At the bottom: how to turn on two-step login for your camera, check whether your email has turned up in a data breach, see who else is logged in, and turn off police footage requests in Ring’s Neighbors app.
State Rep. Barbara Rachelson has filed a bill three times since 2019 that would require internet-connected cameras, doorbells, baby monitors and other smart devices sold in Vermont to meet basic security standards. None of the three versions has come to a committee vote.
The national fight over police license-plate cameras has drawn the attention. The cameras Vermonters mount on their own porches and in their own living rooms carry a different risk: someone they never invited seeing inside.
Rachelson, a Burlington Democrat in the House since 2013, first filed the bill in 2019. Each version carried the same title, “An act relating to adopting minimum security standards for connected devices.” Here is what happened to each one, according to the Legislature’s records.
The 2026 version died when the two-year session ended this spring. To come back, it would have to be filed again in the new Legislature that convenes in January.
What the bill would require
The 2026 version runs three pages. It would bar any business from selling a product in Vermont that connects to the internet, or to other connected products, unless the product:
Scrambles what it sends over the internet, so no one can listen in or change it along the way
Installs security fixes on its own, with that setting turned on out of the box, for “a reasonable period” after sale
Requires a strong password, and makes the owner replace any factory password shared across many devices during setup
Comes from a company with a contact for reporting security flaws and a system for fixing them over the life of the product
Carries a privacy policy in plain language, tells owners when it changes, says whether their data is shared for marketing and lets them opt out, and lets them delete their data and account
That reaches far past cameras. Video doorbells, baby monitors, smart locks, smart TVs and connected appliances all fit the bill’s definition.
A company that broke the rules would be treated as breaking Vermont’s consumer protection law, the same law used against scams and false advertising. Had it passed, the 2026 version would have taken effect July 1.
What a hacked home camera looks like
The clearest record comes from the Federal Trade Commission’s case against Ring, the Amazon-owned camera company. Between January 2019 and March 2020, more than 55,000 U.S. Ring customers had their accounts broken into, according to the FTC’s complaint. The intruders used passwords stolen from other websites, or software that guesses passwords over and over until one works.
In at least 910 of those accounts, covering about 1,250 devices, the intruders went further, watching live video or stored recordings. About 4 in 10 of those devices were cameras sold for indoor use. In at least 20 cases the intruders kept access for more than a month.
The FTC said hackers used the cameras’ speakers to curse at women lying in bed, aim racist slurs at children and threaten an 87-year-old woman. One told a person through the camera, “Tonight you die.”
Outside hackers weren’t the only problem. Before September 2017, the FTC said, every Ring employee and hundreds of contractors in Ukraine could watch any customer’s video. One employee viewed thousands of recordings of at least 81 women over three months that year.
Ring settled for $5.8 million in 2023, and the FTC later sent $5.6 million in refunds to more than 117,000 customers. Amazon disagreed with the FTC’s allegations and said it had fixed the problems on its own years before the inquiry began.
The risk has also turned up in wartime. Israel’s cybersecurity agency reported dozens of Iranian break-ins into security cameras for spying after the U.S. and Israel launched their offensive against Iran on Feb. 28. The security firm Check Point found the scanning aimed at two big low-cost camera brands, Hikvision and Dahua, using security holes that have been known for years. The Wall Street Journal laid out the pattern in a visual investigation this month.
There is no public count of camera hacks in Vermont, or of how many Vermont homes have these cameras. National surveys disagree widely. One industry survey puts cameras in 61% of U.S. households; other estimates run closer to 4 in 10.
What the bill would and would not have stopped
Rachelson’s bill goes after the easiest way in: factory passwords. Many cheap cameras ship with the same password on every unit, and those passwords are often posted online. The bill would force owners to replace them during setup and would require strong passwords from then on.
The bill would have done less against what happened to Ring customers. A strong password does no good once it has been stolen from another website and reused. Two-step login, where the account also asks for a one-time code sent to your phone or email, can block many of those break-ins even when the password has been stolen. The bill did not require it.
Ring has required two-step login for every account since Feb. 18, 2020. On that point, the biggest camera brand already goes further than the Vermont bill would. The password rules would matter most for cheaper, lesser-known brands, the kind a security researcher quoted by the Wall Street Journal tells buyers to avoid.
The bill also left one term open. It requires automatic security fixes for “a reasonable period” after sale but does not say how long that is.
Other governments have already acted on factory passwords. California has required a unique password, or a new one at setup, on every connected device sold there since Jan. 1, 2020. The United Kingdom banned shared default passwords in 2024.
Ring, Flock and police requests
Ring and Flock Safety, the license-plate camera company, announced a partnership in October 2025 that would have let police on Flock’s systems ask Ring owners for footage. The two companies canceled it Feb. 12, and Ring says it never launched and no customer video went to Flock.
Ring’s own police program continues. Under it, local police can post a request for footage in Ring’s Neighbors app for a specific place and time. Owners nearby get a notice and have 60 days to decide whether to share.
Nothing is sent unless the owner chooses. Video an owner does share goes to Axon Evidence, a police evidence system, along with the owner’s home address and account email. Once shared, it cannot be taken back.
That is a separate question from hacking. A police request needs your yes. A stolen password does not.
Check Your Own Camera
Vermont has not adopted the security standards in Rachelson’s bill, so how much protection you want is your call. Here is what you can check yourself.
Turn on two-step login. Ring requires it. For other brands, look in the camera app’s account or security settings. It can stop many break-ins even when a password has been stolen.
Check whether your email has turned up in a breach. Enter your email at haveibeenpwned.com to see whether it has turned up in a known data breach. A match doesn’t prove your password was stolen, and no match doesn’t mean you’re safe. Either way, change any password you’ve used on more than one site, starting with the camera account.
Use a password you use nowhere else. A password manager makes that easier.
See who else is logged in. Most camera apps list the phones and shared users with access to your account. Ring calls this the Control Center. Remove anything you don’t recognize.
Turn on automatic updates in the camera app.
Change your router’s factory settings. Give the Wi-Fi and the router’s own admin login new passwords, and pick WPA3 or WPA2 security in your internet provider’s app or website.
Buying a camera? Stick with established brands that issue regular security fixes.
Ring police requests: Turn off Community Requests in the Neighbors feed settings to stop seeing them. To stop the emails, open the Ring app’s menu, then Control Center, then Public Safety. Turning them off only hides the requests; police can still seek footage other ways, such as with a warrant.
We put the facts in context so you can put the news in perspective. If you value that work, please consider a paid subscription to Compass Vermont.