`Nanny' cam privacy threat exposed
`We're unwittingly letting someone peek inside our children's
bedrooms'
By Tyler Hamilton
Technology Reporter
Two toddlers play in a baby's room, joined a few seconds
later by a nanny who takes a seat in a rocking chair. She picks
up one of the children, hugs her and whispers in her ear, then
tickles the smiley toddler while the other child runs around the
room giggling hysterically.
It's a private moment in a private dwelling - but there's
nothing private about it.
Sitting outside is a white minivan driving slowly through
this Beach neighborhood. Inside the van is a man holding a
low-cost radio receiver out the passenger window and balancing a
small television monitor on his lap. It's a simple set-up, but
enough to intercept the signal of a tiny wireless video camera
monitoring the toddlers' room.
These wireless "nanny" cams, bought on the Internet
for less than $130 and self-installed by many parents as a way
to keep tabs on their children during the day, are becoming
popular tools of home surveillance in Canadian and U.S. neighborhoods.
But parents may not be the only ones checking up on the kids.
The man in the van, local privacy expert Peter Hope-Tindall,
can see and hear everything going on in the room - a
demonstration of how vulnerable people make themselves when they
use such technologies. Ironically, all it takes to eavesdrop is
the same wireless receiver used for the "nanny" cam
itself. Hope-Tindall is on a mission to educate consumers about
the security and privacy problems of using certain wireless
products, sold in huge volumes over the Web without adequate
consumer warnings.
"We're unwittingly letting someone peek inside our
children's bedrooms," he says, adding that wireless camera
signals inside the home or small businesses can be intercepted
for other nefarious purposes. "What a way for a criminal to
case your place or find out if someone is home, using your own
camera."
Hope-Tindall, chief privacy architect of dataPrivacy Partners
Ltd., doesn't know the exact home where this specific
interception took place, because the wireless signal has a range
of more than 100 feet and could have come from dozens of area
homes.
A patient criminal, however, could easily monitor the area
and determine the address over time, while a voyeur may be happy
to anonymously observe the intimate conversations and
interactions within a nearby home, just for sick kicks.
Worse still, there's nothing stopping a tech-savvy peeping
Tom from putting live video of your children or private
communications on the Internet for the world to see and hear.
It's the ultimate reality TV but unlike The Osbournes, it can be
done without your knowledge or consent.
Like the known privacy risks of speaking on wireless handsets
or cordless phones, Hope-Tindall says the public needs to know
that affordable wireless video kits, sold in the name of home
security, can ironically lead to an unprecedented level of
privacy and security breaches by perfect strangers, or perhaps
somebody you know.
(Readers should note the video interception in the Beaches
was limited to a few seconds to demonstrate the ease with which
a homeowner's privacy can be violated. The picture that
accompanies this story is of a different family and was taken
under controlled circumstances with the family's permission.)
"This is sometimes what happens to technology, it has
the opposite effect to what people use it for," says
Michael Erdle, a privacy and Internet lawyer with Toronto law
firm Deeth Williams Wall LLP. "I think right now that most
people (using these cameras) would assume there's a level of
encryption going on there, and there isn't."
Most of the video cameras used in homes come from
Seattle-based X10 Wireless Technology Inc., which is perhaps
best known for its suggestive pop-up Web advertisements that
have flooded the Internet over the past year. Many of the ads
promote the "Amazing X10 Cameras" for home security or
nanny cams, while other ads such as one displaying a pretty
woman in a bathing suit hint at different uses.
X10 continues to be one of the most visible advertisers on
the Internet, translating into huge sales across North America.
"We are an aggressive Internet advertiser, and it has
worked well for us," said Jeff Denenholz, public relations
director for the company, which sells its products exclusively
over the Internet. "I can say these things have gotten
extremely popular, and we're selling lots in Canada."
Software called XRay Vision takes what the camera sees and
allows users or signal hijackers to view it over the Internet or
on a home PC. The signal can be set to one of four channels, but
somebody trying to intercept the signal need only alternate
among the four to eventually lock in on a clear image.
