or from suffering serious physical harm
These are exigent circumstances, which allow police to enter your home without a warrant. Extending that access to include video cameras seems reasonable.
This is a "In Case of Emergency Break Glass" type of situation.
How do you define this though. If someone say talks about XYZ politician. And the current governor feels if said XYZ person takes his position that it’d cause you personal harm. Can the current governor access your camera?
If a police officer comes to your house without a warrant are they allowed to break in? If not they shouldn’t be given access to my camera feeds without my permission.
The move by google here just re-affirmed that I made the right choice to not buy their products.
> circumstances that would cause a reasonable person to believe that entry (or other relevant prompt action) was necessary to prevent physical harm to the officers or other persons, the destruction of relevant evidence, the escape of the suspect, or some other consequence improperly frustrating legitimate law enforcement efforts
My problem with this is defining exigent circumstances as it relates to video or similar data. I can't easily think of a circumstance where the police are outside my house, encounter an exigent circumstance, but also have the time to request/obtain data from Google. And if the police are made aware of to something in advance, they have time to get a warrant.
> You don't have that control here. Your footage can just walk off, no clue. No accounting, no reporting, no post-hoc punishment for mis-use.
The supreme court recently ruled that a woman beaten by police didn't have standing to sue. Good luck with breaking qualified immunity in a court of law in the coming years.
Heh, exigent circumstances? If somebody is hurt or calling for help, by all means knock down a door or bust a window. But exigent circumstances for rifling through my documents? Get a fucking warrant!
> This is a "In Case of Emergency Break Glass" type of situation
The only difference being that when you pull the alarm for lols there are consequences -- for you. Members of law enforcement on the other hand do that on the regular and face zero consequences.
That said, Google doing this might ease the pressure to enable this across the board through legislation. So maybe a positive in the end; I wouldn't really expect any privacy with Nest anyways.
> This is a "In Case of Emergency Break Glass" type of situation.
The problem is there isn’t any broken glass here. No judge is stamping this, and I see no duty to warn the customer about what device and data was accessed, and there doesn’t seem to be a way to opt out ahead of time. This removes a lot of checks in the name of expediency.
Yes, the only sensible comment is downvoted to the bottom of the page. In U.S. jurisprudence "exigent circumstances" gives police all kinds of powers including warrantless searches of all kinds, up to and including electronic surveillance and phone taps.
The "process" to which you are "due" when it comes to these things is if the police try to use this information to prosecute you, they have to explain it in court, whereas if they obtain it through a search warrant, they have to explain themselves in advance. It's all "due process".
> “A provider like Google may disclose information to law enforcement without a subpoena or a warrant ‘if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency,'” a Nest spokesperson tells CNET.
I sympathize with this dilemma. It's a real-life version of the Trolley Problem[1].
But "to any person", e.g., a CIA asset in the field might be exposed by a gmail user, thus threatening her/his life, thus pre-emptively disclose the gmailer's info to law enforcement?
Or imagine an idle threat is made off-hand in a private gmail, so pre-emptively disclose that threat to law enforcement?
In the sci-fi Minority Report scenario, Google could use AI language models on all gmail to make a judgment call on "emergent danger of serious physical injury". If I plan to go bunjee jumping with an unreliable provider, Google scans my gmail and tells law enforcement?!?
Yes good examples of how it can be abused. I'm certain the interpretation could be very liberal depending on the person making the decision.
I know a person who was banned from twitter and was nearly fired because he dead-named somebody. The explanation was that it was literal violence against the person he dead-named, because so many trans people self harm if they don't feel that their identity is affirmed. The person who was banned says it was a force of habit because the person had only very recently went public with their new identity, but it did not stop the ban hammer. He almost lost his job as well because the tweet was posted in a public slack channel. HR left it up the person who was dead-named to make the decision, and they decided not to fire him.
I could absolutely see a scenario like the above happening in gmail or some other Google product, and the decision-maker deciding that it was a threat to a person's life and should be disclosed. To some people that makes perfect sense. To others it does not. The point is simply that when we let humans make subjective decisions like that, we get all the downsides of human judgment.
I have difficulty understanding Googs (or Amazons etc) motivation to do this. What do they have to gain by being excessively cooperative with police force, especially on a local level? I can understand that having good rapport with feds might have benefits, but this doesn't sound like that
Amazon's motivation is quite clear - they want to reduce shrinkage by discouraging "porch pirates" from stealing Amazon deliveries. Not sure what Google's motivation is, but it might just come down to optics. Consider how Apple gets raked over the coals in the media by DAs when they refuse to unlock a suspects phone.
> Amazon's motivation is quite clear - they want to reduce shrinkage by discouraging "porch pirates" from stealing Amazon deliveries.
You say they hand all the information to the police to prevent package stealing? Iam pretty sure thats not the reason at all, maybe a very very little part of it.
Simple, if they cooperate without being asked by warrant they might hope that their using the underlying data may be overlooked and not reviewed by say oh US Congress.
I used Reolinks in the past... Had them save locally on the camera's SD card and upload via FTP on the server on my local network... I also blocked their internet access
How easy would it be for google to, you know, program an interface that allows the police request to be shown to the owner and have them say yes or no to the video wanted?
It should never be possible for a cloud provider to decrypt data from your devices. It should be encrypted by a public key you load on the device and only decrypted by your private key. The cloud prouder should be a dumb provider of the service and not get in the way. As soon as the cloud provider gives your decrypted data away to random people then that is a massive security hole.
Is anyone really surprised? I am not. Google has such a bad relationship to data privacy, they don't see the problem. Getting a warrant is so easy in the US right now, so there is very little reason to disrespect your customers privacy. They just don't see the problem.
Anyone operating under the assumption that their government doesn't already have unfettered, at-will access to all their data is deluding themselves. News like this should come as a surprise to no one, least of all the technically literate crowd here.
At this point I cannot believe that anyone in Tech would have a Google account being that they should know better. Anyone could be made to look guilty when the authorities have enough data.
Adding this for the people who keep downvoting this:
"Google – one of the largest and most influential organizations in the modern world – is filled with ex-CIA agents. Studying employment websites and databases, MintPress has ascertained that the Silicon Valley giant has recently hired dozens of professionals from the Central Intelligence Agency in recent years."
We are imprisoned by our addiction to convenience. I am in the middle of dealing with this now, switching my services where I can: dumb phone, linux laptop, swisscows, openstreetmap and an old Garmin GPS, and just being OK with uncertainty.
