About those unsecured security cameras in the U.S. without password protection

Observations of some of the unsecured security cameras purportedly located in the U.S.

Bedroom shot via unsecured ip security camera

As for why the U.S. has the most cameras connected to the Internet that have no unique passwords to protect them, could it be that all those cameras are not actually located in the U.S.? For example, there was a camper with icicles that appeared to be about a foot long hanging off of it as a deep snow covered the ground, but it was tagged as being located in Ocala, Florida. A quick search revealed the temperature to be 80 degrees, and that didn’t come close to matching the real-time image.

Also, the unsecured security camera below is supposedly overlooking St. Louis, Missouri, but you can be sure the image below is not of St. Louis. If it is, it’s St. Louis like I’ve never seen it, and I’ve been there many, many times. While the image may look like a picture, the blowing wind was making the trees sway. In other words, it’s been incorrectly tagged as being of St. Louis, Missouri, even though “beach” may be correct.

Tagged incorrectly as St Louis Insecam

Each link to a camera also comes with a map. Insecam notes, “The coordinates are very approximate and have accuracy in hundreds of miles.” Indeed, a tropical St. Louis at Christmastime and a snowy ice-covered Florida are hundreds of miles off, even though the approximate latitude and longitude purportedly “point to the ISP address and not the physical address of the camera.” The site adds, “This information is accurate only to a few hundred miles. The coordinates are provided only to locate the city where the camera is located, but not its exact position or address.”

So some of the cameras that are reportedly located in the U.S. may not be in the U.S. at all, but that doesn’t mean some of the cameras aren’t easily traced back to the owners. For over a year I’ve heard from readers who, like me, take privacy and security very seriously and were aghast at all the cameras “secretly” recording people in homes and businesses. They too had locating businesses down to a fine art, using Google Maps and the tilt feature to identify buildings and businesses due to the clues in the streaming camera view.

There was a common theme after finding a phone number to contact the business or a person in the household who knew about the cameras, but not that anyone online could watch them; many of the people on the phone pretended it wasn’t them, or that the manager wasn’t there. If that weren’t so sad it would be funny, since you are watching them freak out in real-time even though the point is to help them. One guy took a different tactic; if no one will speak to him to learn how to secure their camera, then he calls the police and explains it to them. Sure enough, it isn’t long before that business is no longer in the insecure surveillance camera directory.

Axis cameras were not even on the list last year and now it is the top brand without password protection. In the U.S., that meant 3,260 cameras of 5,604. The following Axis image was from surveillance of a power plant in Anchorage. After calling the place, since that is critical infrastructure, I was told that it wasn’t hurting anything although the information would be forwarded to other departments.

Axis camera on critical infrastructure Insecam

On each page featuring an insecure security camera, if you click on the surveillance image then Insecam takes you to more info about that camera, as seen in the image above. Axis appeared most often in industrial or commercial locations, although it was far from the only brand of camera focused on servers, data centers, and industrial controls.

Servers via Axis Insecam
blinking red light via Axis Insecam

Of course some of the cameras are meant to be viewed; there are apparently cat and dog daycare-like facilities which did provide amusement.

Indy lucky dogs Insecam

Other cameras revealed X-rated moments and yet others captured romance and sweet gestures; below was one of two ice skaters caught in a romantic embrace, but I won’t show others as Coca Cola used the “brighter side of surveillance footage” in a Super Bowl commercial and many privacy advocates were less than amused.

romance while ice skating in denver via Sony Insecam

Insecam says of the United States and its unsecured cameras:

You will be able to learn the routine of native Americans, the routine of USA. This observation is free of charge, so you can enjoy the viewing of your favorite locations as much as you want through the Insecam cameras.

You can catch the most interesting episodes from the American everyday: bank robbery, assaulting, protests and other events, which will not be shown by mass media, for sure. These public cameras are available 24/7. 

Thankfully I witnessed no assaults or other crimes, although it surely seems like a crime to be able to see people inside their homes while they likely have no idea they are being watched by anyone 24/7. Or perhaps some do know and just enjoy running around in their underwear?

I have no answer for why thousands of Foscam cameras reportedly located in the U.S. would disappear off the site within two days, bringing the numbers down to the hundreds. It would be fantastic if others who care about privacy and security were on a mission and managed to track them down and educate them into securing their cameras. Tracking cameras back to households is much more challenging than finding businesses, though, so maybe there was a miracle and thousands of Foscam owners wised up? While it is not always true, most often when you hear about a hacker taking control of a baby monitor camera and either cussing at the family, playing eerie music, or talking to the family, the IP camera was a Foscam. There are, thankfully, very few cameras – unlike a year ago – peering down into cribs.

Regarding cribs and beds of Americans, living rooms, kitchens and more which are featured on Insecam, that’s a topic for tomorrow.

Copyright © 2015 IDG Communications, Inc.

Microsoft's very bad year for security: A timeline