The other explanations here don't explain the long delay between the start of the investigation and the release of the footage.
Yes, storing customer data is what we'd expect from Google and yes, the FBI can coerce Google to provide this data for their investigations.
But it does not take a week for Google to find a file on their servers.
My hunch is that Google initially tried to play dumb to avoid compliance, as to not reveal they do in fact retain customer data.
They had a plausible excuse as well -- the owner had no subscription so they don't store the data -- and took a gamble that this explanation would suffice until the situation resolved itself.
I suspect that authorities initially took Google's excuse at face value, since they parroted this explanation to the public as well.
As pressure mounted on authorities to make some headway on the case, they likely formally exercised whatever legal mechanisms they have at their disposal to force Google's hand, and only then was the footage released.
This is a wild claim. I would think criminal charges for something like obstruction would be possible if Google intentionally hid this from investigators for up to a week. That could result in the difference between the victim being found alive or not.
Why are we overthinking this? It was disconnected by the kidnapper, not erased by him. All the FBI has to do is reconnect it (or even just find the MAC address) and wait for Google to provide them the footage via a request.
I heard that Nancy Guthrie was not paying for the subscription that let her view her old video footage. So it's interesting that Google was still storing all that footage.
I don't have a Nest but I suspect it's even simpler than that. She didn't have a subscription but the devices still store video locally up to the capacity of onboard storage. These recent local clips used to all be locally accessible but to "increase subscription value", Google started making that locally stored data inaccessible without subscription.
However, the local storage is just a rolling buffer and the clips beyond the last 10 seconds are still there in local RAM and either not shown in the interface or deleted in the file system (but just by blanking the name in the directory, not a secure overwrite erase). Either the FBI forensic data recovery people or Google/Nest finally ran a sector-by-sector file recovery. I'm just surprised it took so long. I assume maybe because the local storage on those doorbells isn't a removable SD card so they had to gain access some other way.
Frankly, I'm surprised how many people buy devices which are cloud-only. At this point, I generally won't consider any IOT devices if the manufacturer even offers an optional cloud subscription (unless the firmware is open source). Too many companies have now locked down previously open devices to force cloud subscription (looking at you Chamberlain/LiftMaster assholes).
EDIT TO ADD: Saw this Verge article by someone who bothered to find out how current Nest doorbells work. It basically confirms what I thought with the nuance that some local files actually get uploaded to the cloud even without a subscription but aren't accessible until the user pays. https://www.theverge.com/tech/877235/nancy-guthrie-google-ne...
The article even says "[...] some Nest devices record event histories and store them on-device. The third-gen wired Nest Doorbell can save up to 10 seconds of clips, while the first and second-gen wired doorbells can save up to three hours of event history, all without a subscription.".
> Should you get rid of your Nest camera over privacy concerns?
Absolutely, and you shouldn't have bought and installed this garbage in the first place. Their primary purpose is not to protect you but to spy on you for Google's benefit, much like the rest of their dis-services (email, cloud storage, mobile operating systems).
If you absolutely need surveillance cameras for your safety, use generic IP cameras connected to your own NVR (network video recorder), possibly with Frigate for offline AI processing and notifications. Nothing should ever leave your network; the data should be encrypted and only shared with the police when it is in your interest.
The problem is that your advice doesn't work for 99% of the customer base. Go the average person "if you absolutely need surveillance cameras for your safety, use generic IP cameras connected to your own NVR (network video recorder), possibly with Frigate for offline AI processing and notifications." and see what they say. It's important to remember if you are on this site you are an extreme minority and the average person isn't even aware enough to think about these things, let alone set up their own offline AI video processor.
I have that sort of arrangement. I've been wondering though. What's the proper data access protocol? Like I want it available, easily, if the police need it and I'm not there but at the same time, I don't want anyone to just screw around with it because I've got directions and password printed on paper somewhere.
