How Compromised IP Cameras Became Military Intelligence Assets in Europe and Ukraine

The strategic appeal is straightforward. Traditional military surveillance relies on specialised equipment and dedicated intelligence capabilities. Civilian cameras offer another source of information, often positioned exactly where an adversary would prefer to observe: beside roads, near ports, around industrial facilities and in residential areas through which military vehicles may pass.

In late 2022, the pro-Ukrainian hacking group Team OneFist gained access to an internet-connected camera in Russian-occupied Sevastopol. By controlling its pan, tilt and zoom functions, the group tracked Russian helicopters and naval assets and identified a previously unknown Russian air base near a local airport. The resulting intelligence was passed to the Ukrainian military, which used it in a strike that damaged aircraft and air defence systems.

The group also accessed webcams overlooking the Kerch Strait Bridge, monitoring Russian defences, including underwater motion sensors.

The significance lies in the connection between a seemingly minor cyber intrusion and a conventional military operation. The camera supplied an observation point; remote access made that observation possible from a distance; the resulting information could then inform the use of weapons.

The same principle works in the opposite direction. In 2024, Russian hackers compromised residential and community webcams in Kyiv to identify targets and adjust missile strikes. Civilian surveillance equipment had become part of the intelligence environment in which attacks were prepared.

Neither side needs to control an entire surveillance system to benefit from it. A handful of useful viewpoints can expose movements or reveal activity around a strategically important location. The wider the network of accessible devices, the greater the potential choice of observation points.

Artificial intelligence changes the economics of surveillance

The problem would be significant even if every compromised camera had to be watched individually. Artificial intelligence makes that approach unnecessary.

A large collection of video feeds is not automatically useful intelligence. Most footage is repetitive, poorly positioned or irrelevant. Human analysts cannot continuously examine thousands of streams and reliably identify every movement that might matter to a military operation.

Automated analysis changes that calculation. AI tools can help process large volumes of video, identify patterns and track activity across multiple locations. Military intelligence operators can search for movements of interest without having to watch each camera continuously.

The result is a shift in the economics of reconnaissance. The cost of obtaining potential observation points falls when the cameras already exist, are connected to the internet and can be accessed remotely. Automation then reduces the human effort required to extract information from them.

This does not make every compromised camera useful, nor does video analysis eliminate the need to verify intelligence. A camera can provide an incomplete view, fail to distinguish between military and civilian traffic, or capture activity without revealing its purpose. But a network of feeds can offer a picture that no individual device could provide.

The combination of cheap hardware, remote access and automated processing is what makes the threat different from conventional hacking. The objective is no longer necessarily to penetrate one valuable system. It can be to exploit a large number of ordinary devices and extract whatever intelligence their positions make available.

Europe discovers the logistics problem

The implications extend well beyond active combat zones.

In July 2026, Dutch intelligence services AIVD and MIVD warned that a Russian intelligence service had been systematically compromising IP cameras in the Netherlands, other EU and NATO member states, and Ukraine. The objective was to monitor military transport routes, Western arms shipments and troop movements.

Data from Censys indicates that more than 87,000 internet-connected cameras across these regions have potentially vulnerable services. That figure does not mean all those devices have been compromised. It does, however, illustrate the size of the potential exposure.

For European governments, the concern is not confined to the theft of confidential documents or the disruption of computer networks. Military logistics depend on physical movement: equipment must travel, personnel must be deployed, and supplies must reach their destinations. Observing those activities can provide information about the operation of the defence system without breaching a military network directly.

A camera does not need to reveal the contents of a shipment to be useful. Its position and footage may help an observer establish when traffic moves, how activity changes or which routes deserve closer attention. Repeated observations can be more valuable than a single image because they reveal patterns.

This creates a difficult operational security problem for NATO and its European partners. Military organisations can protect their own systems, but they have less direct control over the thousands of privately operated devices overlooking roads, commercial premises and transport infrastructure. The weakest point may belong to a homeowner or a small business with no reason to think of its camera as a potential intelligence asset.

The Dutch warning therefore points to a wider vulnerability in European defence. Protecting military logistics requires attention not only to the security of the forces moving through the continent, but also to the civilian digital environment through which those movements can be observed.

The same vulnerability, different wars

Developments in the Middle East show that the technique is not tied to one conflict or one particular balance of military power.

In early 2026, Israel used hacked Iranian traffic cameras to gather intelligence supporting operations against Iranian leadership. Iran-linked groups, meanwhile, gained unauthorised access to more than 250 sensitive Israeli cameras near strategic sites, using them to monitor military positions and assess the impact of Iranian missile strikes.

These operations illustrate two related uses of surveillance. Before an attack, cameras can help build an understanding of the environment and identify activity worth investigating. After a strike, they can offer a way to assess what happened without sending personnel into the area.

Battle damage assessment matters because an attack does not end when a weapon reaches its target. Military planners need to establish whether the intended effect was achieved and whether further action may be required. Video footage can contribute to that judgement, although it cannot necessarily establish the full extent of the damage.

The exchange of surveillance and military action also complicates the distinction between cyber operations and conventional warfare. A camera intrusion may appear limited in isolation. Its strategic importance changes when the information it provides is used to support decisions about physical targets.

The participants need not follow identical methods or possess equivalent capabilities. The underlying opportunity is available to any actor able to access vulnerable devices and turn their footage into useful intelligence.

Why the cameras remain exposed

The technology itself is not particularly exotic. Many commercial IP cameras are deployed with weak or default passwords, outdated firmware or insufficiently protected communications. Some remain connected long after installation with little attention to maintenance.

These weaknesses are familiar features of the wider Internet of Things, where everyday objects are connected to networks but do not always receive the same security attention as computers or enterprise systems. Cameras are often purchased primarily for their practical function: recording a property, watching an entrance or monitoring a street. Their owners may have little reason to consider the possibility of foreign intelligence services accessing them.

The scale of deployment compounds the problem. Each individual camera may seem unimportant, but the collective network is geographically dispersed and difficult to secure through a single authority. Device manufacturers, owners, service providers and public bodies may all have different responsibilities, while attackers can search for exposed systems across borders.

Ukraine has responded by identifying and neutralising risky devices. The Security Service of Ukraine says it has identified, secured, reoriented or blocked approximately 40,000 cameras considered potential security risks since the beginning of Russia's full-scale invasion.

The range of measures matters. Simply removing a camera is not always the only response; securing access or changing its orientation may also reduce the intelligence it can provide. Yet the scale of the intervention points to the difficulty of treating this as a series of isolated incidents. The problem is distributed across the civilian environment, requiring authorities to identify potentially dangerous devices before they can be exploited.

A security responsibility without clear boundaries

Governments can warn owners, intelligence services can identify suspicious activity, and manufacturers can improve device security. None of these measures alone resolves the structural problem. Cameras already installed across homes, businesses and public spaces remain part of a network whose security depends on decisions made by millions of individual users and organisations.

For European defence planners, that creates an uncomfortable asymmetry. The intelligence value of civilian infrastructure may be available to an adversary even when the military itself has not suffered a conventional breach. An exposed camera can bypass the digital perimeter of a protected organisation by observing the physical activity taking place outside it.

The challenge is not to treat every internet-connected camera as a military threat. Most will never attract the attention of a hostile intelligence service. It is to recognise that the distinction between an ordinary consumer device and a strategically useful source of information can depend on location, access and the ability to analyse its output.