F.T.C. Says Webcam’s Flaw Put Users’ Lives on Display

On Wednesday, the Federal Trade Commission took its first action to protect consumers from reckless invasions of privacy, penalizing a company that sells Web-enabled video cameras for lax security practices.

According to the F.T.C., the company, TRENDnet, told customers that its products were “secure,” marketing its cameras for home security and baby monitoring. In fact, the devices were compromised. The commission said a hacker in January 2012 exploited a security flaw and posted links to the live feeds, which “displayed babies asleep in their cribs, young children playing and adults going about their daily lives.”

“The Internet of Things holds great promise for innovative consumer products and services,” Edith Ramirez, the commission’s chairwoman, said in a statement. “But consumer privacy and security must remain a priority as companies develop more devices that connect to the Internet.”

TRENDnet officials did not respond to a request for comment.

While the Internet of Things is still evolving, the concept currently embraces both industrial and consumer products. In a factory, sensors can be used to monitor manufacturing processes, warning that a machine needs maintenance and potentially avoiding a breakdown. At home, so-called smart appliances like refrigerators or thermostats can feed information via the Internet to manufacturers and service providers to keep the products humming.

In a speech last month, Ms. Ramirez noted that such developments required more diligence by consumers and regulators. While many individuals consent to data collection, consumers rarely are consulted about where their personal information goes afterward. The F.T.C. plans to conduct a workshop in November to discuss the issue, with an eye toward drawing up rules that allow for both innovation and the protection of consumers.

Robert R. Belair, who formerly served in the commission’s division of consumer protection and who is now the managing partner of the Washington office of Arnall Golden Gregory, said it was not yet clear whether the Internet of Things “changes the nature of the privacy threat, or just exacerbates the threat in certain ways that require a little more vigilance.”

In detailing the security lapses, the commission said the company transmitted customers’ login information over the Internet in clear, readable text rather than encrypting the data. It also said TRENDnet’s mobile application, which allows customers to control the home camera from a smartphone, did not properly protect users’ credentials. When the company became aware of the flaws, it uploaded a software patch to its Web site and tried to alert customers.

As part of the case, TRENDnet agreed to sanctions that include a 20-year security-compliance auditing program. The company also promised not to misrepresent the security of its cameras, the confidentiality of the activity that its devices transmit, or consumers’ ability to control the security of the cameras or their recordings. The agency’s four current commissioners voted unanimously for the sanctions.

The F.T.C. does not have the legal authority to impose fines in such cases. But TRENDnet agreed to a consent order prohibiting similar practices, so the commission has the ability to seek penalties in the future.

Despite its recent action, the F.T.C.’s authority in this area has been called into question. The Wyndham Hotel Group is challenging the commission’s ability to penalize companies that do not do enough to protect consumer information, like credit card numbers. Wyndham has argued that the agency has not published any formal rules on data security. The case is pending in Federal District Court in New Jersey.

The case against TRENDnet highlights the potential vulnerabilities that consumers face when they connect everyday, in-home products to the Internet. As with e-mail accounts, online banking and shopping Web sites, enterprising hackers can get around security systems when vendors are sloppy.

In 2010, TRENDnet began selling its digitally connected cameras under the product name SecurView. With the device, individuals and businesses could, via an individual Web site, monitor family members, customers or security concerns. In three years, its camera business produced nearly $19 million in revenue, accounting for 10 percent of the company’s total revenue in that period.

According to the F.T.C., a hacker in 2012 identified a security flaw and circulated the information publicly. Though the company was notified of the breach within three days, others saw the message and quickly posted links to live video feeds of about 700 cameras.

The commission said that the hacker was able “to identify a Web address that appeared to support the public sharing of users’ live feeds.” While only some customers opted to share their feeds publicly, the hacker found that all of the feeds could be viewed and shared, the commission said. After the episode, news accounts sometimes included photos taken from the feeds.

Consumers “had little, if any, reason to know that their information was at risk,” the commission said.

That kind of exposure “increases the likelihood that consumers or their property will be targeted for theft or other criminal activity,” the F.T.C. said, and “increases the likelihood that consumers’ personal activities and conversations or those of their family members, including young children, will be observed and recorded by strangers over the Internet.”

News Analysis: Unraveling Brothers’ Online Lives, Link by Link

The Boston Marathon bombings quickly turned into an Internet mystery that sent a horde of amateur sleuths surging onto the Web in a search for clues to the suspects’ identity. And once the search focused on Tamerlan and Dzhokhar Tsarnaev, the brothers’ social media postings provided a rich vein of material to mine and sift.

There are more than a thousand messages on Dzhokhar’s Twitter account in addition to a profile page on VKontakte, a popular Russian social networking site, and in Tamerlan’s case, a list of favorite videos on YouTube and what appears to be an Amazon wish list belonging to him (Amazon would not confirm whose list it was, citing its privacy policy.)

These posts instantly became dots that people began trying to connect. Some details ratified the views of those former friends and neighbors who said they were utterly shocked at the brothers’ possible involvement in such a horrifying crime. Other posts pointed to Tamerlan Tsarnaev’s growing interest in Islamic radicalism and possibly a dark subtext to the friendly, boy-next-door affect of Dzhokhar.

At the same time, they were reminders of the complexities of online identity — of the ways in which people strike poses and don masks on the Web (which can sometimes turn into self-fulfilling prophecies), and the ways in which the Web can magnify or accelerate users’ interests and preoccupations.

The younger brother, Dzhokhar, in particular, seemed utterly immersed in American pop culture, and concerned with the sorts of things that preoccupy many young men — girls (“miss u.s.a. is so sexy”) and good times (“I am the best beer pong player in Cambridge. I am the #truth”). In fact, much of his Twitter feed is distinctive only in its ordinariness — ordinariness that stands in such startling contrast to the horror of what happened last week in Boston.