We did have some repeated night time visitors (long story, but it was some mistaken identity that took a while to sleuth out) it wasn't difficult to export data for the police but it wasn't something I'd just ask my wife or kids to do either. Scan the footage, find the timestamps, export the data then upload the data somewhere where they can get at it. It wasn't hard but it was chores and it took time with high emotions.
First off, it's not inexpensive. It's not a giant investment either but my cameras cost in the same range as the Nest cameras do and then there is a relatively powerful mini pc, and an accelerator for AI detection and then drives to store the data, PoE switch, network segmentation... I'm rocking home assistant and frigate and 8 8k cameras. Then the much more subtle part is I have a pretty good idea when I'd like the police to have all the data and when I don't want that. That's not so easy if I was abducted. Perhaps an off the shelf complete solution is better and has that sort of law enforcement access situation sorted out. This is sort of the 0.000001% kind of thing though. Over the years, I've replaced drives a couple times too, it's becomes a living and breathing system that needs support and love.
>Their primary purpose is not to protect you but to spy on you for Google's benefit, much like the rest of their dis-services (email, cloud storage, mobile operating systems).
I know! i’d sure hate for Google and the police to be able to identify someone who has kidnapped and/or perhaps murdered me. I’ll be uninstalling all my cameras
immediately. Whose with me? /s
(Notwithstanding: My cameras thermostats etc all go through a wrt3200 router logged into expressvpn on a dedicated ssid/vlan . Amazon and Google pissed me off purchasing Ring and Nest (respectively) so they can plug that into their advertising bullshit and that was my reaction to both of those companies… they get iot devices connecting from some vultr VPS or whatever, and the other way they get you is with all the crap and trackers in their smartphone apps — at least according to Exodus Project - so THATS on a burner android piped through the same SSID too.)
Granted some of that’s by necessity because half the apps for this kind of crap aren’t available in the Mexico iTunes Store but I’ll just shut up now.
> Their primary purpose is not to protect you but to spy on you
Here I was thinking the primary purpose was to see who's at the door and check if Doordash and packages have been delivered. We've also used them to "spy" on our cats to be sure they're using the litter box while on vacation, and even to "spy" on wildlife in our backyard.
Not everything needs to be a conspiracy. These devices are useful and practical and have value.
Also, lest it get lost in the chorus of voices telling us to throw these things out: the actual news here is that the device appears to have provided an actual evidentiary lead in the investigation of an actual (and horrifying) crime. That has value too, even if kidnappings are rare.
Most of these cloud connected cameras always stream footage through their cloud service, regardless of whether you pay for a subscription. Because people don't know how to configure port forwarding, etc, in their firewall.
They're not architecturally delivering the video a different way if you pay than if you don't. They're just changing the retention period.
This video was probably recovered from cache somewhere.
There was an article the other day called something like "How is Google helping the investigation?"
It said she didn't have a cloud subscription, but that there are data pipelines that make these sort of devices work. (Imagine there's a thumbnail of the video in the product somewhere, so there's a pipeline that takes a video stream and generates thumbnails.)
According to the article, it was a matter of having someone figure out which pipelines her videos might have touched, and then go looking to see if there were any ephemeral artifacts that hadn't been lost yet.
> Most of these cloud connected cameras always stream footage through their cloud service, regardless of whether you pay for a subscription. Because people don't know how to configure port forwarding, etc, in their firewall.
No consumer product should have users do port-forwarding or punch holes in the firewall. You don't want an IoT device on your network accepting packets from the internet.
The proper way to do this is with a cloud server arbitrating connections, which is what a lot of products do.
The reason most consumers want cloud storage isn't for ease of access, though. It's because they want the footage stored securely somewhere. If the thief can just pick up your camera and walk away with the evidence, it's not very useful to you.
This reminds me of when people were surprised that Alexa devices listen all the time. Yes, cloud connected device is uploading data to the cloud. That is not very scandalous or interesting. The FBI didn't burn zero days to do this, they simply asked Google for it.
