Cybersecurity experts explain how surveillance footage of Nancy Guthrie’s home was recovered
Investigators with the FBI and Pima County Sheriff’s Department said they were able to recover footage from a Google Nest camera outside the Arizona home of Nancy Guthrie — the missing mother of “Today” co-host Savannah Guthrie — by extracting “residual data located in backend systems,” raising new questions about how it was possible to retain the video.
Retired special agent Jason Pack told CBS News that locating the missing footage of a masked individual outside Guthrie’s door was “like finding a needle in a haystack,” providing a breakthrough authorities needed more than a week after she was reported missing.
But many are questioning how footage was recovered from a doorbell camera that officials said was disconnected with no active subscription to store video. With a free Google Nest plan, the video should have been deleted within 3 to 6 hours — long after Guthrie was reported missing.
How doorbell cameras store data
Although Nest users with a free plan cannot access cannot access recordings past a certain time frame, cybersecurity experts say doorbell cameras, like Guthrie’s, have built-in backup mechanisms that enable them to store data across multiple layers, which makes short-term recovery possible.
“Internal storage uses a very lazy deletion mechanism, so the data wouldn’t be available to users who didn’t pay,” cybersecurity expert Alex Stamos explained to CBS News. “The video for non-subscribers would be marked for deletion, but depending on the exact implementation details, the actual files might not be deleted for days and the actual data wouldn’t be overwritten until the storage was needed.”
Patrick Jackson, a former NSA data researcher and the chief technology officer for privacy and security company Disconnect, added, “There’s kind of this old saying that data is never deleted, it’s just renamed. And I think this is a perfect, you know, showing of this where once this data’s uploaded, they may mark it for deletion, but it may never get deleted.”
Jackson said most doorbell cameras also have a tamper mode, a security feature that alerts a user when a device is being disconnected or damaged. He believes this may serve as a signal for companies to hold onto data for a longer period of time.
“From Google’s server perspective, it knows if that device goes offline,” Jackson said. “And so if the last event was tamper detected, and it’s a motion event, it could tag it in a way where Google may not delete that and may know that this could have some value to some law enforcement.”
Jackson said there’s nothing in the terms of service that would prevent Google from activating this feature and retaining video for a longer period of time. He suspects most users aren’t aware of this potential feature.
Implications for future investigations
“This is Google tipping their hand for potentially a capability that maybe they’ve never disclosed,” Jackson said. “And maybe this rose to the occasion where they felt, OK, you know, we do have this ability, we’re going to use it for this occasion.”
According to Google’s cloud storage protection backup recovery overview, “Cloud Storage offers a variety of options to help you protect your data from accidental or malicious deletion and recover your data in the event of a disaster. These options can be useful for legal or regulatory compliance, as well as for protecting data that is critical to your business.”
FBI Director Kash Patel told Fox News that authorities executed lawful searches and turned to private sector companies to “expedite results and then go into their systems and actually excavate material that people would think would normally be deleted and no one would look for.”
In a transparency report, Nest explained how the company responds to court orders or requests from law enforcement.
“When we get a request for user information, we review it carefully and only provide information within the scope and authority of the request. Privacy and security are incredibly important to us. Before complying with a request, we make sure it follows the law and Nest’s policies. We notify users about legal demands when appropriate, unless prohibited by law or court order. And if we think a request is overly broad, we’ll seek to narrow it,” the company stated online.
Jackson said the recovery of critical footage from Guthrie’s free account could open Google up to a flood of future law enforcement inquiries.
“We’re not the only ones as consumers looking at this kind of alarm,” Jackson said. “Law enforcement folks are looking at this as like, oh, this could be a new capability that we could add to our pipeline for when we’re trying to source video footage.”
CBS News has reached out to Google for comment on the Nest footage. A Google spokesperson previously told CBS News, “We are assisting law enforcement with their investigation,” and adding that “this is an ongoing investigation, and we cannot share further details at this time.”
More from CBS News
Go deeper with The Free Press
