[HN Gopher] How Did the FBI Get Nancy Guthrie's Nest Doorbell Fo...
___________________________________________________________________
How Did the FBI Get Nancy Guthrie's Nest Doorbell Footage?
Author : daft_pink
Score : 93 points
Date : 2026-02-11 18:48 UTC (4 hours ago)
(HTM) web link (lifehacker.com)
(TXT) w3m dump (lifehacker.com)
| daft_pink wrote:
| The Nest doorbell wasn't set to save recordings, so how did the
| FBI get it?
| phendrenad2 wrote:
| I'm not familiar with Nest, if you don't have a subscription to
| store video, and someone rings your doorbell, and you take 5
| seconds to bring it up in the app, can you scroll back and see
| those 5 seconds? Or is it literally a feed from the camera to
| the app over bluetooth? Probably not. The video stream probably
| gets sent to some backend system and, while she didn't pay for
| storage, it probably persists for a few hours to days in cache.
| devmor wrote:
| Not set to save recordings likely means "saved in a memory
| buffer and never given a file handle", that is how most
| consumer recording devices that offer limited playback work.
|
| I recently had to attempt to piece together dash cam footage
| from my wife's car in the same way when she witnessed an
| accident but the file had been "aged out".
| doophus wrote:
| Don't they have a battery backup and a local buffer before
| uploading? It probably had its last footage still stored locally,
| using the remnants of power in its internal battery.
| JoblessWonder wrote:
| She apparently didn't have a subscription so it shouldn't have
| been uploading anywhere... however things get murky with
| notification settings.
| burnte wrote:
| Normally we would expect no subscription means no video
| uploaded, but it doesn't HAVE to mean that. IF you distill
| it, it really only means the Ring doorbell owner doesn't get
| access to any video or features without paying.
|
| There's no reason they, however, won't still derive value
| from it without a subscription by recording and reselling
| that data somehow. That's probably how they got this footage.
| All the subscription does it help subsidize their
| surveillance network and let you use it a little bit.
| esalman wrote:
| I guess I don't have to renew my Ring subscription then. If
| things go awry I can just ask FBI to ask Amazon for the
| footage.
| stackskipton wrote:
| Sure, if whatever case you need Ring camera footage for
| is important enough to get FBI involved.
| pimlottc wrote:
| Distill it?
| ezekiel68 wrote:
| Eh, it's not a terrible usage. I give it 7/10 for
| artistic license.
| kube-system wrote:
| It's a pretty darn normal usage:
|
| https://www.merriam-webster.com/sentences/distill
| burnte wrote:
| I'll take a 7 out of 10.
| wrelsien wrote:
| Even if it isn't uploading, the hardware must have local
| storage. It may be small and persistently overwritten, but if
| the power was severed, then the last data on that drive would
| be the last thing written before the power was cut.
| esseph wrote:
| The hardware was uploading even without a subscription.
|
| A lot of these cameras don't store anything locally unless
| you add an SD card, which die all the time.
| kakacik wrote:
| Or... yet another full-on spying device. Like all phones,
| like all modern TVs, smart speakers/home systems, cars,
| anything electronic capable of recording its environment is
| doing it, for the sole purpose of uploading it to be stored
| and analyzed.
|
| There are some limits of course but they are mostly
| technological, but this ain't some notification trickle but
| full pictures when you expect zero, zilch, nothing.
|
| I'd never install such device at home, added value is dubious
| at best for my family life and this is _exactly_ the type of
| shit I would expect to be happening in it, regardless of
| brand or country of origin. If it connects it sends. Its sad
| state of things in 2026 but thats reality right now.
| the_snooze wrote:
| >If it connects it sends.
|
| More broadly, if it connects, it will serve other masters
| besides you.
| 4d4m wrote:
| Short, sweet, true.
| nickthegreek wrote:
| I thought they just give you reduced storage on the free
| tier? If so, then its obvious that it is still uploading
| motion related events.
| JoblessWonder wrote:
| If it was still uploading events then why did it take so
| long to recover?
| Rebelgecko wrote:
| The camera was supposedly disconnected fwiw
| Aurornis wrote:
| > She apparently didn't have a subscription so it shouldn't
| have been uploading anywhere..