They still have facial recognition feeds, car feeds, and they purchase data from third-party consumer surveillance firms, including credit card purchase histories for non-Google users. You don't need to have a Google account to be tracked by AdWords, and there's no practical opt-out, other than staying logged in all the time, and then being tracked in other ways, and agreeing to all sorts of things in their (ever-changing) EULA.
Homekit doorbells use iCloud services and storage to host/serve the video; that's how Apple is involved even though they don't make the doorbells.
I had a Nest at my previous house - decided to try the Wemo Homekit doorbell this time and I'm very pleased with it. I also use an Apple TV to drive all the content on my TV and the Homekit video notifications are amazing - instantaneous since the Apple TV is my local homekit hub. Way faster and far more reliable than the Nest doorbell ever was.
Any RTSP camera, frigate and homeassistant makes it pretty easy for tech related folks to have a state of the art surveillance system with every feature you could imagine.
In fairness, there is good reason to release footage without a warrant for the reasons they list (including "school shootings, kidnappings, suicide prevention, and missing person cases"). I'd like a robust monitoring of how the information is used. But the law already recognises that you don't need a warrant in urgent, life threatening cases. And let's get real, getting a warrant is so easy these days as to be meaningless...
I'm not sure they're much better. From the SHARING PERSONAL INFORMATION WITH THIRD PARTIES section of their privacy page:
We may share your personal information in the instances described below
Third parties as required to (i) satisfy any applicable law, regulation, subpoena/court order, legal process or other government request, (ii) enforce our Terms of Use Agreement, including the investigation of potential violations thereof, (iii) investigate and defend ourselves against any third party claims or allegations, (iv) protect against harm to the rights, property or safety of Eufy, its users or the public as required or permitted by law and (v) detect, prevent or otherwise address criminal (including fraud or stalking), security or technical issues.
If we should ever file for bankruptcy or engage in a business transition such as a merger with another company, or if we purchase, sell, or reorganize all or part of our business or assets, we may disclose your information, including personally identifiable information, to prospective or actual purchasers in connection with one of these transactions.
We may also share information with others in an aggregated and anonymous form that does not reasonably identify you directly as an individual.
At least it's not owned by American company, so doesn't technically _have_ to give the government institutions whatever they ask for. It's Chinese though, and that's not much better.
So I could see what the hell my nanny is up to with my children.
I also don't want to have to spend 2 days setting up some hacked together system that I also have to spend time supporting when I simply don't have the time or will.
That's why!
For streaming, I have a few pi's (and cameras) running v4l2rtspserver, and it seems to work pretty well. It appears to be using the Broadcom hardware support for H.264 encoding, so it's pretty light on the CPU. I'm currently using Shinobi on a different host to receive and archive the RTSP streams. (Although I'm interested in checking out Frigate, which was mentioned elsewhere in this discussion.)
I don't 'hate' this but how the heck would google detect something like this? Why do I feel like they're analyzing every word we say in our homes and building some kind of profile (for ad reasons). On second thought I do hate this
Most consumers don't want to (or can't) deal with managing encryption keys, and aren't going to be keen on the idea that if you lose the key, you lose the data permanently.
Your daily reminder - if you don't host the data, someone else does. And their interests may or may not align with yours. And even if their interests align with yours today, that's no guarantee they will tomorrow. If you don't want audio, video, etc potentially shared with authorities, don't install cloud-enabled audio/video devices in your home.
It could be your private cloud therefore your computer. <5% of people probably have their own server. When that % changes significantly, we may need to stop saying this.
"Someone else's computer" would be misinformation in any other medium SOLELY because it makes it sound like it's being stored on the same kind of computer that an average person has - that another average person is using. There was a smear campaign in 2013 for cloud computing under this very message.
>> “ During this process, the HomeKit data is encrypted using keys derived from the user's HomeKit identity and a random nonce and is handled as an opaque binary large object, or blob.”
If you don’t control the keys, to me, that’s not end-to-end encrypted.
If the backup password to these encrypted files is known, it can be rather trivial to access the data within.
Recently, a certain head of state's son had 100s of GB of iCloud backups thrown onto a torrent, and within a day rogue manchildren living in their parents' basements cracked most, if not all of it open.
With the backup password in hand, all one needs is this README.md file [0] to be off to the races.
Wildly fascist. The warning sign was when AT&T got retroactive immunity for sharing customer data with the NSA. I wonder when Americans will decide to push the reset button.
Some may be uncomfortable with a company that has access to the most private data of so many people being ready and willing to cooperate with the police state, but voicing your support for this policy is actually a great way to demonstrate your Googleyness during the interview process!
Infuriatingly, as a non-well-connected victim of a boring (not going to be good PR) crime, I’ve found it is completely impossible to get the police to pull data for my own yard, warrant or no.
In my experience, these capabilities are only used to protect the politically connected or for oppression.
I’d be less skeptical if the program allowed any homeowner to pull any nest footage that included their property, and also allowed individuals to pull any footage that included them.
Of course, that will never happen.
I gave the police a 4k camera video of a crime happening and they did nothing with it. This is pretty standard police laziness in the US, individual cops might care but departments overall give zero shits for small people except as revenue sources.
Data ownership issues like this in the US will never be pushed by existing political interests, hopefully we'll see more EFF-ish PACs in the future that take a page from the fascists and provide the written laws and bills they would like enacted to state and municipal governments so local representatives can edit the title block and get back to harassing their interns.
When I was younger our house was robbed and some prescription drugs stolen. Not only did we know who did it, we had text messages where they admitted it and a witness who came forward. The police refused to do anything about it, and told us that if we wanted them to do anything at all we should consider voting for a different mayor.
5 replies →
Same. I even know who stole stuff from our place of business and found the eBay listing tied to the person who did it. And yet, nothing.
It’s not just the US. This happened to me in a west European nation as well
If the police refuse to subpoena the security company, in the US you can get a civil attorney to file a "John Doe warrant" and use that lawsuit against that unknown defendant to subpoena whoever has the footage you need.
Thank you for that info! I am in a similar situation and that was something that did not occur to me.
> I’d be less skeptical if the program allowed any homeowner to pull any nest footage that included their property, and also allowed individuals to pull any footage that included them.
I don't know how exactly it's in the US, but in EU security cam footage is considered to be personal information and as result of that GDPR applies. So whoever controls the security camera is the data controller and is required to e.g. provide access to people who were recorded. In this case it would likely be the home owner and unless Google was acting as data processor for the home owner they wouldn't be allowed to process that data.
