Outsourcing the Surveillance State - Home Security Camera Edition

The "Really Big Important American Football Game" just finished, and while there may have been some, ah, polarizing politics at play, I think one of the most disturbing messages may have flown under the radar - a message delivered by one of the ads.

Search Party - Find Your Lost Pet

It sounds great, doesn't it? "More than on pet per day has been returned" per the ad. Laudable goal, and I'm sure that across the nation there being at least 366 families each year who are reunited with their pets are quite happy. (that's as many as it takes to be able to claim more than one per day) I know there are a couple times I was worried that my dog had been lost, and I might have appreciated such a capability.

But there's a lot going on in order to make that work, and every single bit of it has privacy implications that you need to be aware of as the ad - and indeed the concept itself - does a great job of downplaying these implications.

Let's put this another way: do you believe there have been more or less than 366 personal privacy violations from this self same system per year? The rest of this post will be a consideration of those privacy concerns and what we can do to still have home security cameras that we trust without participating in an outsourced mass surveillance system.

Cloud Based Home Security Camera Storage

So That's Somebody You Don't Know Accessing Your Recordings

Let's start with the basics. In order for this system to work, your camera recordings have to be stored and viewed by the company behind this technology. Read that again. Stored. Viewed. By somebody who isn't you. By somebody you have no relationship with. By somebody you have no control over. That is a concept that is the antithesis of privacy - somebody you don't have any personal relationship with has access to all the video (and audio!) recordings made from your cameras.

But that's OK, because you don't do anything outside that you wouldn't want shared with strangers, right? You don't have any indoor cameras, right? You don't have anything to hide, right?

But that's OK because you're sure the EULA you didn't read protects you, right?

But that's OK because you clicked the "opt out" button. You think. Probably. Didn't you?

Perhaps that's not a deal breaker for you. Perhaps you are comfortable with Amazon (Ring) or Google (Nest) having access to all your recordings - or at least just the "outdoor" cameras, as if there's some inherent difference in the way they store and access different cameras you've got. That's up to you, after all we all have different privacy risk tolerances.

Law Enforcement Access To Your Recordings

One truth that we don't pay enough attention to in the US is that the companies that run consumer cloud services must comply with US law. Not only that, many of them want to curry favor with federal and state government, after all the same companies that run these cameras have lucrative contracts with those same government bodies. That means two things:

1. These companies are required to comply with appropriate warrants and subpoenas. That means they have to turn over recordings they have in their possession if they are appropriately compelled to. It also happens that in at least some cases - if not many - they can be prevented by that same legal order not to inform you that the data has been shared.
2. These companies may have chosen to stop vetting access requests from law enforcement and may simply be providing carte blanche access to local, state, and federal agents. Let's face it, validating that a warrant or subpoena is valid costs time and money, and being seen as uncooperative can impact current and future business with these government entities. There are no effective laws in the US that prevent companies from turning over data about you to government agencies, and in fact in many cases companies actually sell personal data to these agencies. This is a truck-sized loophole in the 4th amendment, but we'll leave that for another time. At the end of the day it is lest costly and easier to simply amend the user agreement you have with them - after all, you can't decline the changes and keep using the system - so that the company can share anything and everything with government agencies without informing you, even if there is no valid warrant or subpoena.

Now at this time there are significant data transfer and computational issues preventing law enforcement/government monitoring 24x7 of every camera that is a part of one of these cloud environments, but at some point that technical hurdle will vanish.

Are you still good with that cloud-stored camera solution?

Facial Recognition and AI Review

One of the features of a solution like this is letting AI scan the content for potential matches. The ad itself mentions this, that in the case of the missing pet local outdoor camera footage is reviewed by AI for a match with the missing pet. If there's a hit then the owner of that camera is asked if they want to share information with you as you look for your pet. But that seems to be past the point of permission - the AI has already reviewed your recordings and is now asking if the content can be shared. I don't know if there's a permission that would prevent the AI from even checking your recordings.

This kind of AI review is the same basic solution used to do facial recognition. The unspoken part of this is that these companies have AI which is capable of performing facial recognition on your recordings. Put another way: they aren't waiting for law enforcement to use their facial recognition programs when they request recordings, these companies are building their own. What transparency do you have into what they're doing with that data? Are you comfortable that they aren't selling your position based on facial recognition to data aggregators and/or anybody who pays them?