|
| Nest cameras upload event footage even without a
| subscription.
|
| It's not a secret. It's a selling point for the devices.
| whycome wrote:
| The CBC report yesterday on tv mentioned the awkward phrase the
| it was recovered "buried deep in servers" and I thought it was
| bizarre.
|
| Replay available on YouTube. CBC the national.
| 1970-01-01 wrote:
| This is correct. It has to be buried below the frost line else
| we would have frozen footage.
| RaftPeople wrote:
| The guy did seem to be wearing a warm coat and gloves so
| obviously pretty cold where the video was, probably just
| below the frost line.
| natas wrote:
| They ultimately found it sandwiched between the videos of
| epstein uncut jail cell footage and Jan 6's lost video
| exhibits.
| zdp7 wrote:
| I suspect that it really might have been 'buried deep'. If you
| are capturing the data short term, to allow a small scroll
| back, then you wrote the data to some storage system. At three
| hours or whatever the short term storage limit is, you delete
| the file. Usually deleting a file leaves the data intact on the
| storage device. Only the file entry and a list of what low
| level storage blocks actually contained data. It could take
| awhile before the data is actually overwritten. Up until the
| point it is, you could scan the contents of unallocated blocks
| looking for the data. It could theoretically take awhile to
| find a customer id or something else that helps you identify
| the deleted data.
| 1970-01-01 wrote:
| Why are we overthinking this? It was disconnected by the
| kidnapper, not erased by him. All the FBI has to do is reconnect
| it (or even just find the MAC address) and wait for Google to
| provide them the footage via a request.
|
| https://policies.google.com/terms/information-requests?hl=en...
| eigencoder wrote:
| I heard that Nancy Guthrie was not paying for the subscription
| that let her view her old video footage. So it's interesting
| that Google was still storing all that footage.
| sandworm101 wrote:
| The google/ring backbone service people are likely
| disconnected from google's money collecting people. It is
| probably just easier to collect all of it and then check for
| payments only when users login to get at the footage.
| Otherwise, every fetch of footage from a camera would trigger
| a query to the payment system.
| chinathrow wrote:
| If I don't pay, they should not store footage. What is so
| difficult about that?
| patmorgan23 wrote:
| If you don't want them to store footage, don't buy a
| cloud connected camera
| yndoendo wrote:
| With Google, you are the product. Those that pay for
| their services just add more to their bank account. There
| is a reason they removed _Don't be Evil_. Decouple and
| move on from them is the only thing you can do.
| krisbolton wrote:
| The article even says "[...] some Nest devices record event
| histories and store them on-device. The third-gen wired Nest
| Doorbell can save up to 10 seconds of clips, while the first
| and second-gen wired doorbells can save up to three hours of
| event history, all without a subscription.".
| mrandish wrote:
| I don't have a Nest but I suspect it's even simpler than that.
| She didn't have a subscription but the devices still store
| video locally up to the capacity of onboard storage. These
| recent local clips used to all be user accessible but to
| "increase subscription value", Google started making that
| locally stored data inaccessible to users except for the last
| 10 seconds of video.
|
| However, it's a rolling buffer and the clips beyond the last 10
| seconds are still there in local RAM and either not shown in
| the interface or deleted in the file system (but just by
| blanking the name in the directory, not a secure overwrite
| erase). Either the FBI forensic data recovery people or
| Google/Nest finally ran a sector-by-sector file recovery. I'm
| just surprised it took so long. I assume maybe because the
| local storage on those doorbells isn't a removable SD card so
| they had to gain access some other way.
|
| Frankly, I'm surprised how many people buy devices which are
| cloud-only. At this point, I generally won't consider any IOT
| devices if the manufacturer even offers an optional cloud
| subscription (unless the firmware is open source). Too many
| companies have now locked down previously open devices to force
| cloud subscription (looking at you Chamberlain/LiftMaster
| assholes).
| jrsdav wrote:
| I'm fairly certain that Nest cameras do not allow streaming over
| your local network.
|
| You can still use the cameras even without a subscription, i.e.
