{"id":6011,"date":"2026-08-26T13:08:15","date_gmt":"2026-08-26T13:08:15","guid":{"rendered":"https:\/\/silvybrand.com\/?p=6011"},"modified":"2026-08-26T13:08:15","modified_gmt":"2026-08-26T13:08:15","slug":"ring-take-encryption-throw-away-the-key-law-enforcement","status":"publish","type":"post","link":"https:\/\/silvybrand.com\/?p=6011","title":{"rendered":"Ring says its new encryption limits what it can give police"},"content":{"rendered":"


\n<\/p>\n

\n
\n

Ring has a new way to protect your videos. It\u2019s developed an encryption method called TAKE<\/a>, short for Throw Away the Key Encryption, that the Amazon-owned company says will protect your videos without traditional end-to-end encryption. TAKE limits when and why Amazon\u2019s cloud can access those videos, while still providing features like smart alerts for people and packages, AI-powered video search, and video descriptions<\/a>.<\/p>\n<\/div>\n

\n

The feature is rolling out gradually starting in September, regardless of whether you have a subscription, and will become the default encryption for all Ring customers.<\/p>\n<\/div>\n

\n
\n
\n
\n
\n
\"\"<\/a><\/div>\n<\/div>\n<\/div>\n

Image: Ring<\/cite><\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n

TAKE arrives during a year of intense scrutiny for Ring, driven by its ties to law enforcement<\/a> and the privacy implications of its AI-powered Search Party feature<\/a>. Ring says TAKE changes what the company can hand over to law enforcement. \u201cRing will only be able to provide non-video information \u2026 and encrypted video files in response,\u201d Ring spokesperson Sam McGee said in an email to The Verge.<\/em> However, it doesn\u2019t completely eliminate the privacy trade-off of cloud-based cameras.<\/p>\n<\/div>\n

\n

Ring says TAKE uses unique, rotating encryption keys for your footage, stored in a secure enclave and accessible only under strict conditions \u2014 based on the features you enable on your account. Currently, footage captured by Ring cameras is encrypted in transit to the cloud and at rest, and then decrypted for Ring to process for those smart features. With TAKE, the encryption keys change for every five minutes of footage. Ring stores copies of those keys to decrypt the footage, but throws away each copy within 24 hours, \u201cleaving you with the keys and full control of your videos,\u201d according to Ring.<\/p>\n<\/div>\n

\n

TAKE was developed using Messaging Layer Security<\/a>, an open standard from the Internet Engineering Task Force, according to Ring. The company says it is \u201cinspired by the privacy principles of E2EE (end-to-end encryption),\u201d which Ring offers on some of its cameras. However, the two systems work differently. With E2EE, Ring never has the keys and can\u2019t process your video for cloud-based features. Both options are available on newer cameras that encrypt on-device, and you can switch between the two. Older cameras encrypt at cloud ingress and only support TAKE.<\/p>\n<\/div>\n

\n
\n
\n
\n
\n
\"A<\/a><\/div>\n<\/div>\n<\/div>\n

A screenshot from the TAKE white paper published by Ring.<\/em><\/figcaption><\/p>\n<\/div>\n<\/div>\n<\/div>\n
\n

According to a white paper the company published today<\/a>, Ring\u2019s copy of those keys is managed inside an AWS Nitro Enclave, to which Ring\u2019s access is restricted by \u201caccess controls, cryptography, and hardware isolation.\u201d The company claims there is no persistent storage and no way for a Ring employee to access it. The stored keys can only be unlocked by the enclave through cryptographic attestation that proves it\u2019s running the exact software image Ring approved. The enclave releases a temporary key when an enabled service requests it.<\/p>\n<\/div>\n

\n

Each key is permanently deleted after 24 hours \u2014 a window McGee told The Verge<\/em> allows for processing its current cloud-based features \u2014 and no backups are kept. To view older footage, an authorized device running the Ring app (such as your phone or computer) must send the keys back to Ring for that session. Ring claims key delivery is push only, meaning Amazon\u2019s servers can\u2019t force devices to hand over your keys remotely; only you can request one.<\/p>\n<\/div>\n

\n

If you lose access to your device, Ring says there are several recovery methods, all of which are only accessible to the customer. These include cloud backup via your phone, a passphrase, passkey, another authorized device, and camera-based recovery. If all those fail, you won\u2019t be able to access encrypted content.<\/p>\n<\/div>\n

\n

The white paper details how the keys are generated and how Ring continuously \u201cthrows away\u201d your old keys. Ring says it\u2019s continuing to harden this architecture:<\/p>\n<\/div>\n

