A Doorbell Camera as a Targeting Sensor
On July 10, 2026, the Netherlands' General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD) published a joint advisory disclosing that Russian state actors are systematically hijacking internet-connected cameras — including consumer doorbell and security cameras — to spy on NATO logistics routes and locate Ukrainian soldiers for targeting. The NCSC.nl advisory is blunt about why this works: attackers don't need sophisticated exploits, "simply because IP cameras are directly connected to the internet without a changed default password."
The operation, detailed further by Recorded Future News, scans the open internet for exposed devices, fingerprints them by manufacturer, and exploits default credentials and outdated firmware to gain a live video feed. Image-recognition software then automates the search across thousands of feeds for military vehicles and cargo moving toward Ukraine. Inside Ukraine itself, the same access has reportedly been used to locate military personnel — intelligence that, per the advisory, has subsequently supported attempts to kill soldiers and destroy equipment. This is not abstract privacy harm. It is a kill chain built on a $40 camera nobody bothered to reconfigure.
The Scale Problem
The exposure isn't marginal. Internet-scanning data cited alongside the advisory and reported by The Hacker News found more than 87,000 internet-connected cameras across the EU, NATO member states, and Ukraine running versions with known-exploited vulnerabilities — including over 4,000 inside Ukraine alone, where the devices sit closest to the front. The Netherlands, a transit hub for military aid, has tens of thousands of publicly reachable cameras of its own, a small number of which intelligence services confirmed were physically positioned along logistics routes and had to be flagged to their owners directly.
The Regulatory Gap Is Real — and Already Being Closed, Slowly
The strongest case for hard IoT security mandates is exactly this scenario: a market failure with a national-security externality. An individual buying a cheap doorbell camera has no reason to weigh the risk that Russian intelligence might one day use it to help kill a soldier a thousand miles away. That cost falls on someone else entirely, so the market underprices security by design. Voluntary best practices don't fix an externality; only a binding floor on what can be sold does.
Regulators have already reached that conclusion — just not fast enough. The UK moved first: its Product Security and Telecommunications Infrastructure (PSTI) Act took effect on April 29, 2024, banning the sale of connectable consumer products — cameras and doorbells explicitly included — with universal default passwords, and requiring a vulnerability-disclosure contact and a stated minimum update period. Penalties run up to £10 million or 4% of global turnover. The EU's Cyber Resilience Act, covering everything from baby monitors to smart watches, entered into force in December 2024, but per the European Commission's own timeline, manufacturer vulnerability-reporting obligations only start September 11, 2026, and the core security-by-design requirements — including the default-password ban — aren't enforceable until December 11, 2027. Ukraine, fighting the war these cameras are now being weaponized against, has no equivalent product-security statute of its own; its 2025 cybersecurity law reforms focus on institutional and critical-infrastructure governance, not consumer device standards.
That gap between "the law exists" and "the law bites" is the actual story here — not an absence of regulatory will, but a multi-year phase-in written for peacetime commerce being tested by a live war.
Don't Rewrite the Rulebook — Enforce and Patch the Fleet
The temptation after a disclosure like this is to legislate harder: mandatory certification regimes, import bans on named manufacturers, or state-mandated backdoor access for "security" scanning. That would be a mistake. The UK and EU frameworks already establish the right principle — no default passwords, disclosed update lifespans, market-surveillance enforcement — without dictating specific technology or burdening manufacturers with duplicative certification across jurisdictions. Piling a second, incompatible layer of rules on top, especially one rushed through in response to a single intelligence disclosure, would raise compliance costs for legitimate manufacturers while doing nothing about the tens of millions of devices already sold and sitting on home networks with factory passwords intact.
The faster, more proportionate fix is enforcement and remediation of the existing installed base, not new statute. That means national CERTs and ISPs — as NCSC.nl is already doing — actively scanning for and notifying owners of exposed cameras on sensitive routes; accelerating the CRA's reporting-obligation timeline rather than waiting until 2027 for the full regime; and Ukraine's own CERT-UA extending its critical-infrastructure monitoring to flag exposed consumer devices near military logistics corridors, in coordination with allied intelligence services already doing the scanning. The policy lesson from a doorbell camera being turned into a targeting sensor isn't that IoT law is too light-touch. It's that good rules, once written, need to be enforced years sooner than their drafters assumed anyone would need them.