| watch the live stream or get notifications. This means that yes,
| they are absolutely uploading data to the cloud and storing it
| for some undetermined window. Paying for a subscription seems to
| just give you access to that history.
| kube-system wrote:
| Most of these cloud connected cameras always stream footage
| through their cloud service, regardless of whether you pay for a
| subscription. Because people don't know how to configure port
| forwarding, etc, in their firewall.
|
| They're not architecturally delivering the video a different way
| if you pay than if you don't. They're just changing the retention
| period.
|
| This video was probably recovered from cache somewhere.
| RobotToaster wrote:
| Some (ironically the cheap Chinese ones) use UDP hole punching
| for a P2P connection. Assumedly because it saves server costs.
| bsimpson wrote:
| There was an article the other day called something like "How
| is Google helping the investigation?"
|
| It said she didn't have a cloud subscription, but that there
| are data pipelines that make these sort of devices work.
| (Imagine there's a thumbnail of the video in the product
| somewhere, so there's a pipeline that takes a video stream and
| generates thumbnails.)
|
| According to the article, it was a matter of having someone
| figure out which pipelines her videos might have touched, and
| then go looking to see if there were any ephemeral artifacts
| that hadn't been lost yet.
| xnobodyx wrote:
| saw this cnn article that discusses a similar theory. it was
| unclear to me whether the source of the article is purely
| speculation.
|
| https://www.cnn.com/2026/02/10/tech/google-video-nancy-
| guthr... and archived at https://archive.ph/oZyRM
| ansk wrote:
| The guy writing a thumbnail pipeline isn't getting petabytes
| (exabytes?) of storage to cache all videos from the past week
| in their entirety. If this quantity of data is being stored,
| it's being stored deliberately and at significant cost.
| Aurornis wrote:
| > Most of these cloud connected cameras always stream footage
| through their cloud service, regardless of whether you pay for
| a subscription. Because people don't know how to configure port
| forwarding, etc, in their firewall.
|
| No consumer product should have users do port-forwarding or
| punch holes in the firewall. You don't want an IoT device on
| your network accepting packets from the internet.
|
| The proper way to do this is with a cloud server arbitrating
| connections, which is what a lot of products do.
|
| The reason most consumers want cloud storage isn't for ease of
| access, though. It's because they want the footage stored
| securely somewhere. If the thief can just pick up your camera
| and walk away with the evidence, it's not very useful to you.
| hypeatei wrote:
| This reminds me of when people were surprised that Alexa devices
| listen all the time. Yes, cloud connected device is uploading
| data to the cloud. That is not very scandalous or interesting.
| The FBI didn't burn zero days to do this, they simply asked
| Google for it.
| Aurornis wrote:
| > This reminds me of when people were surprised that Alexa
| devices listen all the time
|
| Alexa devices are not recording audio and uploading it all to
| the cloud all the time.
|
| Nest cameras are designed to upload recordings to the cloud,
| even without subscription. It's literally one of the selling
| points.
| Aurornis wrote:
| Nest cameras upload video clips to the cloud without an active
| subscription.
|
| This fact is explained right in the Google support page linked by
| this article
|
| > *The 3 hours of event video previews is available without a
| Google Home Premium subscription for the Nest Cam (battery) and
| Nest Doorbell (battery).
|
| All of these articles trying to spin this as some surprise
| revelation are getting old.
| 1970-01-01 wrote:
| Because online journalism is journalism jr. and they can't be
| bothered to do basic research on their story.
| fusslo wrote:
| anecdotally i've had this conversation with 3 people
| (engineers) at my work today.
|
| They all thought it was crazy that without a subscription
| they're recording and uploading video.
|
| One person asked 'Why are we paying for a subscription if
| it's not for the storage and processing?'
|
| Another started talking about flock and ice right after.
| drnick1 wrote:
| > Should you get rid of your Nest camera over privacy concerns?
|
| Absolutely, and you shouldn't have bought and installed this
| garbage in the first place. Their primary purpose is not to
| protect you but to spy on you for Google's benefit, much like the
| rest of their dis-services (email, cloud storage, mobile
| operating systems).
