Internet-connected devices are known for having their fair share of security issues—especially when it comes to cameras. But here’s a new one: the BBC reported this week that a smart home security camera started sending video clips to the wrong person.
The BBC first caught wind of the problem shortly after one of its employees purchased an internet-enabled camera made by Swann Communications and started receiving video footage that showed the inside of someone else’s home. The company claims the problem is a one-off occurrence but there’s been at least one other instance of the issue reported.
The BBC staffer, Louisa Lewis, reportedly first purchased her security camera in December and didn’t have any issues with it until last week, when she started getting notifications from the device. The Swann camera typically alerts the user when it detects movement, so Lewis checked to see what was going on. What she saw, per the BBC, was a stranger’s kitchen:
“I was out and I had a couple of alerts,” she recalled.
“Naturally, I looked at my phone only to see the video was not of my home.
“At first I ignored it – I thought it must be an error – then I had several other alerts, at which point I thought I had better get in touch with Swann.”
The short video clips, which downloaded directly to her phone, offered a surprisingly intimate albeit brief glimpse into someone else’s life. In one shot, it showed a man and a woman walking past the camera. In the other, a child’s voice was audible in the background.
When Lewis contacted Swann about the issue during the weekend, she was told nothing could be done about the issue until Monday. Once it was finally addressed by the company’s staff, Lewis stopped receiving clips from the unrelated camera.
Why exactly did the mix up happen? A spokesperson for Swann told the BBC the issue was the result of a human error. All cameras are given a security key which allows the device to securely transmit footage from the camera to a Swann server and be retrieved on a smartphone or other device. In this case, two cameras were given the same security key, which resulted in the footage being sent to Lewis.
Swann also blamed the family, noting that they ignored a warning prompt that informed them the camera was already paired to another account. But at the end of the day, the issue stemmed from Swann producing duplicate keys—not the family failing to understand the company’s mistake.
The spokesperson for the company said “no further data was breached or accessed by additional third parties,” and said it was a “one-off” occurrence, but that may not be the case. There has been at least one other reported incident of a person receiving footage from a Swann camera that doesn’t belong to them.
On Twitter, a user going by The Obscure Brewer and identified by the BBC as Tim Lane reported receiving footage from a pub. Swann said it was investigating the situation but claimed that the issue was likely the result of both the pub and Lane registering their products with the same username and password.
Can @swannsecurity please tell me why both our smart devices can reliably access the CCTV cameras from a pub. Moreover, who's viewing our cameras? Anyone recognise the pub? pic.twitter.com/LSfUIfF1FE
— The Obscure Brewer (@Battwave) May 30, 2018
Great to meet the manager @newtownlinford and share our concerns that @swannsecurity remote access CCTV system is giving us images from his cameras in place of our own. Bizarre to be able to take a selfie using someone else's CCTV camera pic.twitter.com/fTgmAVoPle
— The Obscure Brewer (@Battwave) June 3, 2018
That explanation seems…suspicious, at best. You shouldn’t be able to register a device with a username that is already in use, for one. And, even if that is possible, what are the odds that a person selects the exact same login information as someone else? That just doesn’t seem to check out.
One way or another, it seems like Swann has some security issues it needs to sort out. Though given there are tens of thousands of unsecured, internet-connected cameras that you can tap into at any time, the company isn’t alone.