WTF?! A former technician admitted on Thursday that he routinely accessed customers' home security accounts in order to spy on nude women, and to watch couples as they had sex. Following his guilty plea, the technician faces a maximum of five years in prison.
The technician---35-year-old Telesforo Aviles---worked for home and small office security company ADT in the Dallas, TX area. While pleading guilty to one count of computer fraud and one count of invasive visual recording, Aviles admitted on Thursday to accessing the cameras of over 200 customers on almost 10,000 different occasions. Ars Technica explains, "He said he took note of homes with women he found attractive and then viewed their cameras for sexual gratification. He said he watched nude women and couples as they had sex."
Aviles did this by adding his email address to the list of authorized addresses in customers' ADT Pulse accounts. This allowed Aviles to remotely access video feeds, but also to remotely disable alarms in customers' homes or to interact with other appliances, like lights.
Aviles used this method to voyeuristically spy on individuals and couples over a five-year period. However, in April 2020, a customer noticed an unauthorized email in their Pulse account; ADT subsequently learned of Aviles' actions, dismissed him from the company, and informed prosecutors.
ADT has contacted customers individually to explain the situation and address concerns. The company has also shared a statement which is being updated with key developments. There, ADT explains that most customers' concerns and disputes have been resolved---though for some, the company's actions aren't enough.
Unsurprisingly, two proposed class-action lawsuits have surfaced: one on behalf of customers, and another on behalf of minors living in affected homes. The suits claim that ADT didn't do enough to ensure that their home security software was safe and secure. Marketed as a way for parents to monitor kids and pets using your smartphone, ADT did not implement safeguards that could further protect customers such as 2FA or automated alerts when new users were allowed into their accounts.
Much like Aviles' sentence, the outcome of the lawsuits have yet to be determined. For now, this strange and sad event is another stark reminder of some of the dangers of network-connected devices.
While many call on companies like ADT to take the legwork out of installing home security systems, it's essential to take basic steps towards safeguarding your own privacy---especially if the home security camera is pointing at your bed.