F.T.C. Says Webcam’s Flaw Put Users’ Lives on Display

On Wednesday, the Federal Trade Commission took its first action to protect consumers from reckless invasions of privacy, penalizing a company that sells Web-enabled video cameras for lax security practices.

According to the F.T.C., the company, TRENDnet, told customers that its products were “secure,” marketing its cameras for home security and baby monitoring. In fact, the devices were compromised. The commission said a hacker in January 2012 exploited a security flaw and posted links to the live feeds, which “displayed babies asleep in their cribs, young children playing and adults going about their daily lives.”

“The Internet of Things holds great promise for innovative consumer products and services,” Edith Ramirez, the commission’s chairwoman, said in a statement. “But consumer privacy and security must remain a priority as companies develop more devices that connect to the Internet.”

TRENDnet officials did not respond to a request for comment.

While the Internet of Things is still evolving, the concept currently embraces both industrial and consumer products. In a factory, sensors can be used to monitor manufacturing processes, warning that a machine needs maintenance and potentially avoiding a breakdown. At home, so-called smart appliances like refrigerators or thermostats can feed information via the Internet to manufacturers and service providers to keep the products humming.

In a speech last month, Ms. Ramirez noted that such developments required more diligence by consumers and regulators. While many individuals consent to data collection, consumers rarely are consulted about where their personal information goes afterward. The F.T.C. plans to conduct a workshop in November to discuss the issue, with an eye toward drawing up rules that allow for both innovation and the protection of consumers.

Robert R. Belair, who formerly served in the commission’s division of consumer protection and who is now the managing partner of the Washington office of Arnall Golden Gregory, said it was not yet clear whether the Internet of Things “changes the nature of the privacy threat, or just exacerbates the threat in certain ways that require a little more vigilance.”

In detailing the security lapses, the commission said the company transmitted customers’ login information over the Internet in clear, readable text rather than encrypting the data. It also said TRENDnet’s mobile application, which allows customers to control the home camera from a smartphone, did not properly protect users’ credentials. When the company became aware of the flaws, it uploaded a software patch to its Web site and tried to alert customers.

As part of the case, TRENDnet agreed to sanctions that include a 20-year security-compliance auditing program. The company also promised not to misrepresent the security of its cameras, the confidentiality of the activity that its devices transmit, or consumers’ ability to control the security of the cameras or their recordings. The agency’s four current commissioners voted unanimously for the sanctions.

The F.T.C. does not have the legal authority to impose fines in such cases. But TRENDnet agreed to a consent order prohibiting similar practices, so the commission has the ability to seek penalties in the future.

Despite its recent action, the F.T.C.’s authority in this area has been called into question. The Wyndham Hotel Group is challenging the commission’s ability to penalize companies that do not do enough to protect consumer information, like credit card numbers. Wyndham has argued that the agency has not published any formal rules on data security. The case is pending in Federal District Court in New Jersey.

The case against TRENDnet highlights the potential vulnerabilities that consumers face when they connect everyday, in-home products to the Internet. As with e-mail accounts, online banking and shopping Web sites, enterprising hackers can get around security systems when vendors are sloppy.

In 2010, TRENDnet began selling its digitally connected cameras under the product name SecurView. With the device, individuals and businesses could, via an individual Web site, monitor family members, customers or security concerns. In three years, its camera business produced nearly $19 million in revenue, accounting for 10 percent of the company’s total revenue in that period.

According to the F.T.C., a hacker in 2012 identified a security flaw and circulated the information publicly. Though the company was notified of the breach within three days, others saw the message and quickly posted links to live video feeds of about 700 cameras.

The commission said that the hacker was able “to identify a Web address that appeared to support the public sharing of users’ live feeds.” While only some customers opted to share their feeds publicly, the hacker found that all of the feeds could be viewed and shared, the commission said. After the episode, news accounts sometimes included photos taken from the feeds.

Consumers “had little, if any, reason to know that their information was at risk,” the commission said.

That kind of exposure “increases the likelihood that consumers or their property will be targeted for theft or other criminal activity,” the F.T.C. said, and “increases the likelihood that consumers’ personal activities and conversations or those of their family members, including young children, will be observed and recorded by strangers over the Internet.”

Bits Blog: Twitter Loses Ability to Properly Display Instagram Photos

7:15 a.m. | Updated Adding comment from Kevin Systrom, Instagram’s chief executive.

Welcome to the Photo Wars.

Instagram on Wednesday disabled the ability for Twitter to properly display Instagram photos on its Web site and in its applications. The move escalates tensions between the two companies, which were once friends in the battle against Facebook but have now become direct competitors.