Feel your privacy bubble bursting yet? Is that worth helping between 366 and 547 families recover a pet each year? (if more than 547 pets were returned each year with this solution the ad would have rounded up to 2 families/pets per day)

The Impact On Your Friends and Neighbors

Lost in all of this is the 3rd party impact that your cameras have on your friends, neighbors, or even those people you rent your home to as a vacation rental. It goes without saying that your camera doesn't stop recording when somebody besides you comes within view - on the contrary, those are the very people we're most interested in recording. That means our friends, family, and neighbors are all on camera whenever they're within the field of our cameras' vision. Surely we have some level of responsibility for their privacy expectations as good friends and neighbors, don't we? Let's also be clear, while there are a great many protections for you, the camera operator, when you're recording a public place, what about cameras that are recording private areas? Your back yard with the privacy fence? Indoor spaces? Places where your friends/neighbors/customers would have an expectation of privacy? What happens when their images are somehow shared in those cases? Are you interested in going to court in order to find out?

Alternatives For People Who Want Cameras

I get it, many of us want the security and convenience features of cameras, but we don't want the privacy issues that the big cloud-based solutions create. I'm one of these people - and I'm a happy camera owner. As I see it, there are three basic alternatives for those of us in this position:

Old School Closed Circuit Cameras

These are the systems that have been around for more than 50 years. They've graduated from VHS tape to DVD to HDD and SSD drives. The cameras are all wired via a coaxial cable, and all terminate at a device purpose-built for recording and playing back video recordings. This is a very private solution.

The drawback to these systems is that they're least likely to be able to alert you to events, or to do any computer-based analysis of the recordings to make it easier to find items and events in the recordings. These also don't generally have a doorbell camera integration.

As far as level of difficulty to deploy and run, the biggest issue is cabling to each camera.

Home Brew IP Camera System

On the other end of the spectrum is the "build your own" solution. Those of us who are Raspberry Pi aficionados might choose this sort of route. There are open-source IP camera solutions out there such as ZoneMinder, and there are IP cameras both wired and wireless galore.

These systems are highly customizable, and can meet most of your expected use-cases, but again you're less likely to find a doorbell/camera integration. You're also going to have to do all the heavy lifting to install, configure, and maintain the system, which may not be all that easy. You're also going to have to secure your own remote access connectivity in order to have access to view videos from outside your local network.

Commercially Available Non-Cloud IP Camera Systems

Now that we've had too-cold porridge and too-hot porridge, this is likely the Goldilocks solution for most of us. Companies like Ubiquity have fully supported IP camera environments that record locally to a local controller but can be made available via a secured network connection. These sorts of solutions have feature parity with the cloud-based camera systems - including doorbell cameras - but because there is no cloud storage of your content there is minimal concern about 3rd parties, including government resources, accessing your data without your approval or at least knowledge.

These are likely the most costly to set up, but their ongoing value quickly shows itself in both capabilities and privacy.

General Camera Recommendations

Beyond avoiding cloud-based camera solutions, I have several recommendations to assist you in making best use of your cameras:

• Do not use network connected cameras inside your home. We all do things in the privacy of our own homes that we don't necessarily want the public at large to potentially see or hear. Stick to using cameras with outdoor views - whether you mount them inside or not.
• Use lights - infrared or otherwise - to improve nighttime visibility. Doorbell cameras are especially likely to have very limited range and resolution if they're left to their own illumination sources in the dark. Infrared lights have the benefit of not causing visible light pollution at night, which can be appreciated by your neighbors while still providing very good black-and-white resolution at night.
• Mount cameras to focus on areas of ingress - doors and first floor windows. A wall with no windows or doors is far less likely to be a wall that miscreants bother with than one that has some. If costs are a consideration you can avoid the expense of monitoring an unimportant area.
• Tune alerts to your mobile app so you aren't getting alerts every time someone walks by on the sidewalk, but you do get them when they approach your door. Just like the boy who cried wolf, you'll start ignoring your camera app if it is too sensitive.
• When an event occurs that you are concerned by, know how to quickly make an off-site backup of the content so that if the original is damaged or made unavailable you have a copy to share with the authorities.

I realize that this advice may mean that up to 500 pets a year aren't recovered as quickly as they could be if you have a cloud-based camera solution, but I'm comfortable suggesting that the privacy you give up in order to reunite those pets with their families isn't worth it.