I suspect that it really might have been 'buried deep'. If you are capturing the data short term, to allow a small scroll back, then you wrote the data to some storage system. At three hours or whatever the short term storage limit is, you delete the file. Usually deleting a file leaves the data intact on the storage device. Only the file entry and a list of what low level storage blocks actually contained data. It could take awhile before the data is actually overwritten. Up until the point it is, you could scan the contents of unallocated blocks looking for the data. It could theoretically take awhile to find a customer id or something else that helps you identify the deleted data.
Don't they have a battery backup and a local buffer before uploading?
It probably had its last footage still stored locally, using the remnants of power in its internal battery.
The video was likely recovered from local flash memory on the camera itself. These kinds of devices are not uploading raw video to the cloud.
There are several reasons for that. The first is that you cannot rely on connectivity 100% of the time. Second, if you can have the camera run image processing and compression locally, you don't have to dedicate a massive amount of processing resources at the data center to run the processing. Imagine ten or a hundred million cameras. Where would you want the image processing to run? Right.
My guess is that they either went to Google to perhaps connect the camera to a sandboxed testing rig that could extract locally-stored video data or they removed the flash device, offloaded the raw data and then extracted video from that data. This last option could also have the advantage of having less compression (architecture dependent).
Decades ago I was personally involved in recovering and helping analyze surveillance video data for the prosecution in the OJ Simpson case. Back then, it was tape.
One of the techniques that was considered (I can't publicly state what was actually done) was to digitize raw data right off the read heads on the VCR's spinning drum. You could then process this data using advanced algorithms which could produce better results than the electronics in even the most expensive professional tape players of he era.
Once you step away from the limitations of a product --meaning, you are not engineering a product, you are mining for information-- all kinds of interesting and creative out-of-the-box opportunities present themselves.
I'm fairly certain that Nest cameras do not allow streaming over your local network.
You can still use the cameras even without a subscription, i.e. watch the live stream or get notifications. This means that yes, they are absolutely uploading data to the cloud and storing it for some undetermined window. Paying for a subscription seems to just give you access to that history.
When the Nest camera was reconnected, the camera uploaded all the cached footage. Google then handed the footage to the FBI, no warrants needed as it's part of an ongoing case and Google is usually pretty friendly with the government (and vice ver-sa)
I'm not familiar with Nest, if you don't have a subscription to store video, and someone rings your doorbell, and you take 5 seconds to bring it up in the app, can you scroll back and see those 5 seconds? Or is it literally a feed from the camera to the app over bluetooth? Probably not. The video stream probably gets sent to some backend system and, while she didn't pay for storage, it probably persists for a few hours to days in cache.
Not set to save recordings likely means "saved in a memory buffer and never given a file handle", that is how most consumer recording devices that offer limited playback work.
I recently had to attempt to piece together dash cam footage from my wife's car in the same way when she witnessed an accident but the file had been "aged out".
Surely their storage backend is not a Linux box with EXT4 but something akin to Google Spanner so there data recovery would possible days later if they looked very hard enough ?.
is it not possible to have these doorcams blur or obscure parts of the video that is beyond certain distance from the camera? It would great if that was made a requirement for them.
ansk|19 days ago
My hunch is that Google initially tried to play dumb to avoid compliance, as to not reveal they do in fact retain customer data. They had a plausible excuse as well -- the owner had no subscription so they don't store the data -- and took a gamble that this explanation would suffice until the situation resolved itself. I suspect that authorities initially took Google's excuse at face value, since they parroted this explanation to the public as well. As pressure mounted on authorities to make some headway on the case, they likely formally exercised whatever legal mechanisms they have at their disposal to force Google's hand, and only then was the footage released.
reverius42|19 days ago
aaron695|19 days ago
[deleted]
1970-01-01|19 days ago
https://policies.google.com/terms/information-requests?hl=en...
eigencoder|19 days ago
mrandish|19 days ago
However, the local storage is just a rolling buffer and the clips beyond the last 10 seconds are still there in local RAM and either not shown in the interface or deleted in the file system (but just by blanking the name in the directory, not a secure overwrite erase). Either the FBI forensic data recovery people or Google/Nest finally ran a sector-by-sector file recovery. I'm just surprised it took so long. I assume maybe because the local storage on those doorbells isn't a removable SD card so they had to gain access some other way.
