Skip to content

Something urgent? Call us now! (852) 3416 1711

When home security is not so smart

By Claire Chow

Hong Kong, 22 March 2023: So-called smart homes have become increasingly popular in recent years, with many households installing surveillance cameras that allow the user to check what is happening at their residence, via mobile phone, while they are out and about. Such devices, which have the capacity to record, are seen as a cost-effective and efficient method of enhancing home security.

But smart homes also carry an element of risk, especially if such devices are not manufactured to meet stringent cyber security and data protection standards. This has been borne out by a Consumer Council investigation which found nine out of ten home surveillance cameras being sold in Hong Kong failed to meet the global requirements laid down by the European Telecommunications Standards Institute. The report shines a light not only on product deficiencies, but also the need for a proper regulatory regime.

The cameras – priced between HK$269 and HK$1,888 – all provided two-way audio, motion detection, night vision and voice control. The Consumer Council commissioned an independent laboratory to test them, with sobering results. It found many of the devices were at the mercy of hackers, transmitted information without encryption and suffered from inadequate data storage security.

Four of the cameras had weak log-in security. Of these, three were susceptible to “brute-force attacks”, a method by which hackers find a password through automated trial and error, with two of the models using only six digits or characters for the default password. The fourth camera allowed unlimited login attempts while the mobile app was in use, so hackers could repeatedly try to steal account information.

The tests also revealed five of the cameras transmitted videos or data without encryption. Of these, four did not encrypt data when sending real-time images, making them vulnerable to hackers who could easily access the video content. The fifth model failed to utilise encrypted transmission when connecting to home Wi-fi, making it more straightforward for hackers to steal account information from the router.

In some instances, there was also an issue with the so-called session key. This is effectively a temporary password, used for encryption and decryption when transmitting data, which should expire each time the user logs out. But three cameras allowed the user to log back in with the old session key. If a hacker stole this code, they could easily pry into someone’s room.

The security of in-app data storage for all ten models was inadequate, the tests revealed. For example, sensitive data such as email addresses, account IDs or passwords were stored in plain text files, which were not protected with encryption, and the relevant data would only be deleted after a certain period.

The Consumer Council also highlighted ethical concerns. It pointed out that all members of the household, including domestic workers, and all visitors should be made aware of the presence of home surveillance cameras. Consideration should be given to the necessity of monitoring, the availability of less privacy-intrusive alternatives, and the proper handling of recorded content.

While calling on manufacturers to take “immediate action” to improve their products, the Consumer Council has also published a security checklist for users which includes the following:

  • Avoid purchasing products without a brand name or from unknown sources;
  • Set a strong password when creating an account and change it regularly;
  • Open the app and activate the camera only when necessary, otherwise keep it turned off;
  • Make good use of functions such as firewalls, network monitoring and activity logs.

Home surveillance cameras are typical Internet of Things (IoT) devices – a term referring to gadgets beyond computers and smartphones that connect wirelessly to a network and have the ability to transmit data. It is estimated there will be some 50 billion IoT devices in use around the world by 2030.

Countries such as Singapore, Germany, Finland and the US have already introduced cyber security labelling for IoT devices. Under such schemes, smart devices are rated according to their levels of cyber security, thus enabling consumers to make better informed decisions when purchasing. The EU has added network and communications security requirements to its Radio Equipment Directive which will become mandatory in August 2024, while the UK is studying to introduce legislation.

The Consumer Council concludes its investigation by recommending the government makes reference to practices in other jurisdictions and introduces relevant schemes or standards suitable for Hong Kong. Until then, citizens are advised to exercise caution when installing and using home surveillance devices.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Civil and Commercial Litigation, and Judicial Review. She can be contacted at Claire@boasecohencollins.com.

37+ years of legal experience is just a click away.

Friendly and approachable, we are ready to answer your questions and offer you sound advice.

Contact us now

BC&C-contact-us

News & Knowledge

Learn more about what we do and what we say. Subscribe to our newsletter to ensure you receive our updates.

  • This field is for validation purposes and should be left unchanged.

Enduring our trails and tribulations

Hong Kong, 24 May 2023: Hiking with the Stumblers is a leisurely activity. The challenging terrain of Hong Kong’s country parks, coupled with aging limbs and much chatter, means we advance at modest speed, admiring the scenery and stopping for regular rests. Inevitably, we are occasionally required to step aside as some energetic young pups […]

Read more

Law & More: Episode 26 – Grenville Cross

Hong Kong, 22 May 2023: In the latest episode of Law & More, we meet Grenville Cross, Hong Kong’s first post-handover Director of Public Prosecutions. Among many topics, Grenville discusses his early days as a Crown Prosecutor, his distinguished 30-year career in public office and some of the notable cases he handled. He speaks with […]

Read more

Showcasing HK’s political diversity

Hong Kong, 10 May 2023: The Romer’s tree frog is a rare species, native to Hong Kong. This tiny amphibian, first discovered on Lamma Island in 1952 by naturalist John Romer, mainly inhabits wooded areas near streams. Such is the tree frog’s ecological importance, one of its major habitats, Ngong Ping, is designated as a […]

Read more

‘Letters of no consent’ affirmed

By Alex Liu Hong Kong, 5 May 2023: In a significant judgment, the Court of Appeal has overturned a lower court’s ruling that the long-established use of “letters of no consent” from the police to effectively freeze suspicious bank accounts was unlawful. In considering the matter of Tam Sze Leung & Others v Commissioner of […]

Read more

Mental health, a workplace issue

By Arthur Chan Hong Kong, 3 May 2023: A study by the Equal Opportunities Commission (EOC) has revealed high levels of workplace discrimination against employees with mental health issues. Further, many such individuals are reluctant to speak out about their unfair treatment, even though they know they are protected by anti-discrimination legislation. The EOC’s report, […]

Read more