Ring unveils TAKE encryption to balance cloud features with privacy

Ring, the smart home security brand owned by Amazon, has introduced a new encryption method designed to address growing privacy concerns among consumers. The system, known as TAKE or Throw Away the Key Encryption, is set to become the default for all Ring cameras starting in September. The rollout will occur gradually and applies to all customers, regardless of their subscription status.

The primary objective of TAKE is to preserve the utility of cloud-based features, such as smart alerts for people and packages, AI-powered video search, and video descriptions. Unlike traditional end-to-end encryption, which prevents the company from accessing footage entirely, TAKE allows for temporary access to encryption keys. This enables Ring to process video data in the cloud while maintaining a layer of security that restricts long-term corporate access.

Under the new protocol, unique encryption keys rotate every five minutes. These keys are stored in a secure AWS Nitro Enclave, a hardware-based security environment that uses access controls and cryptographic attestation to verify software integrity. Ring states that it keeps copies of these keys for processing purposes but permanently deletes them within 24 hours. No backups are retained, meaning that after this window, the company claims it no longer holds the means to decrypt the footage without customer input.

This distinction is significant for legal proceedings. Ring spokesperson Sam McGee confirmed that where TAKE is enabled, the company will only be able to provide non-video information, such as basic subscriber details, and encrypted video files in response to valid legal process. To access older footage, an authorised device running the Ring app must send the keys back to Ring for that specific session. Ring asserts that key delivery is push-only, preventing Amazon’s servers from remotely forcing devices to hand over keys.

The system is built on the Messaging Layer Security open standard from the Internet Engineering Task Force. While Ring describes TAKE as being inspired by the privacy principles of end-to-end encryption, the two are functionally different. Newer cameras that support on-device encryption can switch between TAKE and end-to-end encryption, whereas older cameras that encrypt at cloud ingress will only support TAKE. End-to-end encryption remains the stronger privacy option as it prevents Ring from accessing keys at all, but it disables the cloud-based features that many users rely on.

The introduction of TAKE comes during a period of intense scrutiny for Ring, driven by its ties to law enforcement and the privacy implications of its AI-powered Search Party feature. Competitors such as Reolink and Eufy offer cameras that store and process footage locally, avoiding cloud trade-offs altogether. However, Ring argues that features like Unusual Event Alert and Video Search rely on models and infrastructure that cannot currently run on local camera hardware.

While the new architecture aims to offer a balance between security, privacy, and convenience, critics note that users still must trust Amazon and Ring with their data. Although the system is built on an open standard, the specific mechanisms for key rotation and deletion were developed by Ring. The company has published a technical white paper detailing how the system works, but the approach has not yet been independently evaluated.