Video in investigation into Nancy Guthrie's abduction raises questions about surveillance technology

Tuesday’s release of video surveillance footage showing an armed, masked person at Nancy Guthrie’s doorstep on the night she was abducted has raised a host of questions about why it took so long to publicly release, how it was retrieved and what it means for privacy.

The process involved days of searching, the FBI said, after law enforcement initially believed the footage was lost because the camera was disconnected and Guthrie didn't have a subscription to the camera company.

The surprising emergence of the video footage has resurrected questions about digital content's long afterlife, as billions of people increasingly entwine their lives with mishmash of internet-connected devices, making it possible to retrieve snapshots from their past like old photos stored in an attic.

Unclear reasons for delay

In the days after her apparent abduction, Pima County Sheriff Chris Nanos initially said that a camera attached to Nancy Guthrie's door was disconnected just before 2 a.m. on the night she disappeared. Minutes later, the camera’s software detected movement, but no footage was preserved, he said.

At the time, Nanos said that there was no video available in part because Guthrie didn’t have an active subscription to the company. But unexpectedly, FBI Director Kash Patel said on Tuesday that investigators kept working for days to pull the videos from “residual data located in backend systems."

It was not immediately clear why it took so long to retrieve the video. The delay could, in part, be a law enforcement strategy, according to Joseph Giacalone, a retired New York police sergeant who managed hundreds of homicide and missing person cases.

Giacalone said the FBI likely tried to quietly identify the person on Guthrie’s porch before releasing the images.

“You’re trying to keep these things close to the vest. I think they worked this angle for a couple days,” Giacalone said.

Always recording

Local and federal law enforcement didn't respond to questions clarifying what they meant by “disconnected" or who was working on recovering the data.

The footage appears to have come from a Nest camera fastened on or near Guthrie's door. Google, which has owned Nest since 2014, is among numerous companies that operates private surveillance cameras used in and around homes. Because common doorbell cameras aren’t equipped with the memory cards required for vast amounts of on-device storage, the video recorded on them is routinely transmitted to data centers scattered around the U.S. and other countries.

Google didn’t immediately respond to questions from The Associated Press about how the footage of the masked person was captured while the camera was apparently disconnected. They also didn't clarify how the footage was extracted from “backend servers” even though law enforcement said Guthrie didn't have a subscription.

However, Google's privacy policy — a document that users often blindly agree to after purchasing a device — makes it clear that videos can be captured when a device is offline.

“That means you may not see a visual indicator when your camera is sending the video footage to our servers," the policy states.

Data on the cloud doesn't disappear

The policy also makes clear that footage can stay on cloud servers for varying amounts of time, but also gives users the right to view and delete video at their discretion.

Unless a Nest user subscribes to a service that allows for quick access to review footage recorded on a device, Google routinely purges the footage rather than retain it indefinitely, said Stacey Higginbotham, a policy fellow at Consumer Reports who specializes in cybersecurity issues.

But if law enforcement agencies such as the FBI reached out to Nest for the footage before it was overwritten, the video could still be retrieved and watched, Higginbotham said. “It’s basically like when you send an email to the trash. It’s still accessible,” depending on a provider’s retention policies.

Tensions with privacy concerns

There are ostensibly legal guardrails that are supposed to dictate how companies like Google access and share footage collected on cameras in and around people's homes.

Under many user agreements, camera companies need a warrant or consent from the camera owner to share footage with law enforcement, according to Michelle Dahl, the executive director at the Surveillance Technology Oversight Project.

But there are plenty of legal loopholes that would allow a company like Google to share data directly with law enforcement without either of those things, Dahl said.

“Our hearts are on her family and what they are going through, and we are glad for any information that can lead to her being found,” she said. At the same time, Dahl added, “We should absolutely be alarmed over the privacy implications that are at stake with this video that was recovered by the Nest camera."

Dahl said she doesn't know about Nest cameras specifically. But she said that some user agreements specify that the data collected on cameras belong to the camera company, not the private camera owner. In those cases, a company like Google can share footage with law enforcement at its own discretion, without even notifying its users.

Dahl, who litigates about privacy and surveillance, said that practice is becoming more common, making it harder for consumers to balance the security a camera provides with constitutional protections against surveillance.

“I think the public has gotten too comfortable with surveillance cameras in not only public spaces, but also their private homes, without thinking about the consequences of where that data ends up,” Dahl said. “If a camera is absolutely necessary for your security, look into options where that data is not transmitted off to a cloud.”

---

Associated Press writer Ed White contributed reporting.