There are lots of references to musicians like Chris Brown, Jay-Z and Michael Jackson; television shows like “Breaking Bad” and “Game of Thrones,” and movies like “Spider-Man” and “Finding Nemo.” He prattles away about Nutella and Frosted Flakes, complains about typos and losing his remote. “Pop-up adds are the worst, on par with mosquitoes,” he tweets on June 17, 2012.

Given the layers of irony, sarcasm and joking often employed on Twitter, it can be difficult to parse the messages of a stranger. Yet some of them can seem menacing or portentous, given what we now suspect: “a decade in america already, I want out,” “Never underestimate the rebel with a cause” or, drawing from lyrics from a Kendrick Lamar song, “No one is really violent until they’re with the homies.” But others suggest a more Holden Caulfield-like adolescent alienation: “some people are just misunderstood by the world thus the increase of suicide rates.” Sometimes, Dzhokhar sounds downright sentimental (unless, of course, he is being ironic): “There are enough worms for all the birds stop killing each other for ‘em.”

Parts of Dzhokhar’s VKontakte page are harsher and more serious. Under personal priority, it says “Career and money.” Under worldview, it says “Islam.” There is a link to a video indicating outrage at the violence in Syria, and a link to an Islamic Web site that says “And do good, for Allah loves those who do good.” Another video features a blind boy talking to an older man, saying he believes his blindness will be absolved on Judgment Day; the man starts to cry, and wonders how many people who have their sight are as committed to the study of the Koran as the boy.

Other posts on Dzhokhar’s page have a more sardonic edge. There is a link to a self-described “journal of sarcasm” called “Evil Corporation” (featuring a logo reminiscent of Angry Birds) and also a joke that goes like this: “A car goes by with a Chechen, a Dagestani and an Ingush inside. Question: Who is driving?” Answer: The police.

Finn Cohen contributed reporting from New York, and Andrew E. Kramer from Moscow.

Campaigns Mine Personal Lives to Get Out Vote

In the weeks before Election Day, millions of voters will hear from callers with surprisingly detailed knowledge of their lives. These callers — friends of friends or long-lost work colleagues — will identify themselves as volunteers for the campaigns or independent political groups.

The callers will be guided by scripts and call lists compiled by people — or computers — with access to details like whether voters may have visited pornography Web sites, have homes in foreclosure, are more prone to drink Michelob Ultra than Corona or have gay friends or enjoy expensive vacations.

The callers are likely to ask detailed questions about how the voters plan to spend Election Day, according to professionals with both presidential campaigns. What time will they vote? What route will they drive to the polls? Simply asking such questions, experiments show, is likely to increase turnout.

After these conversations, when those targeted voters open their mailboxes or check their Facebook profiles, they may find that someone has divulged specifics about how frequently they and their neighbors have voted in the past. Calling out people for not voting, what experts term “public shaming,” can prod someone to cast a ballot.

Even as campaigns embrace this ability to know so much more about voters, they recognize the risks associated with intruding into the lives of people who have long expected that the privacy of the voting booth extends to their homes.

“You don’t want your analytical efforts to be obvious because voters get creeped out,” said a Romney campaign official who was not authorized to speak to a reporter. “A lot of what we’re doing is behind the scenes.”

In statements, both campaigns emphasized their dedication to voters’ privacy.

“We are committed to protecting individual privacy at every turn — adhering to industry best practices on privacy and going above and beyond what’s required by law,” said Adam Fetcher, an Obama campaign spokesman.

Ryan Williams, a spokesman for the Romney campaign, said: “The Romney campaign respects the privacy rights of all Americans. We are committed to ensuring that all of our voter outreach is governed by the highest ethical standards.”

In interviews, however, consultants to both campaigns said they had bought demographic data from companies that study details like voters’ shopping histories, gambling tendencies, interest in get-rich-quick schemes, dating preferences and financial problems. The campaigns themselves, according to campaign employees, have examined voters’ online exchanges and social networks to see what they care about and whom they know. They have also authorized tests to see if, say, a phone call from a distant cousin or a new friend would be more likely to prompt the urge to cast a ballot.

The campaigns have planted software known as cookies on voters’ computers to see if they frequent evangelical or erotic Web sites for clues to their moral perspectives. Voters who visit religious Web sites might be greeted with religion-friendly messages when they return to mittromney.com or barackobama.com. The campaigns’ consultants have run experiments to determine if embarrassing someone for not voting by sending letters to their neighbors or posting their voting histories online is effective.

“I’ve had half-a-dozen conversations with third parties who are wondering if this is the year to start shaming,” said one consultant who works closely with Democratic organizations. “Obama can’t do it. But the ‘super PACs’ are anonymous. They don’t have to put anything on the flier to let the voter know who to blame.”

While the campaigns say they do not buy data that they consider intrusive, the Democratic and Republican National Committees combined have spent at least $13 million this year on data acquisition and related services. The parties have paid companies like Acxiom, Experian or Equifax, which are currently subjects of Congressional scrutiny over privacy concerns.

Vendors affiliated with the presidential campaigns or the parties said in interviews that their businesses had bought data from Rapleaf or Intelius, companies that have been sued over alleged privacy or consumer protection violations.

Officials at both campaigns say the most insightful data remains the basics: a voter’s party affiliation, voting history, basic information like age and race, and preferences gleaned from one-on-one conversations with volunteers. But more subtle data mining has helped the Obama campaign learn that their supporters often eat at Red Lobster, shop at Burlington Coat Factory and listen to smooth jazz. Romney backers are more likely to drink Samuel Adams beer, eat at Olive Garden and watch college football.

Jo Craven McGinty contributed reporting.