Be careful with unsecured CCTV footage

Letter to the Editor

It is time to call out the elephant in the room that is stomping on our local businesses. We see formerly successful owners struggling, clinging to “free” tools and cheap, unsecured CCTV systems while wondering where their competitive edge—and their legal compliance—went.

Let’s be blunt: 

If you aren’t paying for the product, you are the product. But worse, if you are using “free” cloud cameras with no digital protection, you are effectively copying your house keys, labeling them with your address, and leaving them on the street for anyone to find.

The Mechanics of Negligence

As someone who has spent years in the security game and knows the value of mechanical integrity, I know you don’t trust a machine you can’t secure. Yet, business owners treat digital security with less care than they treat their trash. They install cheap, cloud-based cameras to save a buck, ignoring that these devices often lack basic encryption, unique passwords, or secure update mechanisms.

The Legal Reality:

It’s Not Just “Bad Practice,” It’s Illegal

Here is where the “free” mentality gets you sued or fined. Under the Privacy Act 1988 (Cth) and the new Cyber Security Act 2024 (Cth), video footage of identifiable individuals is personal information.

When you install a cheap camera with no digital protection (no encryption, default passwords, unpatched firmware), you are failing your legal obligation to take “reasonable steps” to secure that data.

The Breach:

If that footage is accessed by a hacker, a stranger, or even shown to an unauthorized person because the system was inherently insecure, you have broken the law.

The Liability: 

You are liable for unauthorized disclosure. It does not matter if you didn’t show the footage; the fact that your lack of security *allowed* someone else to see it makes you responsible.

The Carriage Service Trap: 

Transmitting unencrypted personal information over the internet (a carriage service) without adequate security safeguards is a direct violation of Australian Privacy Principles. You are broadcasting your customers’ faces to the world without their consent.

The “House Keys” Analogy

Using an unprotected cloud camera is no different to copying someone’s house keys and leaving them on the street with a label saying “Front Door.”

If a thief takes those keys and enters the house, you are responsible.

If a hacker accesses your unsecured feed and watches your customers, you are responsible.

If a passerby sees the feed because you didn’t password-protect it, **you have breached the Privacy Act.

The Myth of the “Gray Area”

Some owners claim that sending someone else’s personal information (video) via the internet is a “gray area” in the law. This is dangerously wrong. There is no gray area; there is only compliance or breach.

Federal Law (Privacy Act 1988): 

Under Australian Privacy Principle 6, you cannot disclose personal information (which includes CCTV footage of faces) to a third party unless you have consent or a specific legal exception (like a police request). Sending unencrypted footage to a foreign cloud server or showing it to an unauthorized friend is a direct breach. The Office of the Australian Information Commissioner (OAIC) does not accept “I didn’t know” as a defense.

State Law (Queensland): 

Under the Invasion of Privacy Act 1971 (Qld) and the Criminal Code, recording or transmitting images of people in places where they expect privacy (or without proper signage/consent) is an offense. Furthermore, transmitting these images via a “carriage service” (the internet) without a lawful basis compounds the breach.

The Verdict: 

If you transmit video of a customer to a server in China or the US, or show it to a mate on your phone, and you cannot prove you had their consent or a legal mandate, you have broken the law. Period.

The AI Betrayal:

Funding Your Own Demise

Perhaps the most insidious cost of “free” is the silent transfer of your business intelligence to your competitors.

Data as Fuel: 

As of 2026, consumer-grade “free” AI platforms and email services explicitly reserve the right to use your inputs—your emails, your documents, your prompts—to train their models. Even paid “Pro” individual accounts often default to sharing data unless manually opted out.

The Competitive Edge: 

When you paste your supplier negotiations, pricing strategies, or marketing plans into a free AI tool to “save time,” you are feeding that data into an algorithm. That same algorithm is then accessible to your competitors, who can query it to uncover your tactics.

Who Else is Using Your Experience? If a giant tech company can get your decades of business experience, your unique operational knowledge, and your strategic insights for free, who else is benefiting? You are essentially subsidizing the creation of a digital brain that your competitors will use to undercut you, outmaneuver you, and close you down. You are working for free to build the very tool that will replace you.

The Result: 

Operational Obsolescence and Legal Action

The trajectory is predictable. First, their strategies leak via AI data pools. Then, they get hit with compliance fines from the Office of the Australian Information Commissioner (OAIC) for failing to secure personal information. Finally, a breach wipes out their reputation, and they liquidate their customer data in bankruptcy court.

It’s not bad luck; it’s digital negligence.

I was brought up knowing the value of self-reliance. I fix my own engines and secure my own properties. It’s time our business community applied that same practical logic to their digital lives. Stop giving away the store for free. If you can’t afford a private domain, secure hosting, and a legally compliant, encrypted, and locally controlled security system, you can’t afford to be in business in 2026.

People need to STOP using Google, Gmail, and free, easy AI tools related to their business or even their private homes. These platforms are designed to harvest your data, not protect it. Every email sent, every document stored, and every query made on these free systems is a potential leak in your business’s hull. If you cannot afford enterprise-grade, private alternatives that guarantee your data sovereignty, you are gambling with your livelihood.

The era of the “Googleburt” is over. The survivors will be those who treat their data like cash: keep it local, lock it down, and never let an unsecured “free” vendor touch it.

Jason Clark

Cape York Peninsula