Every Room, Miked and Watched

Digital surveillance tracks a person’s communications and location. But it has a limit a different category of equipment does not: it cannot show what happens in a room a person believes is private. A hidden camera can.

The devices themselves are neither exotic nor expensive. A pinhole camera, its lens as small as two millimeters across, can be embedded in a pen, a clock, a USB charger, an air freshener, or a smoke detector, recording at up to 4K and storing footage on an SD card or uploading it to the cloud, for thirty to three hundred dollars.¹ Wireless models, no larger than a matchbox, connect over ordinary WiFi and stream a live feed anywhere in the world.² If you are searching a room, these are the everyday objects a device is most often concealed inside: a smoke detector above a bed, because nobody questions a smoke detector; a bedside clock; a phone charger already in the wall; a showerhead or soap dispenser; a stuffed animal in a child’s room. Audio devices follow the identical logic at similar prices: recorders small and cheap enough to disguise inside the same kinds of everyday objects, and detectable the same way a hidden camera is — a physical search and a radio-frequency sweep of the room.³ GPS tracking devices complete the set: AirTags and Tile trackers, coin- to credit-card-sized, hidden in a bag or a shoe or the underside of a car, marketed under the same protective language stalkerware uses — I’m just tracking my things for safety — for fifteen to thirty dollars apiece.⁴

At intimate-partner scale, these devices are documented enabling exactly the mechanisms earlier chapters named. A camera in the bedroom produces footage used for blackmail or humiliation. A GPS tracker in the car lets a perpetrator confront a partner with her own location (I know you were at your mother’s; don’t lie to me), turning ordinary movement into an occasion for punishment. A microphone in the living room supplies gaslighting’s raw material directly: you said you wanted a divorce; I have the recording. None of this requires technical sophistication — the installation itself is quick and covert, leaving little for the target to notice.

The same logic extends into consumer smart-home products never marketed as surveillance at all. Modern televisions from major manufacturers routinely ship with built-in microphones — and, in a range of past models, cameras — sold for voice control or video calling, disabled by default but remotely activatable by anyone with the right access — typically the household’s own WiFi password, which an intimate partner usually already has.⁵ Smart speakers carry their own version: a 2019 Bloomberg investigation found that Amazon employed thousands of workers across the United States, Costa Rica, India, and Romania to listen to, transcribe, and annotate recordings captured by Echo devices, processing as many as a thousand audio clips in a single nine-hour shift, some reporting they believed they had overheard what sounded like sexual assaults. All of it happened without users being clearly told that human reviewers, not only an algorithm, might listen to what their homes recorded.⁶ Smart security cameras marketed for protection — Ring, Nest, Wyze — have been turned toward exactly the people they were installed to protect: in one prosecuted San Diego case, a woman pleaded guilty to eavesdropping after livestreaming more than seven hundred hours of footage from her ex-husband’s own home cameras over two months, watching an average of twelve hours a day;⁷ in a separate 2026 Florida case, a man was charged with felony digital voyeurism after his former partner discovered a Ring camera he had hidden in her bedroom during a visit to their former shared home.⁸ Whatever the device, the vulnerability repeats: anyone on the household’s WiFi network can, from that single point, potentially reach the television’s camera, the speaker’s microphone, the security camera’s footage, the smart lock’s access log, and the browsing history of every device at once — an integrated surveillance system built from products bought for convenience, none of which required a sophisticated technologist to install.

Physical devices carry one advantage over their digital counterparts: they are much harder to explain away once found. Digital surveillance can often be denied — anyone could have accessed an account, software installed itself, a hacker rather than a named person was responsible. A hidden camera discovered inside a smoke detector above a bed, in a home only the perpetrator and victim share, offers no such room for doubt. The device is the evidence — proof of recording without consent that needs no cloud log or digital trail, because the physical object exists, can be photographed in place, and can be sent to a forensic lab to recover its stored footage, its timestamps, and, where the perpetrator was careless, their own fingerprints. Discovery of a hidden camera frequently supports criminal charges (wiretapping, voyeurism, invasion of privacy) more directly than most digital surveillance cases manage, precisely because “I didn’t know it was there” is a far less credible defense for a device in one’s own bedroom than “someone must have hacked my account” is for a suspicious login.