|
| If you absolutely need surveillance cameras for your safety, use
| generic IP cameras connected to your own NVR (network video
| recorder), possibly with Frigate for offline AI processing and
| notifications. Nothing should ever leave your network; the data
| should be encrypted and only shared with the police when it is in
| your interest.
| thinkingtoilet wrote:
| The problem is that your advice doesn't work for 99% of the
| customer base. Go the average person "if you absolutely need
| surveillance cameras for your safety, use generic IP cameras
| connected to your own NVR (network video recorder), possibly
| with Frigate for offline AI processing and notifications." and
| see what they say. It's important to remember if you are on
| this site you are an _extreme_ minority and the average person
| isn 't even aware enough to think about these things, let alone
| set up their own offline AI video processor.
| drnick1 wrote:
| Fair point, but security cameras, despite their name, do very
| little for your security as evidenced by the news. Most
| people don't need one, and only have Rings/Nests and other
| similar spyware because of a combination of fearmongering,
| aggressive marketing, and pricing subsidized by data
| collection (spyware). If you truly fear for your safety, you
| should purchase a shotgun, not a Nest camera.
|
| In any case, when you don't have the skills required to do
| something, you can hire someone who does. I pay a plumber
| because I don't have plumbing skills and tools, so it's not
| unreasonable to pay someone to set up a local camera system
| for you if you want one.
| kenjackson wrote:
| Cameras do more than just that kind of security.
|
| Our camera has been of great use. In fact has largely made
| us money. We had an incident where a fire truck damaged our
| car in the street with its hose. We thought a kid with a
| bat did the damage at first. The camera though showed the
| real culprit. When we told the fire department they denied
| it and said there were no firetrucks in the area. We sent
| the video footage and then they sent a city lawyer with a
| checkbook.
| ajross wrote:
| > Their primary purpose is not to protect you but to spy on you
|
| Here I was thinking the primary purpose was to see who's at the
| door and check if Doordash and packages have been delivered.
| We've also used them to "spy" on our cats to be sure they're
| using the litter box while on vacation, and even to "spy" on
| wildlife in our backyard.
|
| Not everything needs to be a conspiracy. These devices are
| useful and practical and have value.
|
| Also, lest it get lost in the chorus of voices telling us to
| throw these things out: the actual news here is that the device
| appears to have provided an actual evidentiary lead in the
| investigation of an actual (and horrifying) crime. That has
| value too, even if kidnappings are rare.
| TheCondor wrote:
| I have that sort of arrangement. I've been wondering though.
| What's the proper data access protocol? Like I want it
| available, easily, if the police need it and I'm not there but
| at the same time, I don't want anyone to just screw around with
| it because I've got directions and password printed on paper
| somewhere.
|
| We did have some repeated night time visitors (long story, but
| it was some mistaken identity that took a while to sleuth out)
| it wasn't difficult to export data for the police but it wasn't
| something I'd just ask my wife or kids to do either. Scan the
| footage, find the timestamps, export the data then upload the
| data somewhere where they can get at it. It wasn't hard but it
| was chores and it took time with high emotions.
|
| First off, it's not inexpensive. It's not a giant investment
| either but my cameras cost in the same range as the Nest
| cameras do and then there is a relatively powerful mini pc, and
| an accelerator for AI detection and then drives to store the
| data, PoE switch, network segmentation... I'm rocking home
| assistant and frigate and 8 8k cameras. Then the much more
| subtle part is I have a pretty good idea when I'd like the
| police to have all the data and when I don't want that. That's
| not so easy if I was abducted. Perhaps an off the shelf
| complete solution is better and has that sort of law
| enforcement access situation sorted out. This is sort of the
| 0.000001% kind of thing though. Over the years, I've replaced
| drives a couple times too, it's becomes a living and breathing
| system that needs support and love.
| razingeden wrote:
| >Their primary purpose is not to protect you but to spy on you
| for Google's benefit, much like the rest of their dis-services
| (email, cloud storage, mobile operating systems).
|
| I know! i'd sure hate for Google and the police to be able to
| identify someone who has kidnapped and/or perhaps murdered me.
| I'll be uninstalling all my cameras immediately. Whose with me?
