PubCam: An analysis of public access cameras

Introduction

Insecam is one of the world's biggest directories of online surveillance cameras. Our project aims to bring awareness to the privacy concerns raised by these cameras with a focus on the Indian Subcontinent. Our primary objective is to show how these cameras (Over 70,000 worldwide) are a threat to an individual's privacy and to spread awareness on what precautions can be taken to protect oneself. 

We collected data from 20+ cameras all over the country over the course of the project and tried various pattern and object recognition techniques including tracking movement of individuals, observing daily schedules of store workers and office workers, understanding government routines and highlighting high demand products or sections in stores.

Additionally, we conducted two surveys with around 35 respondents to study their awareness of these public IP cameras and whether they had secured their surveillance setup (if any).

One of the publically available cameras on Insecam - Times Square, New York

Workflow

1. Scraping 

We use a custom web crawler to scrape images periodically from a few Insecam video feeds using OpenCV and BeautifulSoup libraries. The crawler stores the images in a well-labelled manner using the Camera ID and timestamp to differentiate images. The complete scraping and processing pipeline used in this work can be found on our Github Repo.

High-level flowchart detailing information flow

Images scraped from different cameras on Insecam

2. Processing

RetinaNet, an object tracking algorithm, is used to automate and simplify the task of sifting through the images. A text file containing the formatted output from RetinaNet are stored along with images so that we can read them to identify and view only snapshots of data with relevant information like moving vehicles, people, etc. A sample text file generatedcan be found here.

(a)

(b)
Processed images after object detection

3. Analysis

With the interesting data discovered after processing, we were able to notice the following interesting patterns and conclusions from various cameras:

1. SP Office, Kurukshetra:  
This footage can be used to track the number of personnel present in the vicinity of the office and even monitor the traffic to make predictions on staffing.

Images from the SP Office, Kurukshetra

2. Residential Duplex, Bengaluru:  
A single camera placed outside the house pointing at the exit can be used to schedule the regular entry and exit times of residents. We were able to figure out the work schedule of one of the residents - She leaves at 9AM everyday and returns around 6PM. This sort of information can be used for malicious purposes.

3. Residential Parking, Chennai:  
Another residential parking lot, this time in Chennai, shows a clear view of the cars parked (eg- a Hyundai Eon) including their license plates being clearly visible. When we looked up the license plate of the car on VahanInfo we were able to find information on where the car was registered. This information could potentially be used nefariously.

4. Clothing Store, Andhra Pradesh:  
Using multiple cameras set up in the same store in Vinnukonda, Andhra Pradesh, we were able to track foot traffic in a clothing store and using the above-mentioned object detection algorithm, we were able to create a graph with the number of customers in the store throughout the day: 

Plot showing number of people in the store throughout the day

Plot showing number of people in the store during one of the busiest periods 

Legal Status

Insecam acts in somewhat of a gray area when it comes to the legal side of things. The administrator of the site is anonymous and runs the service out of Russian servers making it almost impossible to identify and when asked about the legality and ethicality of the site the following statements were given:

  1. Insecam is a whitehat service designed to show the importance of security settings.
  2. Only filtered cameras are available on the site. None of the cameras invade anyone’s private life.
  3. Any private or unethical camera will be removed upon an email complaint.
Due to the anonymity and location of servers, the number of cases/complaints filed against Insecam are very few and even in these scenarios, no action could be taken. Following are a few of the cases we found:
  1. CyberSecurity Malaysia received many complaints regarding Insecam and while there was a consensus on the problematic nature of the site, no action was taken due to lack of proper permissions provided by the authorities.
  2. The Information Commissioner's Office in the UK condemned Insecam and implored the Federal Trade Commission in the US to conduct a review and shut down the site. However, this case was probably buried under more pressing matters and we never saw a progress report on it.

Sadly, this is the state of Insecam's legal status and the site still remains active with over 70,000 cameras still up on the site. Given the lack of any legal action, educating the public on these privacy breaches would be the next best approach.

Survey Stats

We conducted a survey regarding people's knowledge about IP cameras and their awareness of the surveillance cameras around them. 
The Google Form used to collect the data had the following questions:
  1. If they have surveillance in their locality?
  2. Do these cameras add your feeling of safety?
  3. If they knew the difference between a CCTV and an IP camera?
  4. Are they aware of the risks associated with a IP camera that is not configured properly?
  5. If the risks associated with surveillance cameras (especially IP cameras) make them worried?
From the 35 participants in the survey, we were able to create the following piecharts:
Awareness of Surveillance camers in their locality

Awareness about the type of cameras used

There were several insights that were drawn from this survey:
  1. 70% of the people who responded indicated that they have surveillance cameras in their localities. This implies that a considerable numberof individuals have surveillance cameras around them, however our survey was restricted to the people we could reach out to which is mainly middle-income level Indians residing in urban areas. As expected, most of them felt the cameras were there for their own good so that a recording was present in case it's required.
  2. When asked if they felt safe due to the surveillance cameras, most answered yes, and further indicated that the monitoring might prevent suspicious activities(eg- Theft and other criminal activities). Additionally, there were a few who felt that they are being watched. They indicated feeling like they can’t trust the individuals observing the footage as often the video feed isviewed by security guards who change frequently. Some were also worried about where the recorded data was stored and whether it was accessible to anyone except the people authorized to view it.
  3. Another group of individuals were unsure if they felt safe, also happened to be those who had surveillance cameras in a certain part of their own house, which indicates a greater concern for privacy.
  4. When asked if they knew what type of camera (IP or CCTV) was used for surveillance, 50 percent of the individuals responded saying that CCTV was being used, but the other half either knew it was IP or did not know what it was. A negligence in such details about surveillance systems is one of the key reasons that there are so many surveillance feeds out in the public as the people who install them do not know the security measures they should be following. Additionally, the people who responded with " CCTV" may not actually know what type of camera has been installed and since CCTV is an older technology that most people are familiar with they may have responded with this option.
  5. 40 percent of the individuals did not know that poorly configured IP Cameras could be publicly accessed. An increase in awareness about surveillance cameras hence will aid the community and even prevent sensitive feeds from being leaked, and made visible to the general public.
  6. With the knowledge on the risks associated with poorly configured surveillance cameras, the individuals who earlier felt safe, now indicated being worried about the risks they were possibly exposed to. Many wanted to make sure of what the configurations of their surveillance cameras were, which is indicative of the lack of awareness around the topic.