Every device examined in this chapter and the one before it has to be installed by someone, without the target’s knowledge — which raises a question: how hard, actually, is it to get past a locked door?

At the state level, it has never needed to be hard at all. The Church Committee — the 1975 Senate Select Committee to Study Governmental Operations with Respect to Intelligence Activities — documented that the FBI conducted at least two hundred thirty-nine warrantless surreptitious entries, known internally as “black bag jobs,” against fifteen domestic organizations between the late 1940s and 1966. These were part of a broader pattern exceeding two hundred such entries against domestic targets, including civil rights and political groups, between 1942 and 1968.⁹ The purpose was consistent: pick or bypass the lock, enter undetected, plant a microphone or wiretap, photograph whatever documents were inside. In 1972 and 1973 alone, agents conducted nine separate black bag entries across five addresses in New York and New Jersey — the homes of relatives and acquaintances of Weather Underground members — gathering intelligence through covert physical access rather than any authorized method.¹⁰ Even the practice’s own controlling authority eventually recognized it as untenable: on a 1966 internal memo describing the bureau’s approval procedures, J. Edgar Hoover handwrote a single line, “No more such techniques must be used,” an acknowledgment, from inside the program, that what had been standard, budgeted tradecraft had become a liability.¹¹

What made this entry practical for the FBI is available to anyone, because the underlying hardware was never particularly secure. The security researcher and investigative attorney Marc Weber Tobias has shown that pin-tumbler locks — the design underlying most locks in the world, refined but not fundamentally altered since the nineteenth century — can be bypassed in seconds by well-documented techniques requiring little skill,¹² and that even locks marketed as high-security are not exempt.¹³ The countermeasure is not a better ordinary lock but a different class of hardware — bump- and pick-resistant high-security cylinders — together with the same after-the-fact evidence the rest of this chapter turns on: entry logs, camera timestamps, the record an intrusion leaves whether or not the lock itself recorded it.

The same vulnerability recurs at the scale of the “master key” itself. In 2014, the Washington Post published a feature that included, apparently by accident, a high-resolution photograph of the TSA’s own master keys for Travel Sentry-approved luggage locks. The image was removed within minutes, but not before it had already been copied; by September 2015, security researchers had reverse-engineered the key profiles from the photograph and published 3D-printable key designs publicly on GitHub, compromising the master-key security of an estimated three hundred million TSA-approved locks worldwide.¹⁴ The lesson applies well beyond luggage: any master key or backdoor built for one class of authorized user is a single point of failure for everyone else who trusts the lock. It is the same problem this book keeps encountering at the digital layer, where an account-recovery process built for one legitimate purpose becomes exactly the vulnerability an abuser exploits — here demonstrated with an actual metal key photographed in a newspaper.

Prosecuted stalking cases connect this physical-access layer directly to the devices examined throughout this chapter. A man near Winchester, Massachusetts, was arrested in 2018 and charged with stalking and attempted breaking and entering after placing a GPS tracker on the underside of a woman’s car.¹⁵ A San Antonio man was arrested after investigators found a GPS tracker hidden inside a stalking victim’s engine compartment — far more deliberate access than magnetically attaching one to the exterior.¹⁶ And in Westlake, Ohio, a GPS-tracking stalking pattern surfaced incidentally during an unrelated burglary investigation, when the suspect admitted using the tracker’s location data specifically to “show up randomly” near his victim.¹⁷ These cases document the installation half of the argument solidly, even where they don’t each confirm lock-picking as the access method used.

Taken together, this chapter’s two threads describe a single continuous layer beneath every surveillance mechanism examined so far. And the historical record shows, at the highest level of documentation available — a Senate committee’s own findings — that the institutions running the largest surveillance operations in this account treated picking a lock as routine, budgeted tradecraft, not a fringe tactic for extraordinary circumstances. The same lesson holds at every smaller scale: the lock, in nearly every case, was never really the obstacle it was assumed to be.