BOOK SIX · CHAPTER 2
A Computer With a Lens
The camera that watches the door can become the door.
Look up at the camera over the public entrance. It has a lens. It also has software, a login, a password and a network cable. That makes it a computer. It just happens to point at a door.
Attackers know this. Three public records illustrate the risk.
INDEPENDENT EVIDENCE
In August 2024, CISA warned about an AVTECH security camera. A flaw let someone send commands to the camera over the network and make it run them. Attackers were already using it. CISA also reported that the maker had not answered its requests to help fix the problem.
In June 2025, CISA warned about pan-tilt-zoom cameras from PTZOptics and several other brands. Some shipped with administrator passwords that were easy to crack. Owners could not change those passwords, and could not switch off the remote login either. CISA listed government services and facilities among the places these cameras are used. It had no reports of attacks on these flaws at the time.
In September 2024, the FBI, the NSA and their partners described a China-linked botnet associated with actors known as Flax Typhoon. By June 2024 it had taken over more than 260,000 devices, nearly half of them in the United States. Its targets included IP cameras and video recorders, the same kind of equipment that guards a public building.
One caution. None of these records describes a break-in at a specific government building. What they show is simple. Cameras can be taken over from far away, and attackers do it at scale.
When a camera is turned, three things can go wrong. You lose the picture you were counting on. Someone else gains a quiet seat inside your network. And the camera can start talking to places it was never meant to reach.
Then comes the hard part. You can't unplug every camera just to be safe. That leaves the building blind.