By Claire Chow

Hong Kong, 22 March 2023: So-called smart homes have become increasingly popular in recent years, with many households installing surveillance cameras that allow the user to check what is happening at their residence, via mobile phone, while they are out and about. Such devices, which have the capacity to record, are seen as a cost-effective and efficient method of enhancing home security.

But smart homes also carry an element of risk, especially if such devices are not manufactured to meet stringent cyber security and data protection standards. This has been borne out by a Consumer Council investigation which found nine out of ten home surveillance cameras being sold in Hong Kong failed to meet the global requirements laid down by the European Telecommunications Standards Institute. The report shines a light not only on product deficiencies, but also the need for a proper regulatory regime.

The cameras – priced between HK$269 and HK$1,888 – all provided two-way audio, motion detection, night vision and voice control. The Consumer Council commissioned an independent laboratory to test them, with sobering results. It found many of the devices were at the mercy of hackers, transmitted information without encryption and suffered from inadequate data storage security.

Four of the cameras had weak log-in security. Of these, three were susceptible to “brute-force attacks”, a method by which hackers find a password through automated trial and error, with two of the models using only six digits or characters for the default password. The fourth camera allowed unlimited login attempts while the mobile app was in use, so hackers could repeatedly try to steal account information.

The tests also revealed five of the cameras transmitted videos or data without encryption. Of these, four did not encrypt data when sending real-time images, making them vulnerable to hackers who could easily access the video content. The fifth model failed to utilise encrypted transmission when connecting to home Wi-fi, making it more straightforward for hackers to steal account information from the router.

In some instances, there was also an issue with the so-called session key. This is effectively a temporary password, used for encryption and decryption when transmitting data, which should expire each time the user logs out. But three cameras allowed the user to log back in with the old session key. If a hacker stole this code, they could easily pry into someone’s room.

The security of in-app data storage for all ten models was inadequate, the tests revealed. For example, sensitive data such as email addresses, account IDs or passwords were stored in plain text files, which were not protected with encryption, and the relevant data would only be deleted after a certain period.

The Consumer Council also highlighted ethical concerns. It pointed out that all members of the household, including domestic workers, and all visitors should be made aware of the presence of home surveillance cameras. Consideration should be given to the necessity of monitoring, the availability of less privacy-intrusive alternatives, and the proper handling of recorded content.

While calling on manufacturers to take “immediate action” to improve their products, the Consumer Council has also published a security checklist for users which includes the following:

• Avoid purchasing products without a brand name or from unknown sources;
• Set a strong password when creating an account and change it regularly;
• Open the app and activate the camera only when necessary, otherwise keep it turned off;
• Make good use of functions such as firewalls, network monitoring and activity logs.

Home surveillance cameras are typical Internet of Things (IoT) devices – a term referring to gadgets beyond computers and smartphones that connect wirelessly to a network and have the ability to transmit data. It is estimated there will be some 50 billion IoT devices in use around the world by 2030.

Countries such as Singapore, Germany, Finland and the US have already introduced cyber security labelling for IoT devices. Under such schemes, smart devices are rated according to their levels of cyber security, thus enabling consumers to make better informed decisions when purchasing. The EU has added network and communications security requirements to its Radio Equipment Directive which will become mandatory in August 2024, while the UK is studying to introduce legislation.

The Consumer Council concludes its investigation by recommending the government makes reference to practices in other jurisdictions and introduces relevant schemes or standards suitable for Hong Kong. Until then, citizens are advised to exercise caution when installing and using home surveillance devices.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Civil and Commercial Litigation, and Judicial Review. She can be contacted at Claire@boasecohencollins.com.