Ukraine says Russia hacked web cameras to spy on targets in Kyiv

Ukraine’s security officers said they took down two online surveillance cameras that were allegedly hacked by Russia to spy on air defense forces and critical infrastructure in Ukraine’s capital, Kyiv.

The cameras were installed on residential buildings in Kyiv and were initially used by residents to monitor the surrounding area and parking lot. After hacking them, the Russian intelligence services supposedly gained remote access to the cameras, changed their viewing angles, and connected them to YouTube to stream sensitive footage.

According to Ukraine’s security service, SBU, this footage likely helped Russians direct drones and missiles toward Kyiv during a large-scale missile strike against Ukraine on Tuesday. During the attack, Russia fired almost 100 drones and missiles, primarily targeting Kyiv and Kharkiv, Ukraine’s second-largest city. At least 5 people were killed, and 129 were injured.

Since Russia invaded Ukraine in February 2022, the SBU said it has blocked about 10,000 digital security cameras that Moscow might have used to prepare for missile strikes on Ukraine.

According to the investigation by Radio Free Europe, Russia's intelligence services might have been getting video footage from thousands of Ukrainian surveillance cameras equipped with a Russian software program known as Trassir. This surveillance system can capture the movements of people and vehicles and is capable of recognizing faces and license plates.

The journalists found that the footage from those cameras went directly to servers in Moscow and could likely be accessed by Russia’s security services. Ukraine started to abandon Russian software only after the start of the invasion.

Online footage, including photos and videos, could be a valuable source of information for both Ukrainian and Russian intelligence agencies.

Ukrainian laws prohibit citizens from sharing photos or videos of residential buildings or critical infrastructure objects hit by Russians during missile strikes, as it helps the enemy forces to “correct” their targeting. The penalty for this offense is a potential prison term of up to 12 years.

The SBU called on the owners of street surveillance cameras to stop online broadcasts from their devices and to report any detected streams from such cameras on YouTube.