Private moments captured on home security cameras being live streamed again on website

An elderly woman in bed next to a commode toilet in Quebec, a child playing in a livingroom in Alberta,a woman working from home in Ontario andkitchen staff working in a coffee shop.

These private moments have all been visible to anyone on the internet through a website that's live streaming thousands of unsecured cameras around the world in real time.

When an employee at a downtown Toronto coffee shop learned that he and other staff were being watched, he saidhe was surprised because his manager is typically thorough when it comes to security.

CBCNewsis withholding the employee's full last name because he says he feels uneasy after his privacy was already breached. Andy C. saida woman called the Second Cup to alert them that the videofrom one of their cameras at the back of the store wasvisible on the website and described what they were doing in real time.

"As soon as she revealed she wasn't in the area, I was like, 'OK, how do you know all this stuff?' She was able to identify key traits of people who were working; me and another person," he said. "Definitely uncomfortable."

Andy said he disconnected the security camera immediately.

'Privacy is all about control'

Websites that stream unsecured cameras aren't illegal, but the Office of the Privacy Commissioner of Canada has been tracking the particular website for years. It says while the websitestopped broadcasting for a time, it ramped back up, and a few weeks ago itstarted once again streaming private settings.

Cybersecurity experts say with home security cameras becoming more popular and people working from home during the pandemic, it's vital the public iseducated about how to keep their cameras secure.

CBCNews is not naming the website to avoid contributingto the invasion of people'sprivacy. The site is reported to be based in Russia and bills itself as the world's biggest directory of online surveillance security cameras. On any given day, there are tens of thousands of cameras available to watch around the world, including more than 250 in Canada.

WATCH |Ann Cavoukian, executive director of the Global Privacy and Security by Design Centre in Toronto, speaks to CBC News:

Private home security camera footage being live streamed again on website

3 years ago

Duration 2:37

A website reportedly based in Russia is once again live streaming unsecured security cameras after the federal privacy commissioner and other authorities demanded it stop. But websites that stream unsecured cameras aren't illegal. Angelina King has the story.

Most of them show outdoor spaces, where the expectation of privacy is low, but some clearly show inside homes and businesses without permission.

CBCNews attempted to contact the owners of several cameras and was able to get in touch with a handful of businesses (the website lists the cameras' general location, but some were inaccurate). Aside from the one coffee shop employee, business owners and staff didn't want to be interviewed after being told video from their cameras was visible, but several feeds were taken down.

Ontario's former privacy commissioner saidit's appalling that the site is broadcasting people'spersonal moments and interactions without their knowledge or consent.

"You can imagine how much sensitive information could potentially be captured on a camera," Ann Cavoukian said. "It's nobody's business. Privacy is all about control. It's about personal control over the use and disclosure of your personal information. This throws it out the door."

Cavoukian, who is now executive director of the Global Privacy and Security by Design Centre in Toronto, saidwithout control over the images being broadcast online, one "can't imagine what unethical uses could arise."

"We have to find ways to stop this," she said.

Site targets cameras without passwords

Cybersecurity experts say the main ways a website can access a security camera is if it's not assigned a password, the factory password isn't changed or a camera is misconfigured during setup.

"If you're not changing [passwords] or you're not using complex passwords, then you leave yourself vulnerable," said Sumit Bhatia, director of innovation and policy at the Rogers CybersecureCatalyst at Ryerson University.

The main page of the website that CBC is focusing on includes a statement thatit only broadcasts cameras without passwords and that the cameras are not hacked, but Bhatia saidcameras left vulnerable can lead to hackers breaking in.

It's possible hackerscan gain access to other devices on the same network, he said, such ascomputers, phones and tablets, which is even more of a concern during the pandemic.

WATCH | Sumit Bhatia explains how a compromised camera can lead to further breaches:

Sumit Bhatia explains what hackers are capable of once they access unsecured cameras

3 years ago

Duration 1:24

Cybersecurity expert Sumit Bhatia says a compromised security camera can lead to hackers accessing even more private information.

"Everybody is working from home, and a lot of people haven't necessarily placed new measures or implemented new ways to protect their home systems," Bhatia said. "And that's just a function of their own limited knowledge or resources, which means that work laptops and computers are now also accessible by hackers who have hacked into security cams."

Bhatia said there are several sites that stream cameras without people'sknowledge, and he believes some work in tandem. While some of them may claim they are exposing vulnerabilities that exist in security camera systems, he said, outside hackers can take advantage of the compromised cameras.

"There's clearly some concerns around there that we have to address as a community and as an industry, but I believe that their motives are not necessarily one for social good."

Federal privacy commissioner sent letter to site in 2014

A spokesperson for Canada's privacy commissioner says seven years ago, the office along with the heads of other provincial and international data protection authorities sent a letter to the website's operator requesting the sitebe taken down.

Vito Pilieci said thatshortly after, the site stopped streaming for a time, but it resumed by posting a smaller number of outdoor feeds. Then, a few weeks ago, he said, the site once again started streaming "some egregious cases" of private settings.

"This is clearly an extremely concerning privacy issue," Pilieci said in an email. "We are currently considering options about how to best address the matter."

He said that potentially includes discussions with international counterparts because the site isn't based in Canada.

"We would urge anyone with a webcam in their home or business to ensure that they take steps to secure the camera. In particular, they should make sure they are not using the factory default password," Pilieci said.

CBCNews contacted the website's administrator but didn't get a response. The site claims itworks to protect people'sprivacy by only showing filtered cameras and says anything unethical will be removed upon an emailed complaint.

"If you do not want to contact us by email, you can still remove your camera from [the site]. The only thing you need to do is to set the password of your camera," the website reads.

Not illegal to stream compromised cameras, lawyer says

Despite their intrusive nature, running websites that streamunsecured cameras isn't illegal in Canada, said ElliottGoldstein, a lawyer in Newmarket, Ont., who consults the alarm and security industries on the use of surveillance cameras in homes and businesses.

"The problem is most of these websites are out of the country. There's no law that really governs these types of websites," he said, adding the onus is on the person who owns the camera to ensure it's secure with a password.

"It's like leaving your windows open and people looking in. If you want privacy, shut your drapes."

Goldstein saidcompromised footage could be used in nefarious ways from blackmail and harassment to the compromised feed being sold to other viewers for a profit.

Businesses with unsecured cameras couldbe held responsible for compromising the personal information of their customers, Goldstein said. That can be a particularissue in settings where sensitive personal information is collected, such as a doctor's office, he added.

"It's the responsibility of the organization that controls the information-gathering device to make sure it does it properly."

There hasn't been a significant push by provincial or federal governments to pass legislation addressing the specific issue, Goldstein said.

"Right now they have an awful lot of other problems to deal with. Compromised cameras are not really that high on the list of priorities."

Tips to keep your camera secure

Ryerson University's Bhatia saidcybersecurity is a growing concern, and there's a lack ofeducation andawareness programs to help people protect themselves and their information.

Here are his main tips when it comes to protecting home or business cameras:

• Change your camera's default password and assign it a new one.
• Avoid simple and short passwords.
• If you can't remember complex passwords, get a password manager to help.
• Avoid connecting devicesto the same network.
• Regularly update the camera's firmware.

If your camera has been compromised:

• Immediately disconnect it from your network.
• Disconnect your router, reconfigure your network and change all of your passwords.
• If your camera is linked to a monitoring service, notify the service.
• Check your other home devices for anomalies, reconfigure them and change passwords.
• If you have serious concerns, notify police.