Transcription
A security camera captures a burglar breaking into a Kansas City home and stealing valuables. They were proactive because they installed these cameras, which will help police identify who did this. The FBI estimates that in 2019, in the US, there was a burglary every 28 seconds. And there are studies that show that as many as 60% of burglars would be deterred from breaking and entering if there were an alarm system. So, adding a security system to your home might not be a bad idea.
But what kind of security system? And are there any that are truly secure and privacy-preserving? In this video, we’ll dive into some different home camera setups. There are already plenty of videos out there that compare technical features of cameras, like night vision quality, field of view, battery life, etc. We’re not going to go into that. We’re going to compare how private each one is. And unfortunately, privacy doesn’t seem to be a focus for most home security companies.
Let’s first take a moment to go over some definitions you’ll need to understand when choosing a product. Classic CCTV, which stands for Closed-Circuit Television, uses analog cameras that need to be hardwired in. The footage is converted to a digital format on a central processing unit called a DVR, or Digital Video Recorder. It’s similar to how your home DVR would record TV shows off of cable and digitize them, only it's with cameras instead of shows.
More recently, NVR, which stands for Network Video Recorder, made security systems easier to manage thanks to network standardization, and also allowed for better cameras. With these cameras, the footage is already in a digital format, and this setup requires what’s called an NVR system, which is basically a computer that needs to be running at all times in your house, that acts as a hard drive for your footage and allows you to manage this network of cameras.
We now have IP-Based Cameras, which can be wired or wireless devices. A quick note about the difference there: wireless cameras can be jammed more easily than wired cameras, but wireless cameras are also a lot easier to install. So whichever you choose will have to depend on your own threat model. Now, IP cameras first came onto the market about a decade ago, starting with smart doorbells, and from there, consumer-grade, cloud-hosted security cameras really took off. Users no longer had to worry about maintaining an NVR system themselves; they could instead use one in the cloud, maintained by someone else.
So now that we understand some of the options out there, let’s dive into specific products, starting with the most common home security system provider in the United States, which is ADT.
"I can pick most locks with a credit card."
When trouble strikes, ADT can take action. ADT is an alarm system company that historically offered all kinds of sensors for your home. More recently, they expanded into home cameras, offering IP, or internet-based cameras that store footage in the cloud. They make their money by monitoring your home 24/7 for any issues, and informing the appropriate emergency services when needed.
But there are many reports of this home monitoring being abused: Last year, an ADT technician was charged with watching female clients on camera in their homes for sexual gratification. “Home monitoring” suddenly becomes a lot creepier when you add video footage to the mix. ADT released a statement on this event, but did not mention any technical fixes for this problem, only personnel ones. Which made us wonder, how, if at all, is ADT actually protecting your private footage from employees being able to see it?
Normally, this would be done with end-to-end encryption, which means that you would be in control of your footage and no rogue employee would be able to access it. We reached out to them, and ADT confirmed that their new cloud product, Control, doesn't have end-to-end encryption. There are certainly benefits to having your home monitored, but allowing a company to watch your home video footage should be a major red flag.
Another red flag is that ADT has a partnership with Google, and use Nest, a Google product, in their surveillance setups. You know Google? That company that loves to take every piece of data they can find about you and repackage it for advertisers. Google owns 6% of ADT, and they just added another $150 million investment. (“...the company will also receive another $150 million for product development from existing investor Google, the Alphabet Inc.-owned (GOOGL.O) search giant that took a 6% stake in ADT in 2020.”) That’s a partnership that doesn’t motivate me to buy their products. We'll dive into Nest in a moment, but as far as ADT goes, if it’s privacy you’re looking for, you should look elsewhere.
Let’s move on to Ring. Ring is the most popular camera doorbell system on the market. They’re owned by Amazon, and your footage is hosted in the cloud; and there are some big problems with Ring when it comes to privacy and security, and in a recent video, we did a deep dive into some of them. For a quick recap, they share a lot of data with third parties, have a history of being hacked, and have admitted to sharing user footage with law enforcement, without a warrant and without user knowledge.
