Should you cover your webcam?

The rapid growth of remote and home-working has led to many users getting webcams or setting up Zoom equipment in their own homes, often in rooms or parts of the house where there wasn’t previously a computer.

In 2016 Mark Zuckerberg inadvertently brought attention to the risks of users being covertly monitored through their computer’s webcams or mics when he posted a now-infamous photo of his desk setup, showing his laptop with a covered webcam and blocked mic. If even the creator of Facebook blocks his, who else does? Many people, it turned out, including former FBI director James Comey.

The risks, revisited...

Plenty has changed since then both in terms of improvements to security, but also in terms of risks, and we’re going to take a short look at the best practise to stay secure with your computer’s webcam and mic. The fears people talked about in the past, of ending up beholden to remote blackmailers are much less likely than problems closer to home, such as spousal stalkerware.

A host of these products have sprung up over recent years, and increasingly manage to sneak into otherwise safe environments. Even seemingly reputable news sources fall prey to this, with Apple News running content from Pocketlint, explicitly geared around illegal remote monitoring. There is, sadly, a market for this sort of content and product.

That said, user privacy can be violated by simple accident, and without malicious intent. Plenty of Zoom users haven’t realised that their cameras were on, or that when joining a Zoom call that the call host might have configured the call to start with user cameras on. Additionally, it’s possible to join a Zoom call with one’s camera off, be placed in a waiting room before the call begins, and then have the camera turn on once the host admits the user to the call.

There are only a few video apps where the host can remotely enable video if the participant has turned it off after the start of the call, and Zoom is safe in this regard. It does, however, have a feature whereby the host can remotely unmute a participant’s microphone. If you’re in the habit of stepping away from your computer on long calls to get a cup of coffee whilst muted, beware that you might be unmuted without knowing about it. Similarly, if you’re joining the call from a room with other people around, their unexpected presence in your background may cause them embarrassment if they’re not expecting to be broadcast.

These inadvertent risks can be handled with a few simple precautions: covering or physically disconnecting a webcam makes things more obvious, and having a mic with a physical mute button helps.

What about Alexa or the HomePod?

Plenty of users have an Alexa or HomePod device in their home, or other forms of smart devices like thermostats or security cameras. These are all capable of broadcasting video or audio captured within the home. It’s very hard to keep tabs on these, and ultimately one must either trust the company making them or not. Both Amazon and Apple home devices may be listened to by staff in some circumstances, though there are controls that can enable users to opt in or out of parts of this.

If one has smart devices at home, it’s sensible to behave as if one’s audio is being recorded. That is potentially quite a burden. It’s very much not a good idea to buy smart devices from small, untrusted or unknown vendors. Who knows what their security is like?

Top tips to stay secure

Here’s a set of best practises we’d recommend for all users:

• Covering your webcam is important will serve as a reminder to think about security whilst using the computer. Realistically, you’re more likely to inadvertently broadcast yourself without knowing than you are to be remotely monitored by anyone else, and a cover helps make that risk obvious. Anything that makes you more security conscious is likely a good idea. You’ll see no end of ads online trying to sell plastic webcam covers: these are junk, and you don’t need them. A piece of tape or a sticky note is good enough for Mark Zuckerberg, and it’ll work well enough for you. Any residue left behind will be easy to remove. And besides, well-designed laptops won’t leave enough room to be closed without damaging themselves when an additional plastic cover is stuck on.
• Even better, use external, physically connected camera and audio devices. Relying on an external mic and cameras makes it crystal clear whether they are physically connected to your computer or not. This has the advantage that you can then permanently block your device’s internal camera and mic. Camo is a good example of a product like this, and has the additional benefit of greatly increasing the quality that a user will get when they join calls. Beware of products that require installation of drivers, or which are from unknown or untrusted sources.
• Close your laptop or power off your computer when not using it will make it harder or impossible for people to access it remotely.
• If you step away from your Zoom call whilst muted to make a coffee, beware that a host might remotely unmute you without your knowing. If your mic has a physical mute button you’ll be OK. But if you’re using AirPods, or an internal mic, there’s no mute that can override Zoom’s settings. If you’re on a call, always assume you might be overheard.
• Keep your software up to date, especially the main software on your phone and computer, and any browsers you use.
• Don’t disable your computer’s firewall or malware. Nowadays these are enabled by default on just about every type of computer and phone, and there’s little need to install additional software, beyond specific products for monitoring webcam use (see above).
• Be aware of your background. If other people might wander into shot, or you might have mess or private items around you, consider hiding your background whilst on calls.
• Be aware of general security best practises and be sure to securely store any video, audio or photos that you’ve already taken.
• Don’t let anyone untrusted use -- or repair -- any of your devices. Who knows what they might install or change in them.