At first I did not believe this could possibly be true but you're right, there's been a case and everything.
I don't think you have gdpr obligations if your private cameras are just capturing your own grounds and home.
But it DOES apply if your private cameras capture footage of public places.
Interestingly, it looks like it must apply to all cameras in and around AirBNBs.
1 reply →
If your cameras are on your private property and for your personal use, the household exemption means that the GDPR absolutely does not apply.
Are you saying police issued a warrant but a large tech company ignored the warrant?
He is saying that the police weren't interested investigating crimes.
28 replies →
Since when does police issue warrants? A warrant is issued by a judge, unless it somehow works differently in the US. I assume police just didn't do anything with that warrant.
1 reply →
For this reason, I just cancelled my nest doorbell order. I will gladly share access with the police if the situation warrants it but I don't accept that Google (or any company) should be able to make that decision without my consent.
1984 was overly optimistic about people, government didn't even need to enforce putting spying devices in homes. Instead a huge chunk opted in voluntarily with doorbell cameras, Alexa, and other smart devices
1984 and Brave New World weren't exclusive. We can have both at the same time.
2 replies →
There's absolutely nothing wrong with the technology, and it obviously makes peoples lives better to have it. I think the issue is that there are only a handful of vendors that happily operate like the monopolies they are and provide you with zero differentiation or choice within the market.
The government isn't particularly interested in ending this problem either, I suspect this is due to a combination of industry capture and intelligence agency interest in these products.
11 replies →
This is not limited to Alexa or seemingly unnecessary tech gadgets.
This includes ALL your data. Gmail, Google, Android.
So unless you're opting for iOs (provided they're not doing the same as Google here) and not using Gmail or Google you're still falling under "Surveilled by the gov via tech company who serves their interests and not yours, even if you pay money for their services".
16 replies →
It's hilarious. Freedom/privacy-loving Americans voluntarily give it up for minor gains in comfort.
22 replies →
Fahrenheit 451 has a part where they get the entire city to go to their doors to try and spot a fugitive, this action is coordinated by the radios that everyone wears.
With these cameras and recognition algorithms, you don't even need people to go to the doors. Just pull the feeds.
I think Larry Brin's "The Transparent Society" is the best read on the topic. Not predictive of all outcomes, but many aspects of modern surveillance he did see coming.
3 replies →
In the West, Orwell was wrong and Huxley was correct.
Comparisons to 1984 are hack, but I seem to remember that in the book the telescreens were described as something that people willingly bought.
right!?
TikTok could be a spyware (lol) that requires your SSN and people would STILL download it and defend it just because it brings them mindless 10 second videos. I remember reading 1984 as a kid and thought it was so far fetched, that nobody would willingly let society get to that point... but it just only made more sense as I got older... people really just don't care...
I mean, you carry a listening device with you almost 100% of the time. Why would you even worry about the Alexa in your home?
4 replies →
Now if only you could get your neighbors to quit too. The ones that have it are all still recording you. You really only need one or two per block to monitor everyone on the street. ML should easily be able to work out "Silver Corolla with license plate ABC123 left 1200 Sunnyside St at 4:32pm and headed East." Then another one 3 blocks away can report the same car turning North on 127th, and then another can report...
That would assume that nest and ring cameras are even capable of making out license plates. They're all crappy sensors with horrible night vision.
2 replies →
This is much easier (and already accomplished) by the government installing license plate readers.
7 replies →
To be fair, though, there's a flip side. My neighbors seem to get more utility from my driveway feed than I do. Every couple of months, I get a text from a neighbor asking if I got footage of some such thing. Everybody knows who has cameras, and those people are invaluable whenever something nefarious happens (mail theft, break in, kids running amok, etc).
Or live in a metro area with WAMI already in place...
Don't live so close to your neighbors? Easier said than done, but on the long scale...
Note that this is already in-line with their policy, you've already agreed to hand over your data and allowed them to share it, so I don't understand why this single article suddenly changed your mind.
>... so I don't understand why this single article suddenly changed your mind.
Prior ignorance of said policy (which is standard for most users), for one.
Is this tucked away in the Terms/Privacy policy? If so, it might be because they did not read the policy.
1 reply →
To me, a Nest or Ring is pointed at a basically public space. So what if the cops can look at the feed?
> To me, a Nest or Ring is pointed at a basically public space. So what if the cops can look at the feed?
Perpetual and pervasive surveillance completely changes the human expectation of public spaces.
For most of human history, even the most public of spaces was effectively mostly private most of the time. A few decades back you could be in, say, Times Square between thousands of people and yet your actions and presence was completely private. Because unless you did something particularly attention-grabbing, nobody would notice or much less remember. Even if you did do something that people took notice, few of them would really remember you individually a day later (let alone years later). If the cops wanted to interview people about your presence they'd have to find those few that noticed and remembered you, nearly impossible. Thus even public spaces were for most practical purposes private space, and that is the expectation human minds has.
You might say even decades back they could assign people to watch you. And they did. But only for select people so there had to be some cause and selectivity (sometimes unjust, but still). It was literally impossible to watch everyone everywhere all the time.
That's what changes now. It is possible to track everyone everywhere all the time. And not just at the moment, but recorded for posterity for future ML queries.
Because I don't want to live in a surveillance dystopia where the state - or Google or Amazon - has a camera on the outside of every house.
It's bad for public spaces to be pervasively tracked.
4 replies →
The funny thing is I'm of the opposite mind.
"Convenience and if I go missing mysteriously Google will hand info over to the people trying to find me? Win-win."
You're right! That hypothetical and highly unlikely scenario is completely worth all of the ways in which the tech could be and is being abused.
1 reply →
Would it be so difficult for Google to add a configuration step where people can explicitly consent to this?
3 replies →
That's fine, as long as we're clear that is said in a position of privilege.
I rented a house 2 years ago and it had some cloud trash with camera and mic in it. I said I will move out unless they remove it. They simply removed it as it was there only to appease prospective tenants.
I only use these types of cameras outside where neighbors are recording anyway. In home, I use internal networks.
But will you stop using all of Google's products?
"Google will allow law enforcement to access data from its Nest products — or theoretically any other data you store with Google — without a warrant."
Wait a second, do I need to panic that the police can thumb through my gmail, or not?
2 replies →
My understanding is under US law, any data you allow a 3rd party to "see" (aka "host") is considered public and they don't need a warrant
Police don't need a warrant to get into your gmail or icloud or whatever else you host with 3rd parties
3 replies →
This just seems extreme to me, considering how you've likely never been in this scenario and will in all likelihood not ever be in a scenario where you wouldn't give the police this information but Google would (e.g. your own home being robbed or a masked stranger ringing your doorbell).