Interviews

We conducted interviews with some individuals from residential areas surrounding us to understand their mindset of people who had left their open IP cameras unprotected. Most people we spoke to were unaware of the technology used to monitor their societies (The cameras are installed by third parties and hence, people don’t know if the feed is secure or not). 

Few people were aware of the type of cameras used, IP cameras, and they were aware that the feeds were unprotected. When asked why they weren't concerned about it, they mentioned that it was convenient to access the feed from anywhere and they felt like no one would be watching them anyway.

This lack of awareness reinforces our thoughts that, for people to be concerned about their privacy, they first have to experience some adversity.

Proposed Solutions

In order to tackle the issue of public access cameras, there are many plausible
solutions that can be taken at an individual, societal or even at the government
level:
  1. Create surveillance camera regulation - The government must come up with regulations for surveillance cameras to ensure the privacy of its citizens. Telangana state has taken steps forward in this matter with the Nenu Saitham policy which other states could use as a blueprint
  2. Camera companies add security - IP Security cameras come out of the box with either no password protection whatsoever or something like an 'admin'/'admin' password setup. To ensure security, camera companies could enforce customers to change their default login settings before being able to access the camera.
  3. Individuals ensure privacy - Most individuals who are aware that their video feed is visible to a large population would probably change their settings and make the feed private. If we educate individuals on the perils of public IP cameras then we can definitely reduce the privacy implications of these cameras.

Conclusion

The rapid growth of the surveillance camera industry indicates that more individuals worldwide are concerned about their safety and want to set up preventive measures to deter any miscreants. In this frenzy to protect themselves, privacy is often forgotten and might even pose a bigger risk than criminal activities themselves as we indicated through our study. If criminals start utilizing publicly accessible cameras and allocate more resources than we did towards data collection and processing, our privacy, society and even government is at risk.

We believe that educating individuals will curb this problem to a large extent from what we understood from the survey, as many people are unaware that there are publicly visible cameras around them and possibly streaming their activities as well. To solve this problem, we require a concentrated effort from the government, law enforcement and individuals across the globe in an attempt to stop the proliferation of publicly accessible security cameras.

Video Presentation

Alternative Drive Link

Team

The following are the members of our team:
  1. Aakash Aanegola - CSE - UG2K19
  2. Adithya Sunil Edakkadan - ECE - UG2K19
  3. Hemant Suresh - ECE - UG2K19
  4. Pavani Chowdary - ECD - UG2K19
  5. Raghav Raj Dwivedi - CSE - UG2K19
  6. Sidharth Giri - CSE - UG2K19




Comments

Post a Comment

Popular posts from this blog

Applications of NLP in Privacy Policies

Image
  Photo by Marija Zaric on Unsplash How many privacy policies have you accepted without knowing what the policy states? We're guessing that number is probably pretty high. And you are not alone. A  survey  of 2100 individuals conducted reported that 87% of individuals accept policies without reading them. Common reasons for this included the length and general readability of the policies. Of the top 500 websites, the average reading score was comparable to that of a high school student , while the average reading level of US adults is that of the 7th grade. Luckily, Natural Language Processing (NLP) can help. For our project, we set out to detect the readability of current privacy policies (spoiler alert: you'd need to have at least completed high school to make sense of what you agree to). We also wanted to see how we could make the readability of the policies better. So what did we do with the privacy policies? We used privacy policies from the  OPP-115 Corpus ...
Read more

"TL;DR: No more an excuse!": On making privacy policies easier to read and interpret

Image
Introduction Many websites collect, share, and use users’ Personally Identiļ¬able Information (PII). Many regulatory bodies around the globe have long enforced requirements on posting privacy policies online. Over the past few decades, however, the collection, sharing, and usage of users' PII have risen to a major privacy concern over the internet, so much so that newer laws have gone into effect to protect user privacy. Prominent examples of such laws are the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States. Research has shown, time and again, that privacy policies are too long and hard to comprehend for their intended users, and therefore users rarely take the time and effort to read them. Privacy Policies are getting longer over time and increasingly difficult to read. To address the poor readability of privacy policies, we have developed tools that leverage machine learning (ML) to automatically s...
Read more

SiPP - Simple Privacy Policy

Image
SiPP: Simple Privacy Policy     SiPP Introduction Privacy Policies are legal documents that are long and complex that enable the initiated to select their preferences and cripple the uninitiated into opting in by default into the conditions by the organizations to utilize their service.  In today's world, technology is an integral and influential part of most lives. While technology provides services, and to provide services, user-specific data that can be interpreted into information is crucial. Privacy policies are the means to collecting this data legally while providing services and monetizing the same for other incentives. [Trivia: in 2017, data became more valuable than Oil] For generalizing the privacy policies, universal guidelines are established.  FTC Privacy Principles OECD Principles Fair Information Practice Principles We introduce SiPP, Simple Privacy Policy, that enables you to take smaller bites into the privacy policies with ease by selecting cat...
Read more