Russia turns cameras on NATO arms

A security camera on a warehouse wall looks harmless enough. It watches a loading bay, a gate, perhaps a road used by delivery vans. The owner may have installed it to stop theft, check stock movements, or see whether a courier has arrived. But if that same road is being used by military trucks heading towards Ukraine, the camera may be useful to someone else.

Dutch intelligence services AIVD and MIVD disclosed this month that at least one Russian intelligence service had compromised internet-accessible cameras across Europe to monitor military logistics. The hijacked feeds were used to identify military vehicles, cargo, transport routes, weapons deliveries to Ukraine, and locations of Ukrainian military personnel (AIVD). A small number of cameras placed directly on military logistics routes in the Netherlands were confirmed to have been compromised, and their owners were warned (NL Times).

A burglar who borrows your windows

The technique is not sophisticated in the way people imagine cyber-espionage to be. Attackers scan the open internet for devices that should never have been exposed in the first place: cameras still using factory passwords, running old software, or left open to remote access the owner did not properly configure. Once inside, they do not need to plant much. The camera already does the work. It points at the world and streams video (AIVD advisory PDF, Security Management).

It is like a burglar who never enters your house but uses every badly locked window in the street as a lookout. One camera sees very little: a bend in the road, a rail siding, a port entrance. Put enough of those fragments together and a pattern appears. When a convoy passed. Which direction it took. How often it moved. What kind of vehicle was involved (Intelnews). In a war where logistics decides how long armies can fight, timing becomes intelligence.

The attraction is proximity. Satellites can show movement from above, but a roadside camera can catch details that orbiting sensors may miss: markings on vehicles, escort arrangements, loading activity. The Dutch advisory also refers to automated image recognition, meaning software that scans video for vehicle shapes, markings or repeated movement patterns without a person watching every feed. That makes the operation scalable across dozens or hundreds of compromised cameras.

The weak-device pattern is spreading

The Netherlands is not a one-off. Finland issued a similar warning days later, although its case centred on routers and enterprise network devices rather than cameras. Finnish intelligence warned companies that Russian FSB-linked actors exploit poorly protected network equipment to reach companies, critical infrastructure and the defence industry (Supo, Kyberturvallisuuskeskus). The pattern is the same: cheap, weakly secured devices become doors into places that matter. Finland, a NATO member with a 1,340-kilometre border with Russia, is treating weak connected devices as a national-resilience problem.

Poland matters because much of the military supply chain for Ukraine crosses Polish territory. Allied governments had already warned that Russian military hackers target logistics firms involved in Ukraine support (NCSC, Kresy). German media also picked up the story, although the evidence currently runs through Dutch sources rather than a separate German intelligence finding (Focus).

That distinction matters. Some reports described "hacked doorbell cameras" along NATO routes. The official Dutch documents refer to IP cameras. Doorbells, particular brands and detailed route maps appear in media retellings, not in the published advisory (AIVD advisory PDF). The confirmed facts are serious enough without adding detail that has not been publicly established.

Who fixes this?

The Dutch advice to camera owners is basic but necessary: change default passwords, switch off remote access that is not needed, update the camera's software, use encrypted connections, and limit what the camera can see. A well-secured camera still creates risk if it unnecessarily overlooks a sensitive loading point and is compromised later (AIVD advisory PDF).

But this cannot be left to individual owners. Malta should understand that instinctively. A country with ports, free zones, warehouses, yacht marinas, iGaming offices, data centres and apartment blocks packed into a small area cannot treat civilian sensors as someone else's problem. The same cheap cameras that watch a garage in Marsa, a warehouse near Hal Far or a gate on the Grand Harbour can also see more than their owners intended.

Only governments can map which civilian cameras sit along sensitive corridors, warn owners, set procurement standards, and reduce unnecessary visibility around logistics routes. Dutch services did that for the cameras they identified. Whether other NATO members are doing the same remains unclear.

Europe's military supply chain does not move through some sealed military world. It uses commercial roads, civilian ports, private warehouses and streets lined with low-cost internet-connected devices. That gives NATO depth and flexibility. It also makes logistics visible through the ordinary fabric of civilian life, one forgotten default password at a time.