Sometimes I think people covet privacy for its own sake, and don't think about the practicalities. The whole point of living in a collective society is that we give up some freedoms for the sake of overall increased prosperity, that's always been the tradeoff, and this is just one of those tradeoffs.
We already have that tradeoff. It’s called a warrant. If the police get one, you are forced to give them access to your otherwise-private affects.
This is a step beyond that. Warrants are granted at the discretion of a judge, the bar is high, the scope is narrow and you (theoretically) have recourse if it’s abused. Here, the discretion is Google’s, the bar is nonexistent, the scope is unlimited and you have zero recourse if you think you’ve been wronged.
This wouldn’t be an issue if people trusted Google or the police. But they don’t, and it’s pretty easy to imagine ways in which this could be abused to harm people.
Let’s say you live in Texas and get abortion pills in the mail. If the police have a warrant to search your house for something unrelated, they (theoretically) can’t see the pills and decide to charge you with an unlawful abortion (unless they were “in plain view”, etc). But if Google gives police access to footage of your house extrajudicially, police can use anything they see as evidence against you. And make no mistake — things like that will happen as a result of this policy.
9 replies →
In the vein of principals, yes, privacy for its own sake is valuable to me.
In the vein of practicalities, both Google and the justice system (USA for me) are monstrously large bureaucracies known to make difficult-to-redress errors. Google's capricious account banning, police raiding incorrect addresses, eg. The decision to share with them more information than the law requires is one I'd prefer to make myself.
2 replies →
Louis Brandeis on the right to privacy:
https://louisville.edu/law/library/special-collections/the-l...
13 replies →
> “If we reasonably believe that we can prevent someone from dying or from suffering serious physical harm, we may provide information to a government agency — for example, in the case of bomb threats, school shootings, kidnappings, suicide prevention, and missing person cases,” reads Google’s TOS page on government requests for user information. “We still consider these requests in light of applicable laws and our policies.”
So this is just an article pointing out something in the TOS.
National security requests are common for any big company[0-2] since they'd rather play ball today, under their own terms, than resist and trigger new legislation that forces them to hand over information in any warrantless circumstance.
0: https://www.apple.com/legal/transparency/us.html
1: https://transparencyreport.google.com/user-data/us-national-...
2: https://transparency.fb.com/data/government-data-requests/
Maybe this would just make me a bad service admin, but if I believed that I would be literally saving someone's life by sharing data from one of my users with law enforcement, I would be hard pressed to hold their privacy above another's life.
Exactly what it takes to be reasonably convinced that I would be saving someone's life is of course not a simple question, but in at least some situations it seems like it would be worth the tradeoff.
One that I've run into several times is suicide. Most of the time, the person isn't in immediate danger. I've been around when people were.
I'm not going to go into any detail for people's privacy, but it took over an hour to figure out who a regular member of a community was in real life and then get emergency services in another country to them. Got independent confirmation they got dragged to a hospital in time. They weren't exactly grateful afterwards, but they stayed in the community and didn't repeat the attempt.
2 replies →
Why not end to end encryption so we don’t need to even discuss this.
I think you're probably right in your analysis of their thought process, but I'd almost rather they force legislation's hand. Then there's a chance to hold elected officials accountable if they pass it, and there's a chance (IANAL) for a Supreme Court to throw it out as violation of the 4th amendment to the US Constitution.
Even in the worst case (law passes, court upholds, and people re-elect the politicians) at least we have a definition somewhere on what is and what isn't ok. Today where it's ambiguous and "Company X may or may not" leaves a person to wonder.
> Apple’s default setting for their doorbells is end-to-end encryption which means the company is unable to share user video at all
Why won’t Google Nest and Amazon Ring do this?
I have 6 Nest cameras throughout my home ( not the doorbell product)
I suspect because Google and Amazon want to use the data from the video feeds for their own purposes. I think using it for CV modeling and advertising can make them more money than not using it.
Also, they can charge police for these data.
I won’t buy their products because of their decision to monetize over privacy. What I find interesting is that their products aren’t cheaper than other privacy preserving products from Wyze and Apple so this extra revenue is pure profit or gravy. This isn’t some essential need of their business model, they just don’t respect user privacy enough to avoid this extra revenue.
It’s probably because it’s somewhat more complex to implement encrypted end of end video and storage, with a slightly more complex user experience. So they cut corners, knowing most people don’t care about encryption.
2 replies →
Has Wyze ever provided privacy guarantees on their cloud service? Their privacy policy says they will gladly share data.
> In response to a request for information if we believe disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements;
IANAL but that sure sounds to me like they will provide data in cases where they aren't legally required to (as in a warrant) as long as they believe it's "in accordance with" the law. Which could mean almost anything other than a clearly illegal request.
https://www.wyze.com/policies/privacy-policy#c
I like Wyze and think they are acting in good faith, but I wouldn't assume they would say no to a request from government/police. They may offer local recording and RTSP, but AFAIK they are still cloud connected unless you otherwise block them or use alternate firmware and hence not private.
1 reply →
Ring does offer end-to-end encryption, but it breaks various features. You can see a list of what it breaks on their website:
https://support.ring.com/hc/en-gb/articles/360054941511-Unde...
Many of these features are key selling points, so most consumers aren't going to be interested in turning end-to-end encryption on.
It also doesn't work on battery-powered devices, presumably because they offload as much work as possible to the server to save power.
Probably because of the ML processing (event recognition), which is the only good reason to subscribe to Nest/Google home in the first place. Otherwise, you just have streams of video without much context. If the analysis could be done on device, then that would be a different story.
Unfortunately, either Ring or Nest is required in my neighborhood given our property crime issues.
>> either Ring or Nest is required in my neighborhood given our property crime issues
What do you do with that footage? I have a full resolution video of a dude stealing $300 worth of crabbing equipment from my porch. What’s next? Police is not going to do anything about it even though there’s probably technically a way to track him down.
1 reply →
> Why won’t Google Nest and Amazon Ring do this?
Ring says it offers end-to-end encryption [1].
[1] https://blog.ring.com/products-innovation/ring-announces-end...
It breaks most of Ring's more compelling features, though.
Maybe this article hints at why. https://www.mintpressnews.com/national-security-search-engin...
It sucks with Ring if you enable e2e encryption, they tied it to the ability to have live notification and alerts so you lose that functionality.