One upside of Ring is that they now offer end-to-end encryption for their footage. It’s not on by default, and opting in will disable many features of your Ring system, like Alexa integration, desktop app video viewing, and the ability to see camera previews, share videos or links, or see the Event Timeline. But protecting footage with end-to-end encryption is super important if its being stored in the cloud, so this move from Amazon is a good start. If you want an in-depth overview of Ring systems, check out our video, but our takeaway is that, although Ring is moving in the right direction with privacy, Amazon just isn’t a company we trust enough to suggest you put their cameras and microphones around your home.
So what are some other options? Another very popular home camera option is Nest, and as we mentioned earlier, this is the camera system that ADT is currently pushing everyone to install. They’re owned by Google, the digital vampire data collector. They also store your footage in the cloud, and they don’t offer end-to-end encryption at all for that footage, which means they have access to it. We know that Google has no qualms handing over your footage when requested, but I would presume they’re handing over a lot more than we realize. With no way to keep your footage private, we can’t recommend Nest cameras.
Next, let’s look at Eufy. On the surface, things look promising. The video processing is done locally, meaning that pet detection and triggers all happen on the device itself. They say no video footage is sent to the cloud, and that instead, your cameras all link to a base station you run in your house. Footage gets saved to a physical SD card inside your base station or camera, and can be accessed remotely with a key that only you control.
So how does this footage become accessible online? This base station also acts as a server. So technically, YOUR footage isn’t being “SENT” to the cloud; you are hosting a cloud yourself. To view your footage remotely, you download the Eufy app, create an account, and connect your server. Now, unfortunately, in 2021, there was a giant breach where people were able to access the servers and cameras in other people’s homes. Eek! They say this was a bug, and that it’s now been fixed.
There’s also an issue with local setups like this, where, if power or internet goes out in your home, your “server” will go offline, and this makes remote viewing impossible. To protect against this scenario, there is an option to sign up for Eufy’s cloud video storage, where your footage is stored both on your local SD card and on their cloud server. But in this scenario, your cloud footage isn’t end-to-end encrypted, so Eufy will have access to it. It is encrypted at rest, according to their website, which is an important part of a secure setup. This means that should a hacker get access to this cloud server, they wouldn’t be able to see any footage without the encryption key. BUT, given the previous bug that allowed other users to access your footage, I’m worried that they don’t protect the keys as well as they should.
Also, Eufy is a Chinese company, and the support documents on their website are vague and very difficult to understand. So we reached out for more clarification about exactly what they have access to and what they store in the cloud. While nothing is saved to the cloud unless the user subscribes to their cloud service, they said that even when not using their cloud service, all remote viewing of events or live video goes through their servers anyway, and is not P2P between the Homebase and the app. In fact, the setup process requires internet access and won’t even start without it. Users can’t see triggered events or saved video unless the camera and phone are connected to the internet, even if they are on the same network. The only thing you can do while on the same network if not connected to the internet is to view the live feed.
First, this means that there is a lot of cloud reliance for this system, and if Eufy discontinued service, whether you’re using their cloud service or not, your system would stop working. Second, it’s a little strange that your base station won’t work unless it’s connected to the internet, even if you’re not using the Eufy app or using the remote viewing features. Why does THE base station need the internet, if the cameras are all connected to the base station via a local network and footage is all stored on a local SD card?
Eufy does have good language on their website around privacy, saying that they don’t collect user data or share with third parties, so that’s a plus. But they also mention that they are able to hand over footage stored on their servers. Without end-to-end encryption for cloud services, and with a local setup that requires data to be sent through their servers anyway, there were some things that gave us pause about this Eufy. We’ll come back to them in a bit, with some ideas for how to potentially make their systems more secure.
Let's go to Reolink. This Hong Kong-based company’s devices seem slightly harder to manage, and harder to set up, but in terms of privacy, there are some ways they might be better than Eufy. Reolink has a wide range of IP cameras and related products. They also sell full IP-based NVR systems that can be set up without any internet access needed. To view your footage, you’ll connect a monitor to your NVR. These setups require you to plug in cameras to a power outlet rather than use battery power, and recording is always on. They’re also compatible with many third-party NVRs, or storage systems, such as Synology, which we’ll dive into in a second.
