Ring limits data shared with police through new encryption method
Amazon-owned Ring develops TAKE encryption to enhance user video privacy while preserving cloud features.
1New TAKE encryption method
Ring has developed a new encryption method called 'Throw Away the Key Encryption' (TAKE) to protect user videos. Unlike traditional end-to-end encryption, TAKE limits Amazon cloud's access to videos while maintaining smart alerts and AI-powered video search features. The method will become the default encryption for all Ring customers starting September 2026, offering enhanced privacy without sacrificing functionality.
2Changes in data shared with law enforcement
With TAKE, Ring is altering the scope of data it can provide to law enforcement. The company will now only share non-video information and encrypted video files. Ring spokesperson Sam McGee stated this change aims to protect user privacy. However, the privacy trade-offs of cloud-based cameras aren't completely eliminated, as some processing still occurs on Amazon servers.
3Encryption key management
The TAKE system uses unique, rotating encryption keys for every five minutes of footage. These keys are stored in a secure enclave and are only accessible under specific conditions based on enabled account features. Ring permanently deletes key copies within 24 hours. To view older footage, users must resend keys through the Ring app, maintaining control over video access while enabling cloud features.
4Security with AWS Nitro Enclave
Ring manages encryption keys using AWS Nitro Enclave technology, protected by access controls, cryptography, and hardware isolation. The company claims keys can only be accessed through cryptographic attestation and that no Ring employee can access them. The system features no persistent storage or backups, ensuring keys can't be retrieved after deletion. This architecture represents Ring's effort to harden its security infrastructure.
5Key deletion process
Ring designed the key deletion process to be continuous and irreversible. New content encryption keys generate every five minutes, with keys older than 24 hours being permanently deleted. The Cloud Member Management Service (CMMS) overwrites intermediary secrets using one-way functions in the key derivation hierarchy. The database maintains no backups, making key recovery impossible after deletion.
6Comparison with E2EE
TAKE doesn't offer the same privacy strength as end-to-end encryption (E2EE). With TAKE, Ring maintains access to videos for up to 24 hours, and users must resend keys when viewing older footage. E2EE prevents Ring from ever having keys, disabling cloud features entirely. Newer Ring cameras support both options, allowing users to choose between maximum privacy (E2EE) or cloud functionality (TAKE).
7Recovery options
Ring provides multiple recovery methods if users lose device access, all exclusively available to the account owner. Options include cloud backup via phone, passphrase, passkey, another authorized device, or camera-based recovery. If all methods fail, encrypted content becomes permanently inaccessible. These measures balance security with practical account recovery needs while maintaining user control over video access.
8Balancing privacy and cloud features
Ring developed TAKE to preserve cloud-based features lost with E2EE while improving privacy. However, sending footage to Amazon servers for processing maintains some cloud camera privacy trade-offs. The company aims to balance sophisticated cloud features with user privacy protections. Basic on-device AI can still provide person and package detection alerts without cloud processing, offering a middle ground for privacy-conscious users.