Unsecured Camera Feeds: A Factory Audit Checklist (India)

Thousands of Indian cameras stream to the open internet right now — default passwords, ports forwarded straight through the router, unencrypted RTSP feeds anyone can pull up. The camera you installed for security becomes the hole in it. Under India's DPDP Act the leak is your liability, not the vendor's, and the fix is a one-afternoon audit any plant can run. This is the checklist.

In 2026, Gujarat Police unravelled a network that had brute-forced roughly 50,000 CCTV systems across India — hospitals, schools, offices, residential complexes and private homes — and was selling the footage on Telegram for ₹800–2,000 a clip, with live feeds on subscription. What let them in was mundane: cameras still running default passwords like "Admin123," reachable from the open internet (The Cyber Express; Digital Watch Observatory). None of those 50,000 owners knew their feed was public until it was for sale.

Your plant is not too small or too boring to be on that list. Scanners like Shodan sweep the whole IPv4 internet indiscriminately; a camera watching a press shop in Rajkot is as findable as one in a hospital. This guide tells you how to check — and what to do the moment you find one open.

Key points

• The exposure is real and indexed. Public scans routinely find thousands of open camera streams worldwide — a Cybernews study counted 8,373 exposed RTSP streams on Shodan, and later scans by others put internet-exposed cameras well into the tens of thousands (Cybernews; GBHackers). These are search results, not hacks — anyone with a browser can find them.
• Default credentials are the whole game. Most breaches need no clever exploit. The camera ships with admin/admin or admin/12345, someone forwards a port so they can watch from home, and the feed is now public. The 2026 India network ran on exactly this (The Cyber Express).
• The leak is legally yours. Under India's DPDP Act 2023 your factory is the data fiduciary for that footage. Failure to take reasonable security safeguards against a breach carries a ceiling of ₹250 crore — and "our CCTV vendor set it up" is not a defence the Act recognises (official Act text, MeitY). See what DPDP asks of worker CCTV.
• The government is closing the front door too. MeitY's Essential Requirements for CCTV, effective 9 October 2024, and the STQC certification regime bar no universal default passwords, mandate authentication and encrypted transmission, and forbid backdoors — and from 1 April 2026 non-conforming cameras cannot be sold in India (Lexplosion; asmag). New kit will be safer; the cameras already on your wall are still your problem.
• You can self-audit in an afternoon. Everything below can be run by a plant electrician or IT contractor with a laptop and the camera manuals. No pen-test firm required for the first pass.

Why do factory camera feeds leak onto the internet?

Almost never through a Hollywood hack. Four ordinary decisions, made for convenience, do it:

1. Default passwords left in place. The installer commissions the DVR/NVR, gets a picture, and moves on. admin/admin is still live. Public lists of every brand's factory-default credentials are one search away — attackers do not guess, they look it up.
2. Port-forwarding "so the boss can watch from home." To see the feed on a phone outside the plant, someone opens a port on the router and points it at the NVR. That single rule publishes the login page to the entire internet. Now only the password stands between the world and your floor — and see point 1.
3. UPnP opening ports silently. Many cameras and NVRs use Universal Plug and Play to punch their own hole through the router automatically, with no one deciding to. The owner never forwarded a port — the device did it for them.
4. Unencrypted RTSP. The video-streaming protocol most cameras use (RTSP) often runs with no encryption and weak or no authentication. Exposed to the internet, the raw stream can be pulled straight into a media player.

Cloud/relay cameras (where the feed goes out to a vendor server and you watch through an app) avoid the port-forwarding trap — but move the risk to the vendor's security and raise separate DPDP cross-border and country-of-origin questions, which is a large part of why India is restricting Chinese-origin CCTV on government and critical sites. For the certification side of that shift, see STQC and IS 13252 explained.

The factory camera-feed audit checklist

Run these in order. You need your public IP address, admin access to the router and to each NVR/DVR, and the camera manuals. Mark each row pass / fail / fix-scheduled and keep the sheet — it is your evidence of "reasonable security safeguards" if you are ever asked.

Steps 1, 2 and 7 tell you within minutes whether you are currently exposed. Steps 3–6 fix the most common cause. The rest is hardening.

I found an open feed — what now?

Move in this order. Speed matters more than tidiness.

1. Close the door first. Disconnect the NVR from the internet or pull the port-forward rule (step 3) immediately. An exposed feed left open while you "plan the fix" is a live leak.
2. Change every password on the affected devices — camera and recorder both. Assume the old ones are compromised.
3. Check the access/event logs on the NVR for unfamiliar logins or times. Note anything odd; do not wipe it.
4. Preserve evidence. If footage may have leaked, keep the logs and note the exposure window. Under DPDP this is a personal-data breach and, from the substantive-duties commencement, may require notifying the Data Protection Board — take counsel's read on your specific facts.
5. Warn affected people if the footage was sensitive. In the 2026 Gujarat case, victims never knew until clips surfaced. If a feed covering a private-ish area was open, that is a real harm, not a formality.
6. Then re-run the whole checklist to confirm the door is shut and stays shut.

