In October 2014 the journalist Joseph Cox exposed the website Insecam, which was live-streaming the feeds of tens of thousands of CCTV and web cameras around the world whose owners had never changed the default password, and whose subjects had no idea they were being watched. On 20 November 2014 the Guardian quoted the Information Commissioner, then Christopher Graham, condemning the site and saying that he wanted “the Russians to take this down straight away”, and that he would take “very prompt action working with the Federal Trade Commission in the States to get this thing closed down” (the Guardian, 20 November 2014).
Is it the Information Commissioner’s business to censor websites?
It was doubtful whether the Information Commissioner had any power or jurisdiction over the website or its operators, because the site was not operating from the United Kingdom or from anywhere in the European Union. The Federal Trade Commission was likely to be equally powerless, and would probably be prevented from acting by the First Amendment. GoDaddy, which hosted the site at the time, would be shielded from liability for its customers’ wrongdoing by the safe harbour that American law gives to hosts, and it was not even clear that the operators had broken any American law. The Commissioner was, in reality, able to do nothing beyond relying on the goodwill of the Russian authorities.
Interestingly, the operators said the website was not designed with malice in mind but to expose, and raise awareness of, the shortcomings of CCTV security. In that respect it served the public rather well: it spawned a large public debate on the very issue it claimed to be raising, and it increased public understanding of how insecure such cameras are. That outcome, it can be argued, was achieved thanks to the freedom of speech we enjoy, and it brings with it the question whether it is really the Information Commissioner’s job to censor Insecam or any other website. Whether deliberately or not, the site was probably serving a good purpose, and, true to the way capitalism and democracy work, its owners were generating revenue for themselves and for Google through the advertisements on the site.
What has changed since 2014
Insecam was not shut down. It went offline for a few days, relaunched on 25 November 2014 saying that its cameras were now selected by hand so as not to invade anyone’s private life, and it is still online in 2026, much reduced, with a couple of thousand feeds rather than the 73,000 of its peak. The regulator’s threat achieved a change of policy on the site, not its closure, which is more or less what this article predicted.
The law has moved, though, and a regulator asking the same question today would have more to point to. The UK GDPR applies to organisations outside the United Kingdom that monitor the behaviour of people here, and the Information Commissioner, now John Edwards, can fine them up to £17.5 million or 4 per cent of turnover. The Online Safety Act 2023 gives Ofcom the power to ask a court for business disruption orders against a service with links to the UK, so that payment providers, advertisers and internet service providers are made to cut it off, which is the one thing that reaches a site whose operators are abroad. What has not changed is the problem underneath this article: a British regulator’s powers stop at the border, and a foreign operator who ignores them can only be reached through the companies that serve it, or through a court in its own country. That is exactly the ground on which Ofcom and the American forum 4chan are now fighting, and I describe it in The hamster, the judge and the regulator.
First published 20 November 2014. Reviewed and updated 28 September 2026.