How the FBI might have gotten inaccessible camera footage from Nancy Guthrie’s house

As the investigation into Nancy Guthrie’s disappearance continues, law enforcement has been able to get its hands on doorbell footage it previously said was inaccessible.

The FBI released Google Nest video footage Tuesday. It shows a masked person outside Guthrie’s door.

Last week, law enforcement said that the doorbell camera had been removed — and that on Feb. 1, when Guthrie was reported missing, the doorbell camera disconnected. About half an hour later, the camera’s software detected motion, according to Pima County Sheriff Chris Nanos. But there was no video footage because the camera wasn’t connected to a paid subscription, and so the data was overwritten, he said.

“That’s what our analysis teams have told us. We’re not done with that. We’ll do all we can, but that’s what it says,” Nanos said.

But on Tuesday, FBI Director Kash Patel said the video was “recovered from residual data located in backend systems,” though he didn’t provide details about the recovery process.

So how could law enforcement have retrieved the video? Experts say it depends on the company and how the footage went missing.

What if the camera is physically tampered with?

Patel said on Tuesday it appears the front doorbell camera could have been tampered with. Such tampering, like removing the doorbell camera from its post, would likely kill the power. But previously collected data would likely continue being stored, said Jim Jones, director of the digital forensics program at George Mason University.

“Unplugging or losing power would really just stop the recording. Whatever had been recorded up to that point is actually a little bit safer because it’s not going to be overwritten by more recording,” he said.

What if a user doesn’t pay for a subscription?

Google’s Nest cameras offer Google Home Premium subscription plans, which allow users to keep “highlights” of recordings from 30 to 60 days, or 24/7 video history.

But if a user doesn’t have a subscription, “That doesn’t mean the data doesn’t still get pushed up into the cloud, which it likely did,” Jones said. “But it does mean that once Google gets it, and they realize there’s no subscription, they have no obligation to retain the data.”

That data may be moved to a separate storage area within the cloud to free up space, and may be deleted or overwritten eventually, Jones said. NPR has reached out to Google, but has not heard back.

What happens when footage is deleted?

When a user or company “deletes” data, it may not actually be deleted immediately, Jones said.

The U.S. has fairly lax privacy regulations, so in many cases, it’s up to the company to determine what they do with the data, and how long they hold on to it, said Jaron Mink, an assistant professor of computer science and engineering at Arizona State University. This is usually spelled out in privacy policies, they said.

“Sometimes it means that it’s more difficult for the functionality to delete data to actually occur, because it’s not built as a requirement in the system in mind,” Mink said.

However, data is gone for good if it is overwritten, Jones said, meaning some other data has taken its place.

While companies are subject to the laws of the jurisdictions they operate in, in many cases, they can decide if they want to hand over user data to law enforcement. Some won’t out of loyalty to its users, said Leeza Garber, a cybersecurity attorney and adjunct law professor at Drexel University. But Jones said others might if law enforcement has obtained a warrant.

“It is vital that all tech consumers understand the way their data can be accessed by law enforcement,” Garber said. “We hate to read terms and conditions, but it has become necessary to take responsibility for the often one-sided relationship that we continually accept with tech.”