Beware, houseguests: Cheap home surveillance cameras are everywhere now

Marcella Riley, 29, was having a hard time last summer. After moving to L.A. from New York, the aspiring comedian wasn’t making enough money to pay rent, and so was surfing friends’ couches. In June, a friend named Conor —whom she’d met years earlier when they worked together at an Apple Store—offered the couch in his living room indefinitely. She was incredibly grateful. But a month into her couch tenancy, her gratitude turned to anger when she spotted a small black device taped to a bookshelf facing the couch. It was a camera made by Dropcam; the light that indicated when it was turned on had been covered with black electrical tape. Riley was horrified.

Riley looked up the device online, and discovered that Dropcam, a start-up purchased by Google-owned Nest for $517 million last summer, made simple home surveillance systems. “Even when you’re miles away, keep an eye on your home, kids and mischievous pets in beautiful HD,” says its website, which noted that the $199 camera had motion-detection, night-vision for “a clear view in low‑light conditions,” and the ability to upload its recordings to the cloud. Beyond revulsion at the idea of being secretly watched, Riley realized that the camera may have caught her doing all of those things we do when we think we are alone, including changing her clothes.

When Riley confronted Conor about the camera via text message, he claimed it had been there for a year and was broken. But she discovered a receipt that revealed it had been purchased just three weeks earlier. She called the police, but they told her they couldn’t do anything. “They said it’s legal for someone to have a camera in their home and record what they want without telling anyone, as long as it’s not in a private space like a bathroom,” she recalls.

Unbeknownst to her, Riley had stumbled into one of the thornier privacy issues raised by the growth of Airbnb, Couchsurfing, and other home-sharing services, which have us sleeping in other people’s houses more often than ever before. The rise of cheap, easy-to-install security cameras has given peace of mind to many homeowners in these situations. But people installing cameras in their homes—even if for non-creepy reasons—can run into unanticipated legal problems, from inadvertently breaking state and federal privacy laws by recording visitors without their knowledge to capturing footage that could come back to haunt camera owners. (Literally.) Last month, Dropcam was involved in another surreptitious spying episode when Airbnb guests discovered three Dropcams hidden in the apartment they had rented from a Canadian host.

You’re allowed to record yourself in your own home, of course. But when others share your space, the legal issues get murkier. “I would be shocked to learn that there’s a bright line where you can spy on anyone you want in your own home,” says Paul Ohm, a privacy scholar at the University of Colorado-Boulder Law School. “There’s still a reasonable expectation of privacy if you’re crashing on someone’s couch,” said Ohm. “Even if it’s his house, you would expect privacy when he’s away if you’re not informed about a camera.”

Ohm said the most relevant law is the Wiretap Act, because Dropcams—the top-selling camera on Amazon—capture not just video but audio. The anti-eavesdropping law poses a problem for anyone with a Dropcam or audio monitoring system in their home if they are taping guests or nannies without giving them a heads-up. “You can’t bug a room if someone should have an expectation of privacy,” said Ohm. “If the camera isn’t visible and visitors are not warned, there’s potential criminal and civil liability.”

It’s not just a problem for guests; the cams can also invade their owners’ privacy. What’s captured by an in-home camera’s all-seeing eye could be simply blush-inducing, as when a Dropcam e-mailed Metafilter founder Matt Haughey a nude photo of himself. (Yes, the Internet of Things can sext.) Haughey still has the Dropcam in his home, but says by email that he “has a general sense of unease about it now.”

But there are more serious dangers, too. For one, a home monitoring system could supply evidence to be used against its owner in a court of law. Take tech executive Gurbaksh Chahal, who had cameras throughout his home in San Francisco—including two in his bedroom. Last year, prosecutors used video from the cameras of Chahal beating his girlfriend to pursue a domestic violence case against him. Chahal ultimately pled guilty to misdemeanor battery, and was sentenced to three years probation and community service.

Surprisingly, Dropcam’s privacy policy doesn’t warn customers that the government could seize the cloud-based video from their cameras or tap into their live-streams, and doesn’t state under which circumstances the company would comply with such a request. (Update: And law enforcement has come calling with warrants.) An oblique reference in the Dropcam privacy policy says, “We may release Personal Information when we believe in good faith that release is necessary to comply with that law.” A slightly more explicit nod to this possibility can be found on Dropcam’s security page, where it states that “a very select number of employees (senior engineering leadership) have the ability to access video data only when legally required.”

Ohm was surprised by this. “They could encrypt people’s video feeds so that the company could never look at them. Why would they build a backdoor?” said Ohm, who called the nature of the disclosure “bad lawyering.” He added: “From a legal point of view, this should be in the privacy policy, not buried in the security policy.”

Ohm speculated that Dropcam may have left access available to its employees so they could troubleshoot customers’ technical problems, or worse, that the company plans to monetize the video streams in some way. In Google’s 2014 annual report, it said that it plans to “innovate upon devices in the home, making them more useful, intuitive, and thoughtful,” and that Dropcam parent company Nest “expects to continue to reinvent products that will help shape the future of the connected home.” Hopefully, the future of Google’s connected home will, at least, involve being included in the company’s transparency report, which reveals how often law enforcement seeks information about users of its products.

Riley, who remained in Conor’s apartment for another (awkward) month after discovering the hidden bookshelf camera, says she feels psychologically scarred by the episode, and that she worries about being surreptitiously taped in private spaces now. While Conor hasn’t suffered any legal consequences, Riley wrote a blog post about what happened, which includes Conor’s full name and is steadily making its way to the front page of his Google results. Commenters on the post disagreed about whether Conor was a spying creep, or justified in his surveillance because it was his home. A commenter on Conor’s side wrote, “As someone with Dropcam in my home, I don’t tell my friends I have it when they house sit.” Conor did not respond to messages about the incident.

Ohm says it would be better if the Dropcam wasn’t so easily hidden, and if it emitted a noise when recording rather than just turning on a light that can be covered up.

“Eventually these cameras are going to get smaller and then it’ll be really concerning,” said Ohm. “I don’t think it’s a net benefit for society that cameras are getting smaller and easier to use. Inevitably, they are going to wind up in the wrong hands.”