Ring says its new encryption limits what it can give police
Ring introduced TAKE (Throw Away the Key Encryption), a new encryption method that limits cloud access to video footage without full end-to-end encryption (E2EE) Encryption keys rotate every five minutes and are automatically destroyed after 24 hours using AWS Nitro Enclaves with cryptographic attestation and irreversible deletion TAKE is built on Messaging Layer Security (MLS), an open IETF standard, and will become the default encryption for all Ring customers starting in September Unlike E2EE
Analysis
TL;DR
- Ring introduced TAKE (Throw Away the Key Encryption), a new encryption method that limits cloud access to video footage without full end-to-end encryption (E2EE)
- Encryption keys rotate every five minutes and are automatically destroyed after 24 hours using AWS Nitro Enclaves with cryptographic attestation and irreversible deletion
- TAKE is built on Messaging Layer Security (MLS), an open IETF standard, and will become the default encryption for all Ring customers starting in September
- Unlike E2EE, TAKE allows Ring to process videos for smart features (alerts, search, descriptions) while still restricting what can be handed to law enforcement to encrypted files and non-video metadata
- The system requires customer-initiated key retrieval for older footage, with no persistent storage or backups, though users must still trust Ring/Amazon's implementation
Why It Matters
Ring's TAKE represents a significant shift in how consumer smart home companies balance privacy and functionality, offering a middle ground between full E2EE (which sacrifices cloud features) and traditional cloud encryption (which offers weaker privacy guarantees). For AI practitioners and security researchers, it demonstrates a practical application of MLS and hardware-isolated key management at consumer scale, while raising important questions about trust assumptions in cloud-based AI processing pipelines.
Technical Details
- Key Rotation & Deletion: Encryption keys rotate every five minutes per footage segment; each key copy is permanently deleted within 24 hours using a Cloud Member Management Service (CMMS) that ratchets forward intermediary secrets via one-way key derivation functions, making reconstruction cryptographically infeasible
- Hardware Isolation: Key storage and management occur within AWS Nitro Enclaves, protected by access controls, cryptography, and hardware isolation; Ring employees have no direct access, and key release requires cryptographic attestation proving the enclave runs approved software
- MLS Foundation: TAKE is built on Messaging Layer Security (IETF open standard), adapted by Ring for video encryption with custom key-throwaway logic not present in the base standard
- Key Retrieval Model: Key delivery is push-only from user devices—Amazon servers cannot remotely force key handover; users must actively request keys via the Ring app on authorized devices, with recovery options including cloud backup, passphrase, passkey, secondary devices, or camera-based recovery
- Feature Compatibility: Cloud-dependent AI features (Unusual Event Alert, Video Descriptions, Smart Alerts, Video Search) continue to function under TAKE, whereas E2EE disables these entirely; older Ring cameras support only TAKE, while newer models offer both TAKE and E2EE
Industry Insight
- TAKE sets a precedent for "privacy-preserving cloud AI" in consumer hardware, suggesting that full E2EE may not be the only viable path to stronger privacy—time-bounded key access with hardware isolation could become a standard pattern for devices that need cloud processing
- The approach highlights an ongoing tension in the smart home industry: companies will likely continue offering tiered encryption options (TAKE vs. E2EE) rather than mandating the strongest privacy by default, placing the burden of privacy choices on consumers
- Law enforcement compliance remains a gray area—while TAKE prevents Ring from producing decryptable video without user cooperation, the existence of Community Requests and partnerships like Axon means privacy-conscious users should carefully evaluate what features they enable and understand the full scope of data sharing beyond legal process
Disclaimer: The above content is generated by AI and is for reference only.