How do you expect Ring to provide live notifications that are processed server side if you enable e2e encryption? If Ring.com can decrypt the data, they can always share the feed with 3rd parties.
It's a sensible design choice given the current constraints of the hardware.
Maybe it makes it harder to analyze and or sell that data to third parties.
Do Amazon and Google sell data to 3rd parties? I always figured they wouldn't because it's literally the core of their value.
3 replies →
> which means the company is unable to share user video at all
You said it yourself... How would you analyze the data if it's encrypted?
On the device itself, perhaps. Video data stored encrypted, metadata not.
Because Apple's HomeKit stuff is significantly inferior. HN privacy nattering aside, consumers clearly want cloud-accessible home surveillance. It's what they pay for. And if you can get to it from that website using only your Amazon or Google account, so can Amazon or Google.
I have a hub (multiple actually thanks to a few HomePods and Apple TV's) for HomeKit. I can control all of my HomeKit devices remotely and I can view any video remotely.
Yet it is still end to end encrypted because the processing happens locally on device (on the hub) instead of on a cloud server.
I have the ability to detect people, animals, vehicles, and packages and set recording settings based on that. In addition to if I am home or not based on the existing detection round that built into HomeKit.
This narrative around Apple's products missing major features is no longer true and has not been for a while.
5 replies →
You can still store the data on the cloud and access it anywhere. I think the only features that probably need to be limited are video-analysis features such as who is at your door and what is moving across the lawn.
How do you access videos from the Apple HomeKit products?
5 replies →
Knowing the car your neighbor(s) drive and what times they come and go are very valuable marketing tools, to someone. Just like knowing what they search for and the content of their emails tells them other things about you, and your neighbor who didn't sign up for this service.
I'd find this much more acceptable if the system told people when their data was provided to police without a warrant. There's less potential for abuse if they're transparent about it.
Then you might want to read the linked article and not the headline, because CNET asked that question and... got an affirmative response, that Google will try to notify users whose data has been shared.
Really almost all the top comments on this topic are people overreacting to the headline without realizing that the circumstances involved are emergencies and not just routine LE requests. Clickbait has ruined everything.
> the circumstances involved are emergencies and not just routine LE requests.
Fine, every routine LE request is now an emergency. Because one thing US LEOs are known for is their reserve in only requesting just the absolute minimum to do an investigation.
Try.
They'll try to notify users? After their data has been shared with police.
Well that's reassuring.
5 replies →
in 1984, it’s an emergency if you wrongthink
They will try but can be legally prohibited from notifying you. A server you control and have the keys to can be compelled by the police, but not without your knowledge.
Every supposed attempt to protect you is really just an attempt to justify an inherently unethical business model because it is profitable.
Reminds me of the First Law of Robotics[1]
"A robot may not injure a human being or, through inaction, allow a human being to come to harm."
“A provider like Google may disclose information to law enforcement without a subpoena or a warrant ‘if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency,'”
s/provider like Google/robot/
s/may disclose.*if the provider/may act to protect any person if the robot/
s/requires disclosure without delay of communications/requires action/
“A robot may act to protect any person if the robot believes that an emergency involving danger of death or serious physical injury to any person requires action without delay of communications relating to the emergency,'”
[1] https://en.wikipedia.org/wiki/Three_Laws_of_Robotics
Hackers gaining power of subpoena via fake “emergency data requests"
https://news.ycombinator.com/item?id=30842757
It's funny how things like this surprise people, as if the legal system is a trustworthy blob on their architecture graph. One fundamental thing about it is that it's made up of different people and a huge amount of people, all with differing levels of competence (so not only is it untrustworthy, but it can't even consistently do whatever its goals are) as opposed to having any coherent goal or ideology.
> “If we reasonably believe that we can prevent someone from dying or from suffering serious physical harm, we may provide information to a government agency — for example, in the case of bomb threats, school shootings, kidnappings, suicide prevention, and missing person cases,” reads Google’s TOS page on government requests for user information. “We still consider these requests in light of applicable laws and our policies.”
What's the penalty for police lying to Google?
Why, they would never! And if they did, surely there was a good reason! We have to trust the police and Google!
Do you really think someone would do that? Just go on the internet and tell lies?
Another article pointed out that most other cloud based offerings will still provide it if there is a warrant.
But it seems like Apple is the only cloud based offering that cannot actually respond to these requests even if they get one?
I just checked my HomeKit Secure Video camera and it seems like it isn't just the default setting, but the only setting. I see no way to tell it to not encrypt the data when storing it in iCloud (not sure why they would give that option at all TBH)
> “If we reasonably believe that we can prevent someone from dying or from suffering serious physical harm, we may provide information to a government agency — for example, in the case of bomb threats, school shootings, kidnappings, suicide prevention, and missing person cases,” reads Google’s TOS page on government requests for user information. “We still consider these requests in light of applicable laws and our policies.”
This is in line with the reasons cops can do things that otherwise normally require a warrant. This is generally 'a good thing.' The issue, for me, is in the abuse and interpretation of these exemptions.
Right, exactly. Google could have this and make it perfectly accountable. Just surface a user notification that X entity accessed your camera's data for Y time range, ideally with a reference to a case number. People will push back if the police abuse their power. They won't become as complacent, because they'll know when the cops are spying.
But would they actually do it?
I can’t seem to find the direct link, but I remember when the state of Illinois created a program to give these out for free
Recall at the time I mentioned to friends… I bet police get direct access and within 5 years, here we are lol
Many utility companies still do https://themoneyninja.com/free-google-nest-thermostat/
Do the thermostats have cameras in them?
They have occupancy sensors (not cameras), but those can still be used for surveillance.
3 replies →
I have no direct experience, but every time I see Illinois mentioned on commentary (HN, reddit, etc.) it's always surrounding corruption.
Illinois actually has some of the strongest privacy legislation in the country. I got a $350 check from Facebook for running facial recognition on my photo without permission, and Google owes me a similar amount when it's class action gets approved.
Check out the Illinois BIPA, it's the reason tech companies are trying to get federal privacy legislation that preempts state law.
FWIW, Illinois sometimes does crazy things the other way too. They banned facial recognition altogether, so Nest (and other cameras) can't offer the "familiar faces" feature, like to not alert you when a spouse comes home instead of a stranger.
Facebook also paid me several hundred dollars because they were auto tagging faces for Illinois users.
You haven't seen my comments praising Chicago ?