Frankly, I'm surprised how many people buy devices which are cloud-only. At this point, I generally won't consider any IOT devices if the manufacturer even offers an optional cloud subscription (unless the firmware is open source). Too many companies have now locked down previously open devices to force cloud subscription (looking at you Chamberlain/LiftMaster assholes).
EDIT TO ADD: Saw this Verge article by someone who bothered to find out how current Nest doorbells work. It basically confirms what I thought with the nuance that some local files actually get uploaded to the cloud even without a subscription but aren't accessible until the user pays. https://www.theverge.com/tech/877235/nancy-guthrie-google-ne...
krisbolton|19 days ago
drnick1|19 days ago
Absolutely, and you shouldn't have bought and installed this garbage in the first place. Their primary purpose is not to protect you but to spy on you for Google's benefit, much like the rest of their dis-services (email, cloud storage, mobile operating systems).
If you absolutely need surveillance cameras for your safety, use generic IP cameras connected to your own NVR (network video recorder), possibly with Frigate for offline AI processing and notifications. Nothing should ever leave your network; the data should be encrypted and only shared with the police when it is in your interest.
thinkingtoilet|19 days ago
TheCondor|19 days ago
We did have some repeated night time visitors (long story, but it was some mistaken identity that took a while to sleuth out) it wasn't difficult to export data for the police but it wasn't something I'd just ask my wife or kids to do either. Scan the footage, find the timestamps, export the data then upload the data somewhere where they can get at it. It wasn't hard but it was chores and it took time with high emotions.
First off, it's not inexpensive. It's not a giant investment either but my cameras cost in the same range as the Nest cameras do and then there is a relatively powerful mini pc, and an accelerator for AI detection and then drives to store the data, PoE switch, network segmentation... I'm rocking home assistant and frigate and 8 8k cameras. Then the much more subtle part is I have a pretty good idea when I'd like the police to have all the data and when I don't want that. That's not so easy if I was abducted. Perhaps an off the shelf complete solution is better and has that sort of law enforcement access situation sorted out. This is sort of the 0.000001% kind of thing though. Over the years, I've replaced drives a couple times too, it's becomes a living and breathing system that needs support and love.
NeutralWanted|19 days ago
[deleted]
razingeden|19 days ago
I know! i’d sure hate for Google and the police to be able to identify someone who has kidnapped and/or perhaps murdered me. I’ll be uninstalling all my cameras immediately. Whose with me? /s
(Notwithstanding: My cameras thermostats etc all go through a wrt3200 router logged into expressvpn on a dedicated ssid/vlan . Amazon and Google pissed me off purchasing Ring and Nest (respectively) so they can plug that into their advertising bullshit and that was my reaction to both of those companies… they get iot devices connecting from some vultr VPS or whatever, and the other way they get you is with all the crap and trackers in their smartphone apps — at least according to Exodus Project - so THATS on a burner android piped through the same SSID too.)
Granted some of that’s by necessity because half the apps for this kind of crap aren’t available in the Mexico iTunes Store but I’ll just shut up now.
ajross|19 days ago
Here I was thinking the primary purpose was to see who's at the door and check if Doordash and packages have been delivered. We've also used them to "spy" on our cats to be sure they're using the litter box while on vacation, and even to "spy" on wildlife in our backyard.
Not everything needs to be a conspiracy. These devices are useful and practical and have value.
Also, lest it get lost in the chorus of voices telling us to throw these things out: the actual news here is that the device appears to have provided an actual evidentiary lead in the investigation of an actual (and horrifying) crime. That has value too, even if kidnappings are rare.
kube-system|19 days ago
They're not architecturally delivering the video a different way if you pay than if you don't. They're just changing the retention period.