\n
\n

Deletion is continuous rather than a single event at the 24-hour mark. Content encryption keys rotate every five minutes, and as each key ages past 24 hours, CMMS [Cloud Member Management Service] ratchets forward the corresponding intermediary secret in the key derivation hierarchy. Ratcheting applies a one-way key derivation function to overwrite a managed secret with its derived output and discards the original, making it cryptographically infeasible to reconstruct. [\u2026] The CMMS database is configured with no backups. This deletion is designed to be irreversible.<\/p>\n<\/blockquote>\n<\/div>\n

\n

TAKE isn\u2019t E2EE, but it limits Ring\u2019s access<\/h2>\n<\/p>\n<\/div>\n
\n

Ring says that \u201conly you retain the keys to your video\u201d with TAKE. But TAKE isn\u2019t E2EE. Ring has access for up to 24 hours and can receive keys again when you pull up older videos. You can also share the keys with others. With E2EE enabled on Ring cameras, none of that is possible, making it the stronger privacy option.<\/p>\n<\/div>\n

\n

Ring\u2019s main reason for developing TAKE is to preserve cloud-based features you lose with E2EE. But as the footage goes to Amazon\u2019s servers for processing, it still has the privacy trade-off of cloud-based cameras. Cloud processing can deliver more sophisticated features, but basic on-device intelligence can still alert you to people and packages.<\/p>\n<\/div>\n

\n
\n

\u201cWhere TAKE is enabled, Ring will only be able to provide non-video information (such as basic subscriber information) and encrypted video files in response to the valid legal process.\u201d<\/p>\n

\u2014 Sam McgEe<\/cite><\/div>\n<\/div>\n

\n

Competitors including Reolink and Eufy offer cameras and hubs that can store and process footage locally<\/a>, so it doesn\u2019t need to be done in the cloud. Ring also has local processing through Ring Edge<\/a> on its Ring Alarm Pro<\/a> hub, but that doesn\u2019t work with E2EE.<\/p>\n<\/div>\n

\n

Ring says many of its features can\u2019t run locally. \u201cFeatures that require cloud processing include Unusual Event Alert, Video Descriptions, Smart Alerts, and Video Search, for example,\u201d McGee said. \u201cThese features rely on models and infrastructure that cannot run locally on camera hardware.\u201d<\/p>\n<\/div>\n

\n

The Verge <\/em>also asked McGee about concerns users might have regarding how TAKE processes videos in relation to privacy and law enforcement access:<\/p>\n<\/div>\n

\n

What happens if Ring is subpoenaed by law enforcement? Does TAKE prevent law enforcement and others from accessing footage?<\/strong><\/p>\n<\/div>\n

\n

\u201cWhere TAKE is enabled, Ring will only be able to provide non-video information (such as basic subscriber information) and encrypted video files in response to the valid legal process. We have updated our Law Enforcement Guidelines to reflect this change.\u201d<\/p>\n<\/div>\n

\n

Does this change Ring\u2019s Community Requests program and the partnership with Axon?<\/strong><\/p>\n<\/div>\n

\n

\u201cCommunity Requests remains a transparent way for local public safety agencies to request footage from customers to support an official investigation. Customers always choose whether to respond to a Community Request and what they share. If they choose to ignore a request, the Requesting Agency is never notified. TAKE does not change this.\u201d<\/p>\n<\/div>\n

\n

Do governments have a backdoor into TAKE?<\/strong><\/p>\n<\/div>\n

\n

\u201cNo. Building a backdoor would undermine the enhanced security and privacy that we designed TAKE to deliver.\u201d<\/p>\n<\/div>\n

\n

Does Ring train on any data or metadata from users\u2019 Ring devices?<\/strong><\/p>\n<\/div>\n

\n

\u201cRing only trains on video recordings that have been made publicly available, or on recordings from users who have given Ring explicit permission to use them for this purpose. Users can revoke permission at any time.\u201d<\/p>\n<\/div>\n

\n

When asked if TAKE had been independently evaluated, McGee said, \u201cTAKE is built on Messaging Layer Security, an open standard developed and reviewed through the IETF. We are publishing a detailed technical whitepaper explaining how the system works.\u201d<\/p>\n<\/div>\n

\n

You can read the current white paper<\/a> to see how Ring describes TAKE\u2019s many protections.<\/p>\n<\/div>\n

\n

Ring\u2019s TAKE appears to address many of the concerns around cloud processing, allowing a balance between security, privacy, and convenience, especially compared to E2EE, which gives you privacy but not the Ring features you probably bought these cameras for. While TAKE is built on a standard, Ring developed the parts that involve throwing away the key itself, so you still have to trust Amazon and Ring.<\/p>\n<\/div>\n

Follow topics and authors<\/strong> from this story to see more like this in your personalized homepage feed and to receive email updates.<\/span><\/p>\n