The friendliest city I've ever lived, amazing public transit and where I met my first real girlfriend.
For those of you old enough to answer: 30 years ago, did you foresee people spending significant amounts of money to install spy cameras in their homes and tracking devices in their pockets?
30 years ago (which was the early 1990s, eek!), analog CCTV was all the rage. Costs for cameras and VCR units plummeted, tapes became cheap commodities, and multiplexing video became trivial. With time-lapse and multiplexing, you only needed one VCR for four cameras, which could record for 24-48h on a single tape. It became cheap enough for businesses, hotels, apartment complexes, and the like to install them everywhere. Private CCTV became a staple of police procedural shows like Law and Order (1st season was 1990), which made people expect to be able to "check the tapes" after an alleged crime.
Edit: This same issue was also a problem in the 1990s with private CCTV! If a police officer or detective tells a business owner that a crime has been committed and there might be evidence on the tape, the owner doesn't have to show the police the tape without a warrant. But they usually did, because it looks suspicious if they don't.
Here's a quote from Max Headroom (of Pepsi commercial fame, for people old enough to remember Pepsi), from 1987:
Edison Carter: Security Systems has its tendrils into every element of our society - the government, our homes, the police, the courts - I'm not gonna spike this story just because it deals with dollar amounts beyond your comprehension! It's too important!
Murray: ...cerebral...
Theora Jones: Murray, we're trying to play this takeover as a threat to our average viewer. Nobody knows who's doing it. I mean, we all deal with SS every day - what if some really dangerous people got control of it?
Murray: Who do you think controls it now?
Actually yes. 30 years ago I was 8 and the first home CCTV setups were just coming out. People loved that shit. But then Im a brit and we're all nosey neighbours...
weren't the Brits using CCTV to catch kids skipping school a while back?
1 reply →
There were 7 instances in the entire year where this happened.
Folks - while it's definitely disturbing from a legal perspective and needs to be addressed 'proportionality' is also something we have to consider.
If this only happened '7 times' in a year, I'm doubtful this is arbitrary handing over of data.
'Real Life' is complicated, and sometimes processes don't line up as we would like. Neither Google nor the Police are corrupted institutions, rather, they can in some instances do things we don't want them to or that are actually bad. Meaning, I suggest in all likelihood there was likely some kind of material reason fore these '7 disclosures'. They used the term 'emergency' and I buy it.
What we need to do is close the loophole and adapt the judicial process so as to be able to accomodate such situations.
People are yelling about 'Orwell' - well that Dysoptia takes more than '7 times a year' in a nation of 350M to have surveillance abused on them. Again, needs to be sorted out, but we have to contextualise this.
So glad I ditched Gmail several months ago. I have a single Google Home device that was gifted to me by a friend, but I’m tempted to just unplug it at this point.
What are you using now? been aching to get off gmail for a while, just haven't found the right alternative that supports IMAP.
If you have a hosted website, check your provider. I have my domain at Dreamhost and they have IMAP included at my tier.
I moved off Gmail to them about 9 months ago and it's be good.
The worst part is that Dreamhost's spam filtering is abysmal compared to Google's. But my desktop is always on and I just keep Thunderbird running on it. TB's spam filtering is pretty good after training.
I figure some of the dedicated email hosting services do a better job with spam.
Not the person you replied to, buy Fastmail does IMAP just fine.
I switched to Fastmail and haven't looked back. Love it. IMAP is supported: https://www.fastmail.help/hc/en-us/articles/1500000279921-IM...
Fastmail, Protonmail
> prevent someone from dying or from suffering serious physical harm
These are exigent circumstances, which allow police to enter your home without a warrant. Extending that access to include video cameras seems reasonable.
This is a "In Case of Emergency Break Glass" type of situation.
How do you define this though. If someone say talks about XYZ politician. And the current governor feels if said XYZ person takes his position that it’d cause you personal harm. Can the current governor access your camera?
If a police officer comes to your house without a warrant are they allowed to break in? If not they shouldn’t be given access to my camera feeds without my permission.
The move by google here just re-affirmed that I made the right choice to not buy their products.
> circumstances that would cause a reasonable person to believe that entry (or other relevant prompt action) was necessary to prevent physical harm to the officers or other persons, the destruction of relevant evidence, the escape of the suspect, or some other consequence improperly frustrating legitimate law enforcement efforts
https://www.law.cornell.edu/wex/exigent_circumstances
3 replies →
> If a police officer comes to your house without a warrant are they allowed to break in?
Absolutely. If they hear gunshots or screams of “help! Help!” they will break the door down. I’m sure there are other triggers, too.
My problem with this is defining exigent circumstances as it relates to video or similar data. I can't easily think of a circumstance where the police are outside my house, encounter an exigent circumstance, but also have the time to request/obtain data from Google. And if the police are made aware of to something in advance, they have time to get a warrant.
Didn't you know? Future Crimes are now exigent circumstances!
If it's reasonable, then there shouldn't be a problem letting users turn it off.
If police attempt to enter your home under exigent circumstances, you know.
You can get a lawyer, go to court, and demand an accounting.
You don't have that control here. Your footage can just walk off, no clue. No accounting, no reporting, no post-hoc punishment for mis-use.
> go to court, and demand an accounting.
> You don't have that control here. Your footage can just walk off, no clue. No accounting, no reporting, no post-hoc punishment for mis-use.
The supreme court recently ruled that a woman beaten by police didn't have standing to sue. Good luck with breaking qualified immunity in a court of law in the coming years.
1 reply →
Heh, exigent circumstances? If somebody is hurt or calling for help, by all means knock down a door or bust a window. But exigent circumstances for rifling through my documents? Get a fucking warrant!
> This is a "In Case of Emergency Break Glass" type of situation
The only difference being that when you pull the alarm for lols there are consequences -- for you. Members of law enforcement on the other hand do that on the regular and face zero consequences.
That said, Google doing this might ease the pressure to enable this across the board through legislation. So maybe a positive in the end; I wouldn't really expect any privacy with Nest anyways.
> This is a "In Case of Emergency Break Glass" type of situation.
The problem is there isn’t any broken glass here. No judge is stamping this, and I see no duty to warn the customer about what device and data was accessed, and there doesn’t seem to be a way to opt out ahead of time. This removes a lot of checks in the name of expediency.
Yes, the only sensible comment is downvoted to the bottom of the page. In U.S. jurisprudence "exigent circumstances" gives police all kinds of powers including warrantless searches of all kinds, up to and including electronic surveillance and phone taps.
