Marcella Riley, 29, was having a hard time last summer. After moving to L.A. from New York, the¬†aspiring comedian wasn't¬†making enough money to pay rent, and¬†so was surfing friends' couches. In June, a¬†friend named Conor ‚ÄĒwhom she'd met years earlier when they worked together¬†at an Apple Store‚ÄĒoffered the couch in his living room indefinitely.¬†She was incredibly grateful. But a month into her couch tenancy, her gratitude turned to anger when she spotted a small black device taped to a¬†bookshelf¬†facing the couch. It was a camera made by Dropcam; the light that¬†indicated when it¬†was turned on had been¬†covered with black electrical tape. Riley¬†was horrified.

Photo Riley took of the hidden cam

Advertisement

Photo Riley took of the camera she found

Riley looked up the device online, and discovered that¬†Dropcam, a start-up purchased by Google-owned Nest for $517 million last¬†summer, made¬†simple home surveillance systems. "Even when you're miles away, keep an eye on your home, kids and mischievous pets in beautiful HD," says its website, which noted¬†that the $199 camera had motion-detection, night-vision for¬†"a clear view in¬†low‚ÄĎlight¬†conditions," and the ability to upload its recordings to the cloud. Beyond¬†revulsion¬†at the idea of being secretly watched, Riley realized that the camera may¬†have caught her doing all of those things we do when we think we are alone, including changing her clothes.

Advertisement

When Riley confronted Conor about the camera via text message, he claimed it had been there for a year and was broken. But she discovered a receipt that revealed it had been purchased just three weeks earlier. She called the police, but they told her they couldn't do anything. "They said it's legal for someone to have a camera in their home and record what they want without telling anyone, as long as it's not in a private space like a bathroom," she recalls.

Unbeknownst to her, Riley had stumbled into one of the thornier privacy issues raised by the growth of Airbnb, Couchsurfing, and other home-sharing services, which have us sleeping in other people's houses more often than ever before. The rise of cheap, easy-to-install security¬†cameras has given peace of mind to¬†many homeowners in these situations. But people installing cameras in their homes‚ÄĒeven if for non-creepy reasons‚ÄĒcan run into unanticipated legal problems, from inadvertently breaking state and federal privacy laws by recording visitors without their knowledge to capturing footage that could come back to haunt camera owners. (Literally.)¬†Last month, Dropcam was involved in another surreptitious spying episode when Airbnb guests discovered three Dropcams¬†hidden in the¬†apartment they had rented from a Canadian host.

You're allowed to record yourself in your own home, of course. But when others share your space, the legal issues get murkier. "I would be shocked to learn that there’s a bright line where you can spy on anyone you want in your own home," says Paul Ohm, a privacy scholar at the University of Colorado-Boulder Law School. "There's still a reasonable expectation of privacy if you're crashing on someone's couch," said Ohm. "Even if it’s his house, you would expect privacy when he’s away if you're not informed about a camera."

Advertisement

Ohm said the most relevant law¬†is¬†the Wiretap Act, because Dropcams‚ÄĒthe top-selling camera on Amazon‚ÄĒcapture not just video but audio. The anti-eavesdropping law poses¬†a problem for¬†anyone with a Dropcam or audio monitoring system in their home if they are¬†taping guests or nannies without giving them a heads-up.¬†"You can't bug a room if someone should have an expectation of privacy," said Ohm. "If the camera isn't visible and visitors¬†are not warned, there's potential criminal and civil liability."

It's not just a problem for guests; the cams can also invade their owners' privacy. What's captured by an in-home camera's all-seeing eye could be simply blush-inducing, as when a Dropcam e-mailed Metafilter founder Matt Haughey a nude photo of himself. (Yes, the Internet of Things can sext.) Haughey still has the Dropcam in his home, but says by email that he "has a general sense of unease about it now."

But there are more serious dangers, too. For one,¬†a home¬†monitoring system could supply¬†evidence to be used against its owner¬†in a court of law. Take tech executive¬†Gurbaksh Chahal, who had¬†cameras throughout his home in San Francisco‚ÄĒincluding two in his bedroom. Last year, prosecutors used video from the cameras of Chahal¬†beating his girlfriend¬†to pursue a domestic violence case against him. Chahal ultimately pled guilty to misdemeanor battery, and was sentenced to three years probation and community service.

Advertisement

Surprisingly, Dropcam's privacy policy doesn't warn customers that the government could seize the cloud-based video from their cameras or tap into their live-streams, and doesn't state under which circumstances the company would comply with such a request. (Update: And law enforcement has come calling with warrants.) An oblique reference in the Dropcam privacy policy says, "We may release Personal Information when we believe in good faith that release is necessary to comply with that law." A slightly more explicit nod to this possibility can be found on Dropcam's security page, where it states that "a very select number of employees (senior engineering leadership) have the ability to access video data only when legally required."

Ohm was surprised by this. "They could encrypt people's video feeds so that the company could never look at them. Why would they build a backdoor?" said Ohm, who called the nature of the disclosure "bad lawyering." He added: "From a legal point of view, this should be in the privacy policy, not buried in the security policy."

Ohm speculated that Dropcam may have left access available to its employees so they could troubleshoot customers' technical problems, or worse, that the company plans to monetize the video streams in some way. In Google's 2014 annual report, it said that it plans to "innovate upon devices in the home, making them more useful, intuitive, and thoughtful," and that Dropcam parent company Nest "expects to continue to reinvent products that will help shape the future of the connected home." Hopefully, the future of Google's connected home will, at least, involve being included in the company's transparency report, which reveals how often law enforcement seeks information about users of its products.

Advertisement

Riley, who remained in Conor's apartment for another (awkward) month after discovering the hidden bookshelf camera, says she feels psychologically scarred by the episode, and that she worries about being surreptitiously taped in private spaces now. While Conor hasn't suffered any legal consequences, Riley wrote a blog post about what happened, which includes Conor's full name and is steadily making its way to the front page of his Google results. Commenters on the post disagreed about whether Conor was a spying creep, or justified in his surveillance because it was his home. A commenter on Conor's side wrote, "As someone with Dropcam in my home, I don't tell my friends I have it when they house sit." Conor did not respond to messages about the incident.

Ohm says it would be better if the Dropcam wasn't so easily hidden, and if it emitted a noise when recording rather than just turning on a light that can be covered up.

"Eventually these cameras are going to get smaller and then it’ll be really concerning," said Ohm. "I don’t think it’s a net benefit for society that cameras are getting smaller and easier to use. Inevitably, they are going to wind up in the wrong hands."