A $10K Bounty Awaits Anyone Who Can Hack Ring Cameras to Stop Sharing Data With Amazon

Ring faces bounty for data control hack

Amazon-owned security company Ring is now the target of a $10,000 bounty from a nonprofit group, which is paying hackers to find a way to stop Ring cameras from sending user data to Amazon's servers. The bounty, offered by The Fulu Foundation, comes after widespread backlash to a Ring Super Bowl ad for a lost-pet-finding feature called Search Party, which critics labeled a neighborhood surveillance dragnet.

The Fulu Foundation was founded by repair advocate Louis Rossmann and pays bounties to remove user-hostile features from connected devices. Co-founder Kevin O'Reilly says the public reaction to the ad created a moment for people to reclaim control. "People who install security cameras are looking for more security, not less," O'Reilly says. "If we don't control our data, we don't control our devices."

Bounty requirements for Ring hackers

The bounty aims to create a modification that lets Ring doorbells function locally without phoning home to Amazon. The winner must prove their hack meets a specific set of requirements designed to preserve the hardware's usefulness while severing its cloud dependence.

• The modified device must work with a local PC or server.
• It must halt data sent to Amazon servers and not require connection to other Amazon hardware.
• On-device features like motion detection and color night vision must remain functional.
• The process must use inexpensive tools and take a "moderately technical user" less than an hour.

"This needs to be a weekend project," O'Reilly says, where someone "can take care of it, get it done, and be able to sleep soundly at night knowing that they're the only ones who can see their footage." The first person to accomplish and prove this wins the money.

Legal risks and growing reward

The cash reward starts at $10,000 but had already grown to nearly $11,000 at the time of publication, with donors able to contribute more. Fulu will also match donations for the winner with up to an additional $10,000.

Critically, winners are not required to publicly release their method. Doing so could open them to legal action under Section 1201 of the Digital Millennium Copyright Act (DMCA), which prohibits circumventing digital locks. The recipient can choose to keep their work private to avoid legal risk.

"In a perfect world, we'd find somebody who could solve this problem," O'Reilly says. "We'd make it available to Ring owners around the country. But because of Section 1201 and its frankly antiquated and outdated policies, people aren't going to be able to do that."

Ring's ongoing privacy controversies

O'Reilly says Fulu had long prioritized Ring for a bounty due to its history of privacy controversies around data collection and the rights of people recorded by its cameras. The company has tried to soften its image with community-focused features, like finding lost pets or partnering with wildfire tracker Watch Duty.

However, these efforts have not quelled the "panopticon discourse." The intense reaction to the Super Bowl ad prompted Fulu to move the Ring bounty to the top of its list. Following the ad's backlash, Ring also immediately canceled a partnership with the controversial AI surveillance company Flock, and CEO Jamie Siminoff has been on a public apology tour.

O'Reilly emphasizes that the goal is to fix the software, not force people to destroy hardware they still find useful. "Control shouldn't require a trade-off of all of the features that you like," he says. "You shouldn't have to sacrifice the smart capabilities of your device if you don't want to."