Usually, when you see a feel-good story about finding a lost dog, you don’t immediately react with fear and revulsion. But that was indeed the case in response to a Super Bowl commercial from Amazon-owned security camera company Ring. There’s now a group offering to dole out a $10,000 bounty to wrest back control of the user data Ring controls.
The ad showed off a new feature from Ring called Search Party. It uses a network of Ring cameras to scour a neighborhood for signs of lost dogs. But as the details of a leaked internal Ring email reported by 404 Media revealed, the service could eventually be used to find other animals and people as well.
The commercial was met largely with widespread criticism across social media and the tech press, which called out Search Party for essentially being a thinly-veiled neighborhood surveillance dragnet. People are even publicly destroying their Ring cameras. In response, Ring immediately canceled its partnership with the controversial AI surveillance company Flock. Ring CEO Jamie Siminoff has been on something of an apology tour since the Super Bowl commercial aired. (A Ring spokesperson acknowledged our request for comment and says the company will provide one shortly; we’ll update this story when we hear back.)
The Fulu Foundation, a group founded by repair advocate and YouTuber Louis Rossmann, pays out bounties to people who can remove user-hostile features on connected devices. The nonprofit saw this pushback as a moment of opportunity for people to take back control of their devices.
“It’s been an interesting moment for people to grasp exactly the trade-off that they have had to accept when they installed these security doorbell cameras,” says Fulu cofounder Kevin O’Reilly. “People who install security cameras are looking for more security, not less. At the end of the day, control is at the heart of security. If we don’t control our data, we don’t control our devices.”
Fulu’s latest bounty is for Ring’s video doorbell cameras, meant to encourage hackers and tinkerers to disable software features that require the devices to send data to Amazon. The reward is a potential payout of $10,000 or more.
To score the bounty, the winner will have to adhere to a few requirements designed to make sure the hardware itself stays in working order. After modifications, the device must be able to work with a local PC or server, and be capable of halting data sent to Amazon servers or requiring a connection to other Amazon hardware. All of this must be done without disabling on-device hardware features like motion detecting and color night vision. The job also has to be accomplishable with “readily available and inexpensive tooling” and “instructions that a moderately technical user could carry out” in less than an hour.
“This needs to be a weekend project,” O’Reilly says, “where someone who was creeped out by a commercial and wants to take back control can take care of it, get it done, and be able to sleep soundly at night knowing that they’re the only ones who can see their footage.”
The first person to accomplish all of that with a Ring camera—and prove they can do it—gets the money. The reward starts at $10,000, but will likely grow as donors contribute more money (it’s already sitting closer to $11,000 as of publication). On top of that, Fulu will award up to an additional $10,000 to match donations for the winner.
To get a Fulu bounty, winners don’t actually need to release their findings to the public, as that has the potential to open them to legal recourse for violating the part of Section 1201 of the Digital Millennium Copyright Act, which prevents people from circumventing digital locks. O’Reilly says that, like all Fulu bounty winners, the recipient will be able to choose if they want to release their work and thereby open themselves up to legal rebuke.
“In a perfect world, we’d find somebody who could solve this problem,” O’Reilly says. “We’d make it available to Ring owners around the country. But because of Section 1201 and its frankly antiquated and outdated policies, people aren’t going to be able to do that.”
O’Reilly says Fulu had long had its eye on prioritizing Ring in its bounty program, given the various controversies the company has garnered about how Ring cameras collect data and the privacy rights of people caught in the videos. Ring has made efforts to soften its public image by focusing on feel-good features like finding lost dogs or partnering with the fire tracking service Watch Duty to better monitor wildfire movements. Still, Ring has not been able to separate itself from the panopticon discourse, and the fervor around the Super Bowl ad has warranted moving the project way up the bounty list.
O’Reilly also says that it is important to focus on the software here, because while some people may be smashing their devices, others still want to have a hardware camera that works.
“Control shouldn’t require a trade-off of all of the features that you like,” O’Reilly says. “You shouldn’t have to sacrifice the smart capabilities of your device if you don’t want to.”
The post A $10K Bounty Awaits Anyone Who Can Hack Ring Cameras to Stop Sharing Data With Amazon appeared first on Wired.
