Wake-up call on IP camera passwords as UK school CCTV streamed on Russian website

Video footage from more than 500 cameras in UK schools, homes and businesses is being streamed on a freely accessible website.

The Information Commissioner’s Office (ICO) has urged IP camera users and installers to immediately set strong access passwords after it was recently revealed that streams from IP cameras – including some in schools – are available to view via a website, which could be based in Russia or the Ukraine.

According to media reports, video from more than 500 cameras in UK schools, homes and businesses is being streamed on a freely accessible website, Insecam.org. The schools affected include St Mary’s Catholic Academy, Christ the King Catholic Academy and Highfield Leadership Academy, all in Blackpool. Another school, said to be in southeast England but unnamed, was also mentioned.

The parent of a child at St Mary’s told the MailOnline that the breach was “completely shocking. It’s really bad, they’ve got cameras everywhere around the school.” Another Highfield parent said: “Oh, my God. How can they be allowed to run so many cameras if they can’t look after the children the cameras are supposed to protect?”

The schools have taken steps to reset passwords and their camera feeds are no longer viewable on the site.

Cameras can be selected by country, city, types of site including public spaces and private property, and even by camera brand

The Insecam site claims it is “the world’s biggest directory of online surveillance security cameras”. Cameras can be selected by country, city, types of site including public spaces and private property, and even by camera brand.

The types of location available to view from around the world range from the worrying, such as schools and bedrooms, to the random and bizarre such as barbershops, churches and launderettes.

Insecam says it does not hack cameras but merely makes available images from cameras without a password, or with a factory default password. The site claims that individual privacy is protected, as only “filtered” cameras are available and that any private or “unethical” camera will be removed on request.

“Serious threat”

This is not the first time the site has come to the attention of data protection authorities.

In 2015 the ICO, together with privacy enforcement bodies from Australia, China and Canada, wrote to Insecam saying that their actions posed a “serious threat to individuals’ privacy around the world” and that in view of the “sensitive nature of the personal information collected via such cameras”, the site should be taken down with immediate effect. The site was taken down, only to reappear a year later.

“We are aware of a website streaming footage from internet-connected security cameras from around the world, including sites in the UK, and are looking into the details,” an ICO spokesperson told IFSEC Global.

“This may include contacting suppliers, manufacturers and users where they can be identified. We will also be liaising with our colleagues in other countries to consider what steps can be taken on an international level.

“The ICO advises anybody who purchases an internet-connected device which has the capability to stream live video to immediately change passwords and usernames from default settings and to set a strong password – one that should not be known by anyone else or be easy to guess.”

Free Download: The Video Surveillance Report 2023

Discover the latest developments in the rapidly-evolving video surveillance sector by downloading the 2023 Video Surveillance Report. Over 500 responses to our survey, which come from integrators to consultants and heads of security, inform our analysis of the latest trends including AI, the state of the video surveillance market, uptake of the cloud, and the wider economic and geopolitical events impacting the sector!

Download for FREE to discover top industry insight around the latest innovations in video surveillance systems.

Download The Video Surveillance Report