In recent years, there have been many news reports of short-term rentals and hotels using hidden WiFi webcams to spy on their tenants. These webcams are small, inexpensive, and trivial to deploy. Early work in detecting hidden cameras involved significant expertise and equipment along with knowledge of existing devices on the network. We observed that most common webcams use interframe compression to reduce the bandwidth required for the webcam to operate. Interframe compression means that if the video isn't changing much, very little data needs to be sent, but if it is changing frequently, a lot of data needs to be sent.
Based on these observations, we were the first to publish a system that detects hidden webcams by introducing change to the environment and then correlating that change with changes in Wi-Fi network traffic using only a smartphone. The downside of this technique is that it is only effective in small to mid-size rooms and it produces annoying side-effects (who really wants to have the flashlight from a mobile phone flashed at them for a minute during a meeting?).
We then realized we could simply record the environment, compress that video with an interframe compression codec, and then compare our compressed version to the network traffic. This led to the development of the Similarity of Simultaneous Observation (SSO) system. SSO removed the annoying side-effects of our earlier work and was shown to work in significantly larger indoor and outdoor spaces. We later extended this system to work even when the hidden webcam delayed the transmission and achieved an F1 score of 98.89 even when the video was delayed by 30 seconds by using our Delay Tolerant Similarity of Simultaneous Observation (DT-SSO) system.