| /s
|
| (Notwithstanding: My cameras thermostats etc all go through a
| wrt3200 router logged into expressvpn on a dedicated ssid/vlan
| . Amazon and Google pissed me off purchasing Ring and Nest
| (respectively) so they can plug that into their advertising
| bullshit and that was _my_ reaction to both of those
| companies... they get iot devices connecting from some vultr
| VPS or whatever, and the other way they get you is with all the
| crap and trackers in their smartphone apps -- at least
| according to Exodus Project - so THATS on a burner android
| piped through the same SSID too.)
|
| Granted some of that's by necessity because half the apps for
| this kind of crap aren't available in the Mexico iTunes Store
| but I'll just shut up now.
| ansk wrote:
| The other explanations here don't explain the long delay between
| the start of the investigation and the release of the footage.
| Yes, storing customer data is what we'd expect from Google and
| yes, the FBI can coerce Google to provide this data for their
| investigations. But it does not take a week for Google to find a
| file on their servers.
|
| My hunch is that Google initially tried to play dumb to avoid
| compliance, as to not reveal they do in fact retain customer
| data. They had a plausible excuse as well -- the owner had no
| subscription so they don't store the data -- and took a gamble
| that this explanation would suffice until the situation resolved
| itself. I suspect that authorities initially took Google's excuse
| at face value, since they parroted this explanation to the public
| as well. As pressure mounted on authorities to make some headway
| on the case, they likely formally exercised whatever legal
| mechanisms they have at their disposal to force Google's hand,
| and only then was the footage released.
| robomartin wrote:
| The video was likely recovered from local flash memory on the
| camera itself. These kinds of devices are not uploading raw video
| to the cloud.
|
| There are several reasons for that. The first is that you cannot
| rely on connectivity 100% of the time. Second, if you can have
| the camera run image processing and compression locally, you
| don't have to dedicate a massive amount of processing resources
| at the data center to run the processing. Imagine ten or a
| hundred million cameras. Where would you want the image
| processing to run? Right.
|
| My guess is that they either went to Google to perhaps connect
| the camera to a sandboxed testing rig that could extract locally-
| stored video data or they removed the flash device, offloaded the
| raw data and then extracted video from that data. This last
| option could also have the advantage of having less compression
| (architecture dependent).
|
| Decades ago I was personally involved in recovering and helping
| analyze surveillance video data for the prosecution in the OJ
| Simpson case. Back then, it was tape.
|
| One of the techniques that was considered (I can't publicly state
| what was actually done) was to digitize raw data right off the
| read heads on the VCR's spinning drum. You could then process
| this data using advanced algorithms which could produce better
| results than the electronics in even the most expensive
| professional tape players of he era.
|
| Once you step away from the limitations of a product --meaning,
| you are not engineering a product, you are mining for
| information-- all kinds of interesting and creative out-of-the-
| box opportunities present themselves.
| natas wrote:
| When the Nest camera was reconnected, the camera uploaded all the
| cached footage. Google then handed the footage to the FBI, no
| warrants needed as it's part of an ongoing case and Google is
| usually pretty friendly with the government (and vice ver-sa)
| sandworm101 wrote:
| >> no warrants needed as it's part of an ongoing case ...
|
| Thats a rather chilling interpretation of the law. Every case
| is ongoing until trial.
| mrguyorama wrote:
| Current reality is that the government does not need a
| warrant for evidence given freely to them. Google has a level
| of ownership of any video file uploaded to their servers, and
| are allowed to just say "Here you go" to the cops, regardless
| of your opinion.
|
| 3rd party doctrine is being used to eliminate your 4th
| amendment rights.
| RupertSalt wrote:
| The Nest footage is conclusive and unambiguous.
|
| Nancy Guthrie was apprehended by ICE agents and deported to
| Australia. =======
|
| Irishman at Sydney airport: "Greetings, here is my passport and
| visa"
|
| Customs agent: "G'day sir. Have you got a criminal record?"
|
| Irishman: "M'Lord, no! I didn't realise that one was still
| required!"
| taimoorhassan wrote:
| Last sentence of the article.
|
| Unfortunately, we don't have a definitive answer at this time,
| even if the theory is sound
___________________________________________________________________
(page generated 2026-02-11 23:01 UTC)