Russia tracks convoys through private cameras

A small business in the Netherlands puts a camera above the front door. It is there for the usual reasons: the gate, the car park, perhaps a bit of the road outside. The installer connects it to the internet, the owner leaves the factory password in place, and the device becomes part of the furniture.

The road outside, however, may be carrying military equipment towards Ukraine. And if the camera is open to the wrong person, someone in Russia can watch.

Dutch intelligence services AIVD and MIVD have disclosed that Russian actors hacked a small number of privately owned internet cameras along military transport routes in the Netherlands. The cameras belonged to businesses, were viewable remotely, and were compromised through the most ordinary weaknesses: default passwords, outdated software, and insecure settings left untouched for years (Security Insight). The purpose was to see what Europe was sending to Ukraine, and when.

One peephole is nothing. A hundred are a map.

There was no great technical mystery here. An internet camera is a small computer with a lens. It runs software, connects to the internet, and often arrives with a standard password such as P@ssw0rd that many owners never change (Tenable). Security researchers have documented cameras with login details embedded in their streaming links, allowing anyone who finds them to watch live footage (OffSeq Radar). Government advisories routinely list default passwords and missing login requirements among the common flaws in surveillance equipment (ISSSource).

One compromised camera gives you a glimpse. Many compromised cameras along roads, rail yards, ports and depots begin to look like an observation network, built from devices whose owners may have forgotten they were online at all. The value is in the pattern. One delivery tells you little. The same gate watched for weeks can tell you the rhythm of movement.

That rhythm matters. Even patchy coverage can show when a route becomes busy, where convoys stop, and which facilities are active at night. In logistics, tempo is information.

That is why the Dutch warning reaches beyond the Netherlands. Weapons and troops still move through ordinary civilian places: commercial ports, private warehouses, business parks and public roads. A camera over a warehouse gate will not reveal a classified plan. Over time, it may reveal enough about the supply chain to be useful.

From Dutch roads to German rail

Germany is one of the central corridors for European military movement. In Minden, authorities found an internet-capable camera mounted on a railway mast with a fake Deutsche Bahn logo. Deutsche Bahn had not installed it. A 43-year-old Lithuanian man was suspected of spying on military transports for Russia (FAZ).

Security officials in North Rhine-Westphalia have warned about Russian "low-level agents" scouting barracks, rail junctions and military facilities (Focus). Germany's own defence planning identifies rail yards, signal boxes and energy supply as sensitive points for military mobility (Operationsplan Deutschland). Much of the protection of those points falls to civilian operators, even when the military depends on them.

Poland shows why the routes themselves are so sensitive. Poland's defence minister has said 90 percent of aid transfers to Ukraine move through Polish airports, roads and railways (Polsat News). The Rzeszów-Jasionka airport hub is one of the three pillars of Polish support for Ukraine (Polish Defence Ministry). Anyone able to observe those flows gains a view of Europe's wider supply pipeline.

The hard part is knowing what's online

The fixes are familiar: change passwords, update the device's built-in software, separate camera networks from other systems, and retire equipment that no longer receives security support (Australian Home Affairs). The harder problem is inventory. Many organisations cannot say with confidence which cameras they own, which installer enabled remote access years ago, or which device now overlooks a route that has become militarily sensitive.

There is no public evidence of a proven continent-wide Russian camera network, with named targets and attributed operators. The Dutch case concerns a small number of devices. The Minden case remains a reported investigation, not a concluded prosecution. The threat is credible, but the public record is limited, probably for operational and privacy reasons.

What the Dutch disclosure does is make an abstract vulnerability easy to grasp. A business camera on a quiet road, streaming to an adversary because nobody changed the factory password, is not a cyber thriller. It is a maintenance failure with strategic consequences.

Europe's military supply lines run through civilian life. Russia does not always need to break into a classified system to learn something useful. Sometimes it can watch the ordinary world doing its work.