Iran built a vast camera network to control dissent. Israel turned it into a targeting tool

Israel’s Hijacking of Iranian Surveillance Cameras Highlights Growing Cyber Warfare Tactics

The killing of Iran’s supreme leader Ayatollah Ali Khamenei, facilitated by Israel’s hijacking of Tehran’s own street cameras, demonstrates how surveillance systems are increasingly becoming military targets in modern warfare.

On February 28, Israel tracked down Khamenei with the assistance of Tehran’s street surveillance network, despite repeated warnings that these systems had been compromised, according to interviews with officials and an Associated Press review of leaked data and reports.

The operation utilized hacked surveillance cameras alongside other intelligence sources, according to an intelligence official with knowledge of the operation and another person briefed on it. Both spoke to AP on condition of anonymity as they weren’t authorized to discuss the matter publicly.

Iran has installed tens of thousands of cameras across Tehran, primarily in response to waves of protests. The most recent demonstrations in January ended in a bloody crackdown that resulted in thousands of Iranian deaths. These cameras, meant to consolidate control, inadvertently created a vulnerability that adversaries could exploit.

Tehran’s surveillance network had been compromised multiple times since 2021. Last year, a senior Iranian politician publicly warned that Israel had hacked the cameras, describing it as a national security threat. Despite these warnings, the vulnerabilities remained unaddressed.

“The irony is that the infrastructure authoritarian states build to make their rule unassailable may be what makes their leaders most visible to the people trying to kill them,” said Conor Healy, director of research at surveillance research publication IPVM.

Cybersecurity experts have long cautioned about the potential for surveillance cameras to be weaponized. In 2019, security engineer Paul Marrapese discovered he could easily hack millions of cameras remotely. Despite his warnings, the number of unprotected cameras has continued to grow, with a recent scan revealing nearly three million unsecured camera feeds worldwide, including about 2,000 in Iran alone.

“There are millions and millions and millions of these throughout the world,” Marrapese told AP. “They’re just dumb little things… It’s fish in a barrel.” Many cameras are trivially easy to hack due to minimal security measures, such as default passwords like “1234” or outdated systems that lack security patches.

Even government surveillance systems on networks isolated from the internet remain vulnerable. “Humans are kind of the weakest link,” Marrapese noted. “There’s really only so much you can do.”

The weaponization of surveillance cameras has accelerated in recent conflicts. Hamas reportedly hacked Israeli surveillance cameras before its October 7 attack, using them to monitor Israeli army patrols. Similarly, Russian forces have attempted to hijack cameras near missile targets in Ukraine and at border crossings.

Advances in artificial intelligence have dramatically enhanced the military utility of hacked footage. AI can now scan vast amounts of video to identify people, vehicles, and other targets in near real-time—a task that previously required teams of analysts and took weeks or months.

“It used to be that you could hack the cameras, but humans had to do the real work of figuring out where the person was,” explained cryptographer and security expert Bruce Schneier. “With AI systems… you can do a lot more automatically.”

Iran’s surveillance systems have been repeatedly compromised over the past few years. In 2021, an Iranian exile group leaked footage of abuses at Tehran’s Evin prison. In 2022, another group claimed to have hacked over 5,000 cameras around Tehran, releasing gigabytes of surveillance footage and internal data on Telegram.

During a 12-day conflict last summer, Israel reportedly used Tehran’s cameras to track and bomb a meeting of Iran’s Supreme National Security Council, injuring Iranian President Masoud Pezeshkian.

“All the cameras at our intersections are in the hands of Israel,” Mahmoud Nabavian, deputy chairman of the Iranian parliament’s national security committee, told Iranian media in September. “Everything on the internet is in their hands… if we move, they will find out.”

According to a person briefed on the Khamenei operation, Israel had hacked almost all of Tehran’s traffic cameras years ago and transferred the information to servers in Israel. At least one camera was positioned at an angle that allowed Israel to track daily movements near Iran’s leadership compound.

Algorithms helped provide detailed information including addresses, routes, and security details. While the attack had been planned for months, the operation was expedited once intelligence confirmed that Khamenei and top officials would be in the compound on the morning of the strike.

The incident has sent shockwaves through the region. Check Point Research, a cyber threat intelligence group, reports that Iranian hacking attacks on cameras have spiked since the beginning of the current conflict, with increased activity in Israel and Gulf countries.

Gulf monarchies have responded by barring residents from filming or livestreaming footage of Iranian strikes, with the UAE arresting dozens for sharing video online. These measures aim not only to protect national reputations but also to prevent footage from being exploited by military forces.

As the global network of security cameras continues to expand—with estimates exceeding one billion installed cameras worldwide, triple the number from a decade ago—the potential vulnerabilities grow exponentially.

“I don’t think anyone anticipated that these traffic cameras would become targeting tools… there is alarm all over,” said Muhanad Seloom, assistant professor in security studies at the Doha Institute for Graduate Studies. “How come Iran’s whole leadership has been decapitated on the first day?… It is a topic that is being talked about.”