This video was probably recovered from cache somewhere.
bsimpson|19 days ago
It said she didn't have a cloud subscription, but that there are data pipelines that make these sort of devices work. (Imagine there's a thumbnail of the video in the product somewhere, so there's a pipeline that takes a video stream and generates thumbnails.)
According to the article, it was a matter of having someone figure out which pipelines her videos might have touched, and then go looking to see if there were any ephemeral artifacts that hadn't been lost yet.
Aurornis|19 days ago
No consumer product should have users do port-forwarding or punch holes in the firewall. You don't want an IoT device on your network accepting packets from the internet.
The proper way to do this is with a cloud server arbitrating connections, which is what a lot of products do.
The reason most consumers want cloud storage isn't for ease of access, though. It's because they want the footage stored securely somewhere. If the thief can just pick up your camera and walk away with the evidence, it's not very useful to you.
RobotToaster|19 days ago
Aurornis|19 days ago
This fact is explained right in the Google support page linked by this article
> *The 3 hours of event video previews is available without a Google Home Premium subscription for the Nest Cam (battery) and Nest Doorbell (battery).
All of these articles trying to spin this as some surprise revelation are getting old.
ajam1507|19 days ago
1970-01-01|19 days ago
hypeatei|19 days ago
Aurornis|19 days ago
Alexa devices are not recording audio and uploading it all to the cloud all the time.
Nest cameras are designed to upload recordings to the cloud, even without subscription. It's literally one of the selling points.
whycome|19 days ago
Replay available on YouTube. CBC the national.
zdp7|19 days ago
1970-01-01|19 days ago
natas|19 days ago
doophus|19 days ago
JoblessWonder|19 days ago
robomartin|19 days ago
There are several reasons for that. The first is that you cannot rely on connectivity 100% of the time. Second, if you can have the camera run image processing and compression locally, you don't have to dedicate a massive amount of processing resources at the data center to run the processing. Imagine ten or a hundred million cameras. Where would you want the image processing to run? Right.
My guess is that they either went to Google to perhaps connect the camera to a sandboxed testing rig that could extract locally-stored video data or they removed the flash device, offloaded the raw data and then extracted video from that data. This last option could also have the advantage of having less compression (architecture dependent).
Decades ago I was personally involved in recovering and helping analyze surveillance video data for the prosecution in the OJ Simpson case. Back then, it was tape.
One of the techniques that was considered (I can't publicly state what was actually done) was to digitize raw data right off the read heads on the VCR's spinning drum. You could then process this data using advanced algorithms which could produce better results than the electronics in even the most expensive professional tape players of he era.
Once you step away from the limitations of a product --meaning, you are not engineering a product, you are mining for information-- all kinds of interesting and creative out-of-the-box opportunities present themselves.
jrsdav|19 days ago
You can still use the cameras even without a subscription, i.e. watch the live stream or get notifications. This means that yes, they are absolutely uploading data to the cloud and storing it for some undetermined window. Paying for a subscription seems to just give you access to that history.
natas|19 days ago
sandworm101|19 days ago
Thats a rather chilling interpretation of the law. Every case is ongoing until trial.
daft_pink|19 days ago
phendrenad2|19 days ago
devmor|19 days ago
I recently had to attempt to piece together dash cam footage from my wife's car in the same way when she witnessed an accident but the file had been "aged out".
tibbydudeza|19 days ago
taimoorhassan|19 days ago
Unfortunately, we don't have a definitive answer at this time, even if the theory is sound
notepad0x90|19 days ago
RupertSalt|19 days ago
Nancy Guthrie was apprehended by ICE agents and deported to Australia.
Irishman at Sydney airport: “Greetings, here is my passport and visa”Customs agent: “G‘day sir. Have you got a criminal record?”
Irishman: “M‘Lord, no! I didn’t realise that one was still required!”