How Authorities Plan to Take Out the Site That Secretly Streams Home Cameras

The website that hosts the feeds of hundreds of thousands of IP cameras—those web-enabled cameras that people often use as baby monitors or in business surveillance systems—has gained worldwide media attention over the past couple of weeks. Now, it has caught the eyes of the authorities, with the UK vowing to take it down one way or another.

As a reminder, the site shows the private feeds of IP cameras from all over the world; from bedrooms in England to living rooms in Hong Kong. These cameras have been accessed remotely by typing in common default passwords such as 'admin', and the owner of the site told me that this collection of cameras was being carried out in an automated fashion. The owner says his motivation is to expose peoples' poor password security, and urges them to be more careful.

Today, the UK's Information Commissioner's Office (ICO), an authority set up to protect information rights, published a list of tips for keeping your camera, and ultimately your private life, off the site.

"We believe [the site is] a clear threat to peoples' privacy," an ICO spokesperson told me. The ICO were alerted about the site by their Canadian counterparts, and the first alarm bells came from Hong Kong, according to the spokesperson.

But the head of the ICO Christopher Graham also announced plans to shut the camera site down all together.

Adamant that the site is being "run by Russians," Graham said on BBC Radio 4, "I'm very concerned about what this [website] shows, and I want the Russians to take this down straight away … We now want to take very prompt action working with the Federal Trade Commission in the States to get this thing closed down. But the more important thing is to get the message out to consumers to take those security measures. If you don't need remote access to a webcam then switch off that function altogether."

When I asked the ICO what evidence they had the site was "run by Russians," as Graham said, a spokesperson told me they didn't want to go into further detail at this stage. When I asked whether they simply looked up the site's IP address, the spokesperson said, "yes, that sort of thing." A WHO IS search of the site does return an IP address from Moscow, Russia.

It's important to remember that just because a WHO IS lookup of a site reveals one location, that doesn't necessarily mean that is where its operators are based, or their nationality. Although the ICO wouldn't provide any more details on this, the spokesperson did say that "all the evidence so far suggests" that the site's owners are Russian.

Back in September, the site was allegedly being hosted by a company called MediaNet, based in Moldova, according to the Mail on Sunday investigation that first highlighted the site. The ICO spokesperson wouldn't comment on this. Today, the site is being hosted by GoDaddy, a US company, according to a WHO IS search.

According to Graham, the site is "registered in an offshore territory administered by Australia." Again, the ICO spokesperson would not elaborate on this, but he did say that their Australian counterparts were the one of the first to flag the site.

As for how the ICO plan to take down the site, there appear to be two strategies: working with Russian agencies to trace down those behind the Russian IP address, or getting the US company that is hosting the website to shut it down; in this case, GoDaddy. That would be done via the Federal Trade Commission (FTC), in the US.

"We're exploring all options at this stage, and those two would be up for consideration," the ICO spokesperson told me.

When I pushed, saying that dealing with the company hosting the website would probably be the most fruitful, the ICO spokesperson agreed, and said "the FTC approach I think is the most promising at this stage."

However, Yair Cohen, a lawyer from Cohen Davis Solicitors who specialise in internet law, is sceptical the ICO can do anything about the site. "I doubt whether the ICO has any powers or jurisdictions over the website or its operators because the site is not operating from the UK or from anywhere in the EU," Cohen wrote in an email.

"The FTC is also likely to be powerless to do anything and will probably be forbidden from taking any action by virtue of the First Amendment. Likewise, GoDaddy is likely to be protected by Safe Harbour provisions that shield it from liability for any wrongdoing by its customers.

"Based on our experiences with these sorts of matters, I believe the ICO is completely powerless to do anything other than rely on the goodwill of the Russian authorities."

So for the time being, it appears that the camera site is going to remain up and running.