Reolink impressed us as a local-only security setup, but whether or not you want a local-only setup is another decision you’ll have to make based on your threat model. Is the privacy and security of a local-only camera setup worth it if a criminal just takes the footage with them when they leave? So we only like their offline setup, but one warning: not all of their cameras are compatible with their offline NVR system. With certain battery-powered cameras, the only way you’ll be able to view your footage is through their app and cloud storage setup, which again is not end-to-end encrypted. So choose your cameras wisely.
Let’s move on to Amcrest. We saw no big difference between Reolink and Amcrest, only that Amcrest is based in Texas as opposed to Hong Kong. They also seem like a reasonable choice for a local-only setup, but as with Reolink, don’t use their battery-powered cameras if you want your footage to stay local. They also don’t offer end-to-end encryption for their cloud services. So we can only recommend this system as a local-only option.
There are also a bunch of lesser-known products out there, but none of them inspire confidence. For example, the Haicam E23 Encryption Cam is one of the only cameras we found making the claim of E2EE. But there is shockingly little information available about this system online. It’s unaudited, barely reviewed, and their website does not inspire confidence. We felt that way about a lot of similar products we looked at.
Now let’s dive into Synology. This isn’t a security camera system itself. You probably know it as a NAS, or Network-Attached Storage company that offers Disk Stations for backing up all your data. But they also offer something called Surveillance Station. It’s software that runs on your Synology that lets it operate as an NVR, storing video feeds while managing cameras, alerts, notifications, etc.
Synology has a mobile app that can allow you to view your live cameras and use two-way audio, but this is only available if you’re on your local network. If you want to do this remotely, you can connect to your local network using a VPN, and Synology has software to help you do this. You can also receive security-related notifications via the app no matter where you are. The “Synology Surveillance Station” software is included with every Synology unit without additional cost and includes two camera licenses, and additional cameras can be added for a one-time cost (no subscriptions required).
Synology Surveillance Station is compatible with many third-party cameras, such as some Eufy, Amcrest, and Reolink cameras already mentioned, and it offers many features such as motion detection, scheduled recording, and even remote viewing and alerting. They market it as your own private cloud, and the setup looks pretty cool, but doesn’t resolve the problem of offsite data storage. So they’ve also rolled out something called “C2 Surveillance,” which is part of their cloud subscription lineup. This allows you to record to the Synology C2 cloud at the same time as you record locally in order to back up your recordings.
So how secure is that cloud backup? It’s not completely clear. Remember when Zoom told everyone they’re end-to-end encrypting their calls, which would mean that Zoom couldn’t access them, but what they were actually doing was using transport layer encryption which did allow Zoom access to calls? They basically just redefined what “end-to-end encryption” means for the unacquainted, and they got into big trouble for it. We think C2 Surveillance is doing a similar sleight of hand. They say on their website: “End-to-end encryption: Footage is protected through AES-256 encryption before it leaves the recording server, with decryption carried out only at destination.” What do they mean by destination? We reached out to them for clarification, and C2 confirmed the destination means their servers, NOT your devices, and that they have access to any video recordings saved with them. So that’s not end-to-end encryption at all. They should probably be careful about redefining end-to-end encryption. It didn’t work too well for Zoom.
So let’s finally dive into Apple HomeKit, which isn’t a security camera system itself either. It’s an encrypted cloud storage system that can be used with certain third-party security cameras. And when they say they end-to-end encrypt your footage and store it in the cloud for you, they define end-to-end encryption the CORRECT way. You can connect your local camera system to Apple HomeKit, and view it remotely in a secure and private way from your Apple device.
There are many cameras that are currently compatible with Apple HomeKit. Cameras like Eve and Logitech Circle View have no native app; you just plug them in, scan them in the HomeKit app, and you have access to the footage remotely. If you’re after an end-to-end encrypted, remote camera setup, this might be a good option for you. Other cameras have HomeKit as an add-on where you will need to use the camera system’s own app and then connect to HomeKit. We like this a lot less, because of the data that is usually collected by such apps.
Eufy is the only fully wireless camera setup that seems to be compatible with HomeKit, but there were also some strange things with the Eufy setup. Instead of connecting the cameras themselves to the HomeKit, you actually connect your Eufy base station via a wired Ethernet connection. The base station forwards your footage to Apple HomeKit Secure Video.