Baby threatened by Nest camera hacker
It was an unremarkable Wednesday afternoon when our nanny texted my wife and me asking if we were speaking through one of the Nest cameras in our house. We both replied that we were not.
Then the nanny texted that a voice was coming through the kitchen camera and using bad words.
I immediately pulled up the video feed and began reviewing:
I hear the familiar chime, which means someone is about to talk through the camera. Then, to my horror, a female voice that I don’t recognize starts talking to my 18-monthold son. He looks around the room and then at the ceiling, wondering who’s there.
It feels as though my heart is about to beat through my chest. The blood rushes to my face. I am completely helpless.
The voice is laughing when it chimes in. She says we have a nice house and encourages the nanny to respond. She does not. The voice even jokes that she hopes we don’t change our password. I am sick to my stomach.
After about five minutes of verbal “joy riding,” the voice starts to get agitated at the nanny’s lack of response and then snaps, in a very threatening voice: “I’m coming for the baby if you don’t answer me, bitch!” My jaw drops.
We unplug the cameras and change all passwords. The nanny has taken our son to the park down the street in an effort to escape. However, the damage has been done.
Still helpless, I started doing the only thing I could do — Googling. I typed “Nest + camera + hacked” and found out that this happens frequently. Parent after parent relayed stories similar to mine — threatening to steal a baby is shockingly common — and some much worse, such as playing pornography over the microphone to a 3-year-old.
I dived deeper to find out how this could have happened. Essentially, an email and a password are compromised somewhere across the internet. They join millions of other email addresses and passwords, which are then cross-referenced with other websites, including Nest. When a match is found, any novice can jump on and terrorize with little to no technical background.
What is worse is that anyone could have been watching us at any time for as long as we have had the cameras up. This person just happened to use the microphone. Countless voyeurs could have been silently watching (or worse) for months.
However, what makes this issue even more terrifying is a corporate giant’s complete and utter lack of response.
Nest is owned by Google, and, based on my experience and their public response, Google does not seem to care about this issue. They acknowledge it as a problem, shrug their shoulders and point their fingers at the users. Their party line is to remind people that the hardware was not hacked; it was the user’s fault for using a compromised password and not implementing two-step authentication, in which users receive a special code via text to sign on.
That night, on my way home from work, I called Nest support and was on hold for 1 hour, 8 minutes. I followed all directions and have subsequently received form emails in broken English. Nobody from Google has acknowledged the incident or responded with any semblance of empathy. In every email, they remind me of twostep authentication. They act as if I am going to continue to use Nest cameras.
I am reminded of Google’s former motto: “Don’t be evil” (now buried in literally the last sentence of their code of conduct). It is not evil to bring a product to market before the privacy has been completely figured out, but it is evil to let someone threaten to kidnap an 18-month-old and have no real response.
Maybe privacy is a thing of the past. Maybe trolls on the internet are everywhere. Or maybe an almost trillion-dollar company needs to hire a few more developers focused on security and a few more customer service representatives to help parents cope when anonymous, sadistic people terrorize their users. Or maybe Google buried its former motto for a reason.