A note on Shodan itself: searching your own IP and devices is fine and prudent. Do not go poking at feeds that are not yours — unauthorised access to someone else's system is an offence under the IT Act, and that is precisely what the arrested network was charged with.

How this ties into DPDP and India's ER/security rules

Two separate pressures now point at the same fix, and the audit satisfies both.

DPDP (your liability for a leak). A recognisable worker on a networked feed is personal data, your factory is the data fiduciary, and Section 8 requires reasonable security safeguards — a password-protected NVR (not admin/admin), role-based access, encryption in transit, an access log. An unsecured feed is the textbook failure the ₹250 crore breach-penalty ceiling was written for, and it is the cheapest exposure in the building to close. The duties bind substantively from 14 May 2027, but the leak risk is live today. Full detail in DPDP and worker CCTV, and the worker-facing document in the CCTV privacy-notice template.

ER / STQC (the government's minimum for the device itself). MeitY's Essential Requirements — in force since 9 October 2024, mandatory for sale from 1 April 2026 — bar universal default passwords, require authentication and encrypted transmission, forbid hardcoded backdoors, and demand secure firmware updates and tamper resistance (Lexplosion). New cameras you buy after that date should be safer by design — but ER does not retrofit the recorder already in your cabin. Your audit does. The national-security backdrop — a 2021 statement in Parliament that around 10 lakh Chinese-origin cameras in government institutions posed a risk of footage relaying abroad — is why this is now regulation and not just advice (Business Standard).

Retention (step 13) has its own logic: keep footage only as long as your stated purpose needs, then auto-overwrite. There is no single mandated number under DPDP — 30–90 days is common Indian practice, not statute — and it doubles as your erasure defence. We work through the trade-offs in how long a factory must keep CCTV footage, and every dated obligation sits in the India factory CCTV compliance calendar 2026.

The cheapest security you own

The camera budget is spent, the cameras are up. The gap is almost never money — it is the ten minutes nobody spent changing a default password and closing a port. An afternoon with this checklist removes the single most common way a factory feed ends up for sale on a Telegram channel. That is a better return than most things on the plant this quarter.

When we plan a camera deployment at Mama, placement and access hygiene are decided together — a feed that points only at machines and lanes, on a segmented network with no open ports, is data-minimised and hard to leak by design. (Our floor-deployment experience is general, not India-specific.)

This is general security and compliance guidance, not legal advice. Confirm your DPDP position, and any breach-notification duty, with counsel; have a qualified IT/security professional validate changes to a live network.

FAQ

How do I know if my factory CCTV is exposed to the internet right now? Fastest test: from a phone on mobile data (not the plant Wi-Fi), enter your plant's public IP address followed by common camera ports (:80, :8000, :554, :37777). If a login page or a live image loads, you are exposed. Then create a free Shodan account and search your public IP. If nothing external responds and Shodan shows no open camera service, you have passed the first check — but still change default passwords and disable UPnP.

Is it legal to use Shodan to check my cameras? Yes — searching your own IP address and devices is a legitimate self-audit. What is illegal under India's IT Act is accessing someone else's camera or system without authorisation; that is what the 2026 Gujarat network was arrested for. Check yours, not others'.

Our CCTV vendor set it all up — aren't they responsible if it leaks? No. Under the DPDP Act the factory is the data fiduciary and carries the compliance duty and the penalty exposure; the integrator or AMC firm is at most a processor. "The vendor handles it" is not a position the Act recognises. Put security obligations in the AMC contract, but the liability stays with you.

We just want the owner to watch the feed from home — how do we do that safely? Not with a plain forwarded port. Use a VPN into the plant network, or the manufacturer's secured cloud app with a strong unique password and, ideally, two-factor login. Both let you watch remotely without publishing the NVR's login page to the whole internet.

Do the new ER/STQC rules mean my existing cameras are now illegal? No. The Essential Requirements (in force 9 October 2024) and the 1 April 2026 sale ban govern what can be sold; they do not force you to rip out working cameras. But they set the security bar — no default passwords, authentication, encryption — that your existing kit should also meet. Audit and harden what you have rather than assuming old cameras are fine.

What counts as a "reasonable security safeguard" under DPDP for a small plant? There is no certified checklist in the Act, but the defensible baseline is: no default passwords, role-based accounts, no open ports (VPN/vendor cloud for remote view), encryption in transit, current firmware, a locked recorder, a defined retention window, and an access log. Running and dating the audit above is itself evidence you took the duty seriously.