--------------------------------------------------------------------------------
`Most people (using these cameras) would assume there's a level
of encryption going on there, and there isn't.'
Michael Erdle,
Privacy lawyer
--------------------------------------------------------------------------------
Denenholz, pointing out that X10 is a private company with no
obligation to release financial details, stopped short of
providing geographic sales or unit figures. But past reports
suggest roughly half of the company's revenues, which exceed $50
million (U.S.) a year, come from sales of wireless cameras. It
is estimated that the company has likely sold hundreds of
thousands of the tiny devices since it was founded in 1999 as a
unit of Hong Kong-based X10 Ltd.
Asked whether the boxes or packaging the cameras are shipped
in contain any warnings about signal interception or privacy
risks, Denenholz admitted that they don't, but would not comment
any further.
"All we can say is we don't see an issue with
security," he said. "I'm not able to officially
comment."
Use of these cameras does not yet seem as widespread in
Canadian cities such as Toronto as it is in technology hotspots
in the United States such as San Francisco, where high-tech toys
tend to be more readily gobbled up.
Still, a drive around a number of Toronto neighbourhoods
shows the cheap little devices are catching on. In the Annex,
one in-home camera is aimed at what appears to be a student's
record collection and book cabinet, while several other homes
have pointed the cameras at their front doorstep to monitor
visitors.
Near Queen St. W. and Ossington Ave., a camera in someone's
apartment monitors the parking lot of the Centre for Addiction
and Mental Health. Back in the Beach, a number of small stores
along Queen St. E. and Kingston Rd. have wireless cameras
pointed at cash registers and clientele often without their
knowledge.
At one RadioShack store in the Toronto area, Hope-Tindall
drove more than 250 metres away and was still able to pick up a
clear colour signal of an employee talking with a customer a
good way to monitor employee movement and secretly case the
store. When The Star brought this to the store manager's
attention, he said he wasn't aware of the security
vulnerability.
"But what can you do?" he said. "This is the
way technology is going."
Hackers do the same thing with wireless data networks,
cruising neighbourhoods and industrial parks trying to intercept
corporate data using an inexpensive receiver, a laptop and some
simple software. Called "war driving," it has emerged
as a major security risk for businesses and is treated as a
serious offence.
It's unclear whether video eavesdropping is legal or not in
the United States, but criminal law in Canada would seem to
cover such an action if done with intent.
Section 184 of the Criminal Code makes it a crime, punishable
of up to five years in prison, to "listen to, record or
acquire a communication or acquire the substance, meaning or
purport thereof." To address a concern that emerged in the
late 1980s regarding eavesdropping on cellular phone
conversations, section 184.5 was enacted, making it an offence
if such a cellular interception is done maliciously or for gain.
Disclosure of such communications, such as through a feed on
the Internet, is likely to be caught by section 193. At issue
may be whether a video image alone is considered a private
communication. But Erdle believes video and audio would be
treated the same way.
"The communication doesn't have to be audio," he
says. "Communication has to be an exchange of information,
and video is a communication."
Erdle says it may come down to whether people using this
technology have a reasonable expectation of privacy, though he
adds from a peeping-Tom perspective there's the more general
charge of public nuisance or mischief, as well as the likelihood
of civil action for invasion of privacy or even stalking.
"Obviously, there are no cases on it," he says.
Michael Geist, an Internet law professor at the University of
Ottawa, agrees there is no legal precedent for intercepting
wireless cameras in the home, but adds it's only a matter of
time.
"As these technologies proliferate and certain people
understand the ability to manipulate that technology, the law
can't be far behind," he says.
In the meantime, Geist says consumers should educate
themselves on the risks of using these technologies.
"There are a whole slew of precautions that people ought
to be taking, for everything from mundane e-mail to providing
credit-card information (over the Internet) to more
sophisticated activities like this. You may feel like you're
acting in a private room, but in reality, you're often sharing
what you do with the entire world."
|