The "process" to which you are "due" when it comes to these things is if the police try to use this information to prosecute you, they have to explain it in court, whereas if they obtain it through a search warrant, they have to explain themselves in advance. It's all "due process".
It's literally a checkbox a cop clicks when they request data with no vetting that it actually is an emergency or consequences if it is not.
Oh, have you seen the forms the cops fill out to do the data request? Or are you theorizing?
9 replies →
> “A provider like Google may disclose information to law enforcement without a subpoena or a warrant ‘if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency,'” a Nest spokesperson tells CNET.
I sympathize with this dilemma. It's a real-life version of the Trolley Problem[1].
[1]: https://en.wikipedia.org/wiki/Trolley_problem
But "to any person", e.g., a CIA asset in the field might be exposed by a gmail user, thus threatening her/his life, thus pre-emptively disclose the gmailer's info to law enforcement?
Or imagine an idle threat is made off-hand in a private gmail, so pre-emptively disclose that threat to law enforcement?
In the sci-fi Minority Report scenario, Google could use AI language models on all gmail to make a judgment call on "emergent danger of serious physical injury". If I plan to go bunjee jumping with an unreliable provider, Google scans my gmail and tells law enforcement?!?
Yes good examples of how it can be abused. I'm certain the interpretation could be very liberal depending on the person making the decision.
I know a person who was banned from twitter and was nearly fired because he dead-named somebody. The explanation was that it was literal violence against the person he dead-named, because so many trans people self harm if they don't feel that their identity is affirmed. The person who was banned says it was a force of habit because the person had only very recently went public with their new identity, but it did not stop the ban hammer. He almost lost his job as well because the tweet was posted in a public slack channel. HR left it up the person who was dead-named to make the decision, and they decided not to fire him.
I could absolutely see a scenario like the above happening in gmail or some other Google product, and the decision-maker deciding that it was a threat to a person's life and should be disclosed. To some people that makes perfect sense. To others it does not. The point is simply that when we let humans make subjective decisions like that, we get all the downsides of human judgment.
I have difficulty understanding Googs (or Amazons etc) motivation to do this. What do they have to gain by being excessively cooperative with police force, especially on a local level? I can understand that having good rapport with feds might have benefits, but this doesn't sound like that
Amazon's motivation is quite clear - they want to reduce shrinkage by discouraging "porch pirates" from stealing Amazon deliveries. Not sure what Google's motivation is, but it might just come down to optics. Consider how Apple gets raked over the coals in the media by DAs when they refuse to unlock a suspects phone.
> Amazon's motivation is quite clear - they want to reduce shrinkage by discouraging "porch pirates" from stealing Amazon deliveries.
You say they hand all the information to the police to prevent package stealing? Iam pretty sure thats not the reason at all, maybe a very very little part of it.
Just giving out the data with no due diligence saves billable hours from their lawyers.
Simple, if they cooperate without being asked by warrant they might hope that their using the underlying data may be overlooked and not reviewed by say oh US Congress.
Is there a decent "connected" camera that allows you to specify and use your own storage solution?
I used Reolinks in the past... Had them save locally on the camera's SD card and upload via FTP on the server on my local network... I also blocked their internet access
How easy would it be for google to, you know, program an interface that allows the police request to be shown to the owner and have them say yes or no to the video wanted?
It should never be possible for a cloud provider to decrypt data from your devices. It should be encrypted by a public key you load on the device and only decrypted by your private key. The cloud prouder should be a dumb provider of the service and not get in the way. As soon as the cloud provider gives your decrypted data away to random people then that is a massive security hole.
This just left me with my head shaking in disappointment after just reading the title.
I'm done with all these devices, yet I know that my phone will still have this ability even if I've disabled the hotword functionality.
Luckily for us, there are still the single board computers with cameras attached to them, which can do the same job without the could.
Is anyone really surprised? I am not. Google has such a bad relationship to data privacy, they don't see the problem. Getting a warrant is so easy in the US right now, so there is very little reason to disrespect your customers privacy. They just don't see the problem.
Anyone operating under the assumption that their government doesn't already have unfettered, at-will access to all their data is deluding themselves. News like this should come as a surprise to no one, least of all the technically literate crowd here.
The market seems to be wide open for a range of home devices that don't violate your privacy.
"Google will allow law enforcement to access data from its Nest products — or theoretically any other data you store with Google — without a warrant."
At this point, what doesn't Google know or is unable to accurately infer about any given person on the internet?
At this point I cannot believe that anyone in Tech would have a Google account being that they should know better. Anyone could be made to look guilty when the authorities have enough data.
Adding this for the people who keep downvoting this:
https://www.mintpressnews.com/national-security-search-engin...
"Google – one of the largest and most influential organizations in the modern world – is filled with ex-CIA agents. Studying employment websites and databases, MintPress has ascertained that the Silicon Valley giant has recently hired dozens of professionals from the Central Intelligence Agency in recent years."
We are imprisoned by our addiction to convenience. I am in the middle of dealing with this now, switching my services where I can: dumb phone, linux laptop, swisscows, openstreetmap and an old Garmin GPS, and just being OK with uncertainty.
> old Garmin GPS
I want this. Which model did you get and does it have up-to-date maps?
4 replies →
"Any" includes people who do not use Google and this is about 10% of online users. For them, a lot.
They still have facial recognition feeds, car feeds, and they purchase data from third-party consumer surveillance firms, including credit card purchase histories for non-Google users. You don't need to have a Google account to be tracked by AdWords, and there's no practical opt-out, other than staying logged in all the time, and then being tracked in other ways, and agreeing to all sorts of things in their (ever-changing) EULA.
https://epic.org/documents/google-purchase-tracking/
I'm sure they have other programs I haven't heard of.
1 reply →
The article implies that Apple makes a doorbell. Do they? There are obviously Homekit doorbells, but this sentence implies otherwise:
> Apple’s default setting for their doorbells is end-to-end encryption which means the company is unable to share user video at all.
Homekit doorbells use iCloud services and storage to host/serve the video; that's how Apple is involved even though they don't make the doorbells.
I had a Nest at my previous house - decided to try the Wemo Homekit doorbell this time and I'm very pleased with it. I also use an Apple TV to drive all the content on my TV and the Homekit video notifications are amazing - instantaneous since the Apple TV is my local homekit hub. Way faster and far more reliable than the Nest doorbell ever was.
I'm sure Google's Machine Learning!(tm) will always make the right decision!
