Doorbell cameras are helpful for package theft, but come with privacy risks

Ernie Field pushes the doorbell on his Ring doorbell camera at his home in Wolcott, Conn., on July 16, 2019. (Jessica Hill / AP)

EDMONTON — Thanks to a rise in package theft, doorbell cameras have gained popularity as online deliveries surge amid the pandemic. But experts warn the internet-connected cameras come with their own set of concerns.

Like all smart devices, when used without enhanced security settings, the cameras are vulnerable to prying eyes. Those who know how to gain access to the cameras can easily intercept their live video streams and share them publicly.

But it doesn’t take a hacker to intercept unprotected cameras – a lesson Calgary resident Bill Douros recently shed light on after discovering his own doorbell camera feed was being streamed on a website that features live security camera feeds from around the world.

“About six weeks ago I had a package stolen from my front porch… so I thought maybe if I had a doorbell camera I could shame these people on Facebook like other people do,” Douros told CTVNews.ca by phone Friday.

“It was really easy to set up, I did it in like 15 minutes. But then I was curious to see if my security was locked down enough…. That’s when I started investigating, came across some forums on Reddit and found this website with all of these web cam feeds.”

His search led him to Russian-based website Insecam, which curates live streams of unprotected security cameras around the world. The website even provides an estimated location of the camera based on its IP address.

Douros, an IT professional by trade, found more than a dozen cameras being streamed from the Calgary area.

At the time of publishing, the website featured over 15 video feeds from Toronto, 12 in Vancouver, and a handful in Halifax.

“There was one that was like a nanny cam – you could see the kids playing. There was another one in somebody’s living room, so you could see them eating dinner or sitting down and watching TV,” Douros.

“People have set these up so they feel more secure, but they don’t know they could be watched by strangers.”

CTVNews.ca was unable to contact Insecam for comment. Its contact page, which users are told to visit if they want to request the removal of their camera’s stream from the website, registers a 404 error.

But Insecam is just one example of the many ways unprotected smart devices can be accessed by rogue users.

"When we use doorbell cams, people can surveil us and peer into intimate aspects of our lives," Yuan Stevens, policy lead on technology, cybersecurity and democracy at the Ryerson Leadership Lab, told CTVNews.ca by email Friday.

"Right now, it is up to consumers to educate themselves on the privacy of internet-connected devices like doorbell cams. Consumers need to decide whether the sense of safety they gain from these products is worth the harm they can cause."

The problem is, the majority of users rely on the default settings of connected devices, including their routers, putting their privacy at risk.

A survey conducted by Steven’s team last year found that around a quarter (26 per cent) of Canadians have a voice-operated assistant or smart speaker in their homes. But only a quarter of those people have configured those devices to limit the information collected by the device.

“Canadians can guard their homes from the prying eyes of companies like Insecam by using strong device passwords,” she explained.

“Insecam's FAQ says as much: ‘The only solution to make your camera private is to set up a password!’”

Stevens says she urges consumers to explore resources like Mozilla Foundation's "*privacy not included" project. The website examines whether smart devices, such as Amazon's Alexa or Ring doorbell camera, have been designed with privacy in mind.​