In a status update on Twitter’s Web site, the company said Instagram had disabled its integration with Twitter cards, which are used to display images and content within Twitter messages.

“Users are experiencing issues with viewing Instagram photos on Twitter,” the post said. “This is due to Instagram disabling its Twitter cards integration, and as a result, photos are being displayed using a pre-cards experience.”

Speaking at the LeWeb technology conference, Kevin Systrom, Instagram’s chief executive, confirmed that the company has removed the ability to send pictures to Twitter, and plans to completely cut off embedding pictures on the Twitter Web site.

“We’ve decided that right now, what makes sense, is to direct our users to the Instagram Web site,” Mr. Systrom said, noting that Instagram images will soon no longer be visible on Twitter. “Obviously things change as a company evolves.”

Mr. Systrom did not say when images will cesase to show up on the site.

Instagram users will still be able to generate a tweet on Twitter when they post a photo. But when someone clicks on the Instagram link in those tweets, they will be taken out of the Twitter site or app and directed to Instagram’s site to view it.

Until now, if someone posted a photo on Instagram and also shared it with their Twitter followers, a click on the “View Photo” link on Twitter’s site would summon it right on the same page.

Mr. Systrom said that photos posted through other sites and services, including Facebook, Tumblr and Foursquare, will not be affected.

For now, Instagram photos appear incorrectly on Twitter, sometimes showing up cropped or off center. It is unclear if Instagram will completely disable the ability for Twitter to show pictures on its Web site.

Photo sharing continues to be a volatile battleground for social networking services, and given the potential advertising dollars at stake, the tensions will likely continue to grow.

Although Instagram and Twitter worked closely together during Instagram’s early days, relations between the two companies have soured since the Facebook acquisition.

Now the companies are competing on a number of fronts for consumer eyeballs. Last month Instagram, which had been almost entirely app-based, began rolling out its own Web-centric pages for its 100 million registered users. And Twitter is expected to introduce photo filters to its mobile applications, much like the ones Instagram offers.

When the Facebook acquisition of Instagram closed, Instagram said in a blog post that the deal “means we can now work together to evolve and build a better Instagram for everyone.”

It looks like “everyone” doesn’t include Twitter.

Bits Blog: Google to Topple Facebook as Leader in Display Ads, eMarketer Says

Google is set to overtake Facebook in earning money from display ads, making it the leader in all three types of digital advertising — search, mobile and display.

That is the prediction of eMarketer, a research firm that many in the tech industry rely on for its ad revenue forecasts. Earlier this year, it said that Facebook would maintain the lead, but this month cut its forecast for Facebook’s revenue from display ads, which are ads with images or video.

Google is the latest company to shake up the industry in recent years. Yahoo was dominant in display advertising until last year, when Facebook overtook both Google and Yahoo.

Google will collect 15.4 percent of display ad dollars this year, or $2.31 billion, up 38.5 percent from last year, according to eMarketer. Facebook will earn 14.4 percent, or $2.16 billion, up 24.4 percent. Yahoo will earn 9.3 percent of display ad dollars, Microsoft 4.5 percent and AOL 4.3 percent, eMarketer said.

The overall display ad market will grow 21.5 percent this year, according to the predictions. That is slightly less than originally expected, in part because advertisers are paying less for display ads.

Google has been pouring resources into its display ad business and courting Madison Avenue. For the company, which still makes most of its revenue from search ads — the simple lines of text that relate to an Internet user’s search query — finding a new source of revenue has been crucial. Display ad spending growth will outpace search ad spending growth for the first time this year, eMarketer said.

Nikesh Arora, Google’s chief business officer, crowed about Google’s display ad business on its earnings call in July and said, “four-line text ads are not as exciting.”

Google runs the DoubleClick Ad Exchange, a marketplace for display ads that sells ads all over the Web, and has recently bought several companies to improve its display ad technology. Facebook last week introduced an ad exchange.

EMarketer attributed Google’s ascendancy to stronger-than-expected performance from mobile ads, the success of display ads on YouTube and strong performance from DoubleClick. Also, it said Google has benefited because it has longtime relationships with advertisers from its years in the search ad business.

What does all this mean for Yahoo? Even as other Yahoo businesses struggled, its display ad business used to be strong, but now its percentage of the pie is shrinking. While Yahoo’s board chose Marissa Mayer, a product specialist, as chief executive instead of an ad sales expert, she has said that the company would continue to focus on ad technology.