If anyone wants to get rid of their devices because of this I'll take them :D
Use a camera that exposes an RTSP feed like Amcrest and buy Blue Iris. Backup whole disk with Backblaze.
You’re done, and you’re welcome.
If you’re really lazy at least use something like Apple HomeKit with supported cameras.
Any RTSP camera, frigate and homeassistant makes it pretty easy for tech related folks to have a state of the art surveillance system with every feature you could imagine.
Wow. So Ring and Nest at it. What are some safe alternatives please?
Home Assistant
Logitech
Logitech does not have a competing system. They offer Cameras which tie in with Apple Homekit so the alternative here is Apple HomeKit.
I am looking into SimpliSafe [1]. Anyone know if they store these data?
[1] https://simplisafe.com/
I haven't looked into it, but someone else recommended https://github.com/blakeblackshear/frigate which integrates with Home Assistant.
I see them shilled in youtube sponsor deals often enough that I have to assume they're no good.
I would happily pay more for a company that will refuse to do this. This will be a strong market opportunity, at least for this buyer.
Incorrect title. Not the nest, Google here is allowing thier devce. Google is the one handing over data without a warrant.
In fairness, there is good reason to release footage without a warrant for the reasons they list (including "school shootings, kidnappings, suicide prevention, and missing person cases"). I'd like a robust monitoring of how the information is used. But the law already recognises that you don't need a warrant in urgent, life threatening cases. And let's get real, getting a warrant is so easy these days as to be meaningless...
It is far, far better to set up your own personal cloud and run your own encrypted video capture system.
You get both security AND privacy.
And all it costs is the anxiety of wondering whether you succeeded or your bedroom is currently visible via shodan.io.
That’s why cybersecurity job security is so secured against the leaking dikes of poorly designed computing protocols and software.
Glad I'm using Euphy and not Nest
I'm not sure they're much better. From the SHARING PERSONAL INFORMATION WITH THIRD PARTIES section of their privacy page:
We may share your personal information in the instances described below
Third parties as required to (i) satisfy any applicable law, regulation, subpoena/court order, legal process or other government request, (ii) enforce our Terms of Use Agreement, including the investigation of potential violations thereof, (iii) investigate and defend ourselves against any third party claims or allegations, (iv) protect against harm to the rights, property or safety of Eufy, its users or the public as required or permitted by law and (v) detect, prevent or otherwise address criminal (including fraud or stalking), security or technical issues.
If we should ever file for bankruptcy or engage in a business transition such as a merger with another company, or if we purchase, sell, or reorganize all or part of our business or assets, we may disclose your information, including personally identifiable information, to prospective or actual purchasers in connection with one of these transactions.
We may also share information with others in an aggregated and anonymous form that does not reasonably identify you directly as an individual.
At least it's not owned by American company, so doesn't technically _have_ to give the government institutions whatever they ask for. It's Chinese though, and that's not much better.
Why do people still put a camera in their homes connected to the internet?
That itself is the most bizarre behaviour.
So I could see what the hell my nanny is up to with my children. I also don't want to have to spend 2 days setting up some hacked together system that I also have to spend time supporting when I simply don't have the time or will. That's why!
Any open-source projects to reliably stream and archive a video from a raspi?
I did this for a university project. It streams to S3 (of Azure or Digital Ocean) encrypted, the client downloads it from there.
It's very rough around the edges but if you are up to contribute it's a good base.
https://github.com/tcz/choicecam-server https://github.com/tcz/choicecam-client
The client is a React Native project, should run on Android or iOS.
For streaming, I have a few pi's (and cameras) running v4l2rtspserver, and it seems to work pretty well. It appears to be using the Broadcom hardware support for H.264 encoding, so it's pretty light on the CPU. I'm currently using Shinobi on a different host to receive and archive the RTSP streams. (Although I'm interested in checking out Frigate, which was mentioned elsewhere in this discussion.)
MotionEye?
I don't 'hate' this but how the heck would google detect something like this? Why do I feel like they're analyzing every word we say in our homes and building some kind of profile (for ad reasons). On second thought I do hate this
11 times in a year across the US sounds quite reasonable though.
Why isn't end to end encryption a standard now?
Because it's impractical in a lot of cases.
Most consumers don't want to (or can't) deal with managing encryption keys, and aren't going to be keen on the idea that if you lose the key, you lose the data permanently.
Pressure from governments reportedly.[1]
[1] https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
Your daily reminder - if you don't host the data, someone else does. And their interests may or may not align with yours. And even if their interests align with yours today, that's no guarantee they will tomorrow. If you don't want audio, video, etc potentially shared with authorities, don't install cloud-enabled audio/video devices in your home.
"Cloud" means somebody else's computer. This is pithy, people here are sick of hearing it, but it's still true.
It could be your private cloud therefore your computer. <5% of people probably have their own server. When that % changes significantly, we may need to stop saying this.
18 replies →
"Someone else's computer" would be misinformation in any other medium SOLELY because it makes it sound like it's being stored on the same kind of computer that an average person has - that another average person is using. There was a smear campaign in 2013 for cloud computing under this very message.
Apple stores HomeKit video in their cloud.
It’s worthless because it’s end-to-end encrypted. They can hand over the data but no one can view it.
There are safe ways of using the cloud.
>> “ During this process, the HomeKit data is encrypted using keys derived from the user's HomeKit identity and a random nonce and is handled as an opaque binary large object, or blob.”
If you don’t control the keys, to me, that’s not end-to-end encrypted.
Source: https://support.apple.com/guide/security/data-security-sec49...
2 replies →
Can you verify that or are you just taking their word?
1 reply →
If the backup password to these encrypted files is known, it can be rather trivial to access the data within.
Recently, a certain head of state's son had 100s of GB of iCloud backups thrown onto a torrent, and within a day rogue manchildren living in their parents' basements cracked most, if not all of it open.
With the backup password in hand, all one needs is this README.md file [0] to be off to the races.
[0] https://github.com/avibrazil/iOSbackup/blob/master/README.md
6 replies →
I like my Eufy doorbell and cameras, which stores recordings on an appliance that I keep in my office.
Wildly fascist. The warning sign was when AT&T got retroactive immunity for sharing customer data with the NSA. I wonder when Americans will decide to push the reset button.
Was never your data to begin with
Police should not be able to ask without a warrant.
down with surveillance capitalism!!
Some may be uncomfortable with a company that has access to the most private data of so many people being ready and willing to cooperate with the police state, but voicing your support for this policy is actually a great way to demonstrate your Googleyness during the interview process!