WHY NO CAMERA COMPANY HAS IMPLEMENTED SECURITY?

[prakash d]

Looking into another thread about stolen cameras, I found myself in deep questioning.

Since all digital cameras like phones, iPad or even Tesla cars, are Computers at heart, then why hasn't any camera implemented security yet?

For example; a password or remote disabling etc.. which i think can reduce theft.

Often things are easy said than done. Microsoft introduced surface technology more than a decade ago. But they came with a Surface Studio (PC) in 2016.

I wonder what's stopping the industry. I saw in forums about some kind of GPS, RFID tags etc..

I want to see if anyone has any ideas about security.

 

[Hrvoje Simic]

Looking into another thread about stolen cameras, I found myself in deep questioning.

Since all digital cameras like phones, iPad or even Tesla cars, are Computers at heart, then why hasn't any camera implemented security yet?

For example; a password or remote disabling etc.. which i think can reduce theft.

Because that would transfer someone's problems over to folks building cameras, do little to prevent thefts and be a logistic nightmare to maintain.

 

[M.Halsell]

I rent a camera package from a camera owner with the intent of absconding the property. Rental owner hands over the password. My fraudulent documents passed the muster. Im good to go.

Criminal intellect and determination will match wits with most security solutions.

 

[prakash d]

You are right. Its definitely a logistical nightmare. Or even a hardware design is necessary to implement at Sensor level.
However at Software level, that should not be a big challenge. Like password encryption.
Obviously some rouge hackers will come up with password breaking etc.. But still it would make harder to open or use the camera.

 

[prakash d]

I rent a camera package from a camera owner with the intent of absconding the property. Rental owner hands over the password. My fraudulent documents passed the muster. Im good to go..

With Security Roles, you can have master user and guest users. And you can implement valid time range after which a guest password expires.

 

[prakash d]

I think there must be something stopping, like Industry Regulations etc.. Otherwise someone would have had come up with these solutions already.

 

[M.Halsell]

With Security Roles, you can have master user and guest users. And you can implement valid time range after which a guest password expires.

Agreed, but common encryption schemes are defeatable. Every coder in the world doesn't work on the right of law and goodness. And as mentioned logistical nightmare. Imagine Canon having a non-user resetable password schema on their camera, the sheer size of that help desk?

 

[M.Halsell]

I think there must be something stopping, like Industry Regulations etc.. Otherwise someone would have had come up with these solutions already.

No company probably wants to bear the cost burden or potential liability issues. The equipment can't protect itself, it's the owner's duty.

 

[prakash d]

I guess in that case some startups may come up with 3rd party security plugins. That would take burden out of camera manufacturers.

 

[M.Halsell]

Banking, medical, business and government are all struggling with data breaches. And they are throwing money at the problem, left and right.

 

[prakash d]

Banking, medical, business and government are all struggling with data breaches. And they are throwing money at the problem, left and right.

You are absolutely right. This is the case if a company maintains a running database.

But if the Security is on the Camera itself, like a Master Password, which can only be reset by the service department. Then there is no need for maintaining a central database.

So a rental company can give a guest user/password to customers and they are able to reset the password. But if the Rental Company loses the Master User Password, then they have to go to Camera Service Department.

Camera Service department would have the software/hardware tools to reset Master Password for a $$$ charge.

I know in this day and age, all secure solutions are only temporary. But it would still stop street and ordinary thieves because they cannot reset passwords with a screwdriver and a wrench.

 

[Martin Konrad]

It could be much easier I think. All these devices have USB ports, if the camera/computer would require once a week/month (to be determined only while the dongle is connected) for the owner to plug in a dongle that way even rental companies never have to hand over any security...
If you cannot supply the key the next time the device asks for it it simply does no longer turn on.

 

[M.Halsell]

It could be much easier I think. All these devices have USB ports, if the camera/computer would require once a week/month (to be determined only while the dongle is connected) for the owner to plug in a dongle that way even rental companies never have to hand over any security...
If you cannot supply the key the next time the device asks for it it simply does no longer turn on.

Dongle get violated, damaged, stolen, misplaced, USB port breaks (requires camera servicing or it becomes a brick even for the legitimate owner)? USB dongle gets duplicated (real or artificially). Just thinking out loud.

 

[prakash d]

Dongle is a good idea, however it requires the companies to create additional hardware or work with 3rd party companies. Like Avid Pro Tools and keystores, license keys etc..

 

[John Brennick]

Dongle get violated, damaged, stolen, misplaced, USB port breaks (requires servicing)? Just thinking out loud.

From a business perspective, this sounds like a good idea... Replacement keys, surcharges for losing them? Extra revenue and extra security? Win win... I see people coming up with reasons why NOT to do these and putting the responsibility entirely on the owner... However... If nothing is done, then the same number of thefts will still be what they are right now... If they implemented some sort of extra security measure and carried that cost onto the customer, which I personally would be more than happy to pay for, then if even 1 or 2 cameras get recovered then it worked for someone... Might even reduce costs of insurance for theft policies. I don't think just saying "well ya... but someone will get around it..." isn't a very productive response.. Because there are a lot of idiot thieves out there that don't even know what they stole... "Find my iphone" has saved me so many times... The same theory could be applied to camera protection. Built in gps on board maybe? I'm not an engineer so I don't have the answer... However, again, to just say "nah.. someone will work they're way around it" just seems like taking the easy road... Something never exists until someone invents it... Then... it becomes the most useful tool they've had. Just my 2 cents.

