When an employee of a coffee shop in downtown Toronto learned that he and other employees were under surveillance, he said he was surprised because his manager is usually thorough when it comes to safety.

CBC News concealed the employee’s full name because he said he was upset after his privacy had been violated. Andy C. said a woman called Second Cup to remind them that the video they took on a camera at the back of the store can be viewed on the website and described what they were doing in real time.

“Once she revealed that she was not in the area, I was like,’Well, how do you know all these things?’ She was able to identify the key characteristics of the staff; me and the other person,” he said. “It must be uncomfortable.”

Andy said he immediately disconnected the security camera.

‘Privacy is control’

Sites that stream unsafe cameras are not illegal, but the Office of the Privacy Commissioner of Canada has been tracking specific sites for years. It said that although the site stopped broadcasting for a while, it resumed broadcasting, and it started streaming private settings again a few weeks ago.

Cybersecurity experts say that as home security cameras become more popular and people work from home during the pandemic, it is important for the public to understand how to protect the security of cameras.

CBC News did not name the site to avoid infringing on people’s privacy. According to reports, the website is located in Russia and claims to be the world’s largest online surveillance security camera catalog. On any given day, there are tens of thousands of cameras available for viewing all over the world, including more than 250 in Canada.

Most of them show outdoor spaces that do not require high privacy, but some are clearly displayed inside homes and businesses without permission.

CBC News tried to contact the owners of several cameras and successfully got in touch with several companies (the website lists the approximate locations of the cameras, but some are inaccurate). Except for a coffee shop employee, the business owner and employees did not want to be interviewed after being told they could see their camera video, but several feeds were deleted.

The former privacy commissioner of Ontario said that it is shocking that the site broadcasts people’s personal moments and interactions without their knowledge or their consent.

“You can imagine how much sensitive information might be captured by the camera,” Ann Cavoukian said. “It’s nothing to do with anyone. Privacy is control. This is personal control over the use and disclosure of personal information. This throws it out of the door.”

Cavoukian is now the executive director of global privacy and security at the Toronto Design Center. He said that if you can’t control the images displayed online, “it is impossible to imagine unethical uses.”

“We must find a way to prevent this,” she said.

Website for cameras without password

Network security experts said that the main way for websites to access security cameras is that no password is assigned, the factory password has not been changed, or the camera is configured incorrectly during the setup process.

“If you don’t change [passwords] Or if you don’t use complex passwords, then you are vulnerable to attacks,” said Sumit Bhatia, director of innovation and policy at Rogers Cybersecurity Catalyst at Ryerson University in Toronto.

The homepage of the website that CBC focuses on states that it only plays cameras without passwords and that the cameras have not been hacked, but Bhatia said that vulnerable cameras may lead to hacking.

He said that hackers may be able to access other devices on the same network, such as computers, mobile phones and tablets, which is even more worrying during the pandemic.

Watch | Sumit Bhatia explains how the damaged camera caused further damage:

Cyber ??security expert Sumit Bhatia (Sumit Bhatia) said that compromised security cameras could allow hackers to access more private information. 1:24

“Everyone works from home, and many people don’t necessarily adopt new measures or implement new methods to protect their family system,” Bhatia said. “This is just a function of their own limited knowledge or resources, which means that work laptops and computers can now also be accessed by hackers hacking into security cameras.”

Bhatia said that there are several websites that play cameras without people knowing, and he believes there is some collaborative work. He said that although some of them may claim that they have exposed vulnerabilities in the security camera system, outside hackers can use the infected camera.

“Obviously, as a community and an industry, we have to solve some problems, but I believe their motivation is not necessarily for the benefit of society.”

The Federal Privacy Commissioner wrote to the site in 2014

A spokesperson for the Canadian Privacy Commissioner said that seven years ago, the office, together with the heads of other provincial and international data protection agencies, A letter The website operator requested that the website be closed.

Vito Pilieci said that shortly after, the site stopped streaming, but resumed it by publishing a smaller number of outdoor feeds. Then, a few weeks ago, he said that the site again started streaming “some shocking cases” of private settings.

“This is obviously an extremely worrying privacy issue,” Pilech said in an email. “We are currently considering options for how to best solve this problem.”

He said this may include discussions with international counterparts because the site is not in Canada.

“We would urge anyone who installs a webcam at home or at a company to make sure that they take steps to protect the camera. In particular, they should make sure that they are not using the factory default password,” Pilec said.

CBC News contacted the administrator of the site, but received no response. The website claims that it protects people’s privacy by showing only filtered cameras, and stated that any unethical content will be deleted after complaints via email.

“If you don’t want to contact us via email, you can still [the site]. The only thing you need to do is to set a password for the camera,” the website reads.

Lawyer says it’s not illegal to stream damaged cameras

Elliott Goldstein, an attorney in Newmarket, Ontario, who advises the alarm and security industry on the use of surveillance cameras in homes and businesses, said that although these sites are intrusive, they run streams in Canada. The website of the media unsafe camera is not illegal.

“The problem is that most of these sites are abroad. There is no real law governing these types of sites,” he said, adding that it is the responsibility of the person who owns the camera to ensure the use of passwords is safe.

“It’s like leaving your windows open and people looking in. If you want privacy, close the curtains.”

Goldstein said that the damaged footage could be used in malicious ways—from blackmail and harassment to selling the damaged feed to other viewers for profit.

Goldstein said that companies with unsafe cameras may be responsible for leaking the personal information of their customers. He added that in environments where sensitive personal information is collected, such as a doctor’s office, this may be a special problem.

“It is the responsibility of the organization to control the information collection equipment to ensure its correct operation.”

Goldstein said that the provincial or federal government did not vigorously promote the passage of legislation to solve specific problems.

“Now they have a lot of other issues to deal with. The damaged camera is not that important in the priority list.”

Tips to ensure camera safety

Bhatia of Ryerson University said that cybersecurity is a growing concern and there is a lack of education and awareness programs to help people protect themselves and information.

The following are his main skills in protecting home or commercial cameras:

• Change the camera’s default password and assign a new password to it.
• Avoid using simple and short passwords.
• If you do not remember a complicated password, please seek the help of a password manager.
• Avoid connecting devices to the same network.
• Update the camera’s firmware regularly.

If your camera is compromised:

• Disconnect it from your network immediately.
• Disconnect the router, reconfigure the network and change all passwords.
• If your camera is linked to a surveillance service, please notify the service.
• Check if there are any abnormalities in your other home devices, reconfigure them and change the password.
• If you have serious concerns, please notify the police.