 

[prakash d]

Master Password Reset for a small charge for real owners, (based on ID and Invoice Number) is a quickly implementable solution from Business perspective. It can be a Software update even for existing cameras.

 

[M.Halsell]

From a business perspective, this sounds like a good idea... Replacement keys, surcharges for losing them? Extra revenue and extra security? Win win... I see people coming up with reasons why NOT to do these and putting the responsibility entirely on the owner... However... If nothing is done, then the same number of thefts will still be what they are right now... If they implemented some sort of extra security measure and carried that cost onto the customer, which I personally would be more than happy to pay for, then if even 1 or 2 cameras get recovered then it worked for someone... Might even reduce costs of insurance for theft policies. I don't think just saying "well ya... but someone will get around it..." isn't a very productive response.. Because there are a lot of idiot thieves out there that don't even know what they stole... "Find my iphone" has saved me so many times... The same theory could be applied to camera protection. Built in gps on board maybe? I'm not an engineer so I don't have the answer... However, again, to just say "nah.. someone will work they're way around it" just seems like taking the easy road... Something never exists until someone invents it... Then... it becomes the most useful tool they've had. Just my 2 cents.

The OP asked why there weren't stronger security deterrence at the camera level. I have provided response to the thread. This is not the first discussion on this topic. The solution has to be pragmatic for all the parties involved. Your response to me personally is embraced. That's why this is a professional forum. Professionals talking shop and sharing ideas. In other posts, I have shared my idea of embedding a flag at the SDK level that would relay the IP address of the footage being managed. There could possibly be permission based restrictions that would need to be user validated. Ultimately, this would need consensus of the camera manufacturer. So there would need involvement from a party that may not be keen on being in the security business.

But again, in creating security protocol, requires reverse engineering and identifying failure points. Apologies if my responses sound defeatist, the general omission of camera security features is probably not accidental, but rather overwhelmingly doesn't meet any sales/benefit/cost criteria.

 

[Hrvoje Simic]

From a business perspective, this sounds like a good idea... Replacement keys, surcharges for losing them? Extra revenue and extra security? Win win... I see people coming up with reasons why NOT to do these and putting the responsibility entirely on the owner... However... If nothing is done, then the same number of thefts will still be what they are right now... If they implemented some sort of extra security measure and carried that cost onto the customer, which I personally would be more than happy to pay for, then if even 1 or 2 cameras get recovered then it worked for someone... Might even reduce costs of insurance for theft policies. I don't think just saying "well ya... but someone will get around it..." isn't a very productive response.. Because there are a lot of idiot thieves out there that don't even know what they stole... "Find my iphone" has saved me so many times... The same theory could be applied to camera protection. Built in gps on board maybe? I'm not an engineer so I don't have the answer... However, again, to just say "nah.. someone will work they're way around it" just seems like taking the easy road... Something never exists until someone invents it... Then... it becomes the most useful tool they've had. Just my 2 cents.

Would you be interested in developing a high technology high-priced product then taking the responsibility for it's security, 24/7 ?

With AC's, directors, producers, production companies, rental companies, shooters in the field etc. all around the world in a complete drama relying on you, and knowing someone's production day or whole project's outcome lies on your team ?

 

[Antony Newman]

I am not sure I share everyone's view on complexity - this is not a complex software requirement.

Many financial institutions have data breaches for a wide variety of generally iodiotic reasons - e.g. Social engineering.

Apple didn't act on the multitude of requests to make it more difficult for people to 'steal phones to order' until US legislation forced their hand.

There is a real man cost in writing & maintaining software - and this may not be something RED want to get involved with, especially in a real time operating system on the camera itself.

I would propose a TWO stage solution for RED.

STAGE 1 :
Include a list of all known stolen RED CAMERAs in the SDK. This list has to be TINY.
Give FCPX / PREMIERE et al the option of displaying that the R3D was created with a stolen camera.
Perhaps default to overlay it in the video output.
Allow Redcini to email RedHq with the details of the stolen camera + IP address.

STAGE 2 :
As previously suggested (earlier thread on this) - allow an iPad like passcode that requires periodic entering of the passcode - and cannot be wiped by a firmware update.

AJ

 

[M.Halsell]

Mr. Newman,

I'm with you on the Stage 1 suggestion. But wouldn't go any further with a hard camera lockout. If a camera has parted from its owner, it may be better the camera stay online to keep generating IP targets, in terms of future retrieval. A hard passcode would essentially brick the camera, at which point the camera may simply get tossed.

A robust implementation at the footage level, could be to restrict output size or watermark footage identified has having been produced from a stolen camera, until credentials have been established. Which I guess, is moving into the digital watermarking domain.

And again, how ever far the camera manufacturer dips its toe into adding security features, they essentially are in the security business. Which would beg the question 'Why take on an unnecessary burden'?

I've always wondered if footage captured with a stolen camera could technically be considered stolen property? Anyone?