Why Your Construction Site Camera Feed is a Cyber Target (And the Risk to You and Your Customer)

Jump to section

• What Attackers Actually Do
• Why This Problem Is Worse Than It Looks on Paper
• What IoT SIMs Actually Fix
• The Signal Strength Factor Nobody Talks About
• The Problem With Mobile Broadband SIMs on Construction Sites
• What You Can Do Today

If your mobile CCTV tower is running on a mobile broadband SIM, it may well have a static public IP address, and that means it could already be visible to automated scanners and bots constantly crawling the internet.

This isn't hypothetical. Shodan.io (a publicly accessible search engine for internet-connected devices) currently indexes over 3.4 million cameras and security devices that are openly reachable and actively vulnerable. That figure includes UK-based deployments. If your cameras are running on mobile broadband SIMs, there's a reasonable chance yours are among them.

What Attackers Actually Do

Most people imagine a targeted hacker when they think about camera security. In practice, the majority of risk comes from automated scanning at scale.

Bots continuously sweep IP addresses looking for open ports. When they find one, they probe it for known vulnerabilities, such as outdated firmware, weak authentication, misconfigured SSL certificates, and exposed management interfaces. A device connected to a mobile broadband SIM with a public IP can receive several thousand probe attempts per hour without any human attacker being involved. The device doesn't need to be "interesting" to be targeted. It just needs to be reachable.

Once access is gained, the implications range from footage interception to using the device as a foothold in a broader network attack. For cameras relaying footage under GDPR-covered contracts, unauthorised access to video data is a reportable breach, not just an operational inconvenience.

Why This Problem Is Worse Than It Looks on Paper

Mobile broadband SIM deployments have a structural security gap that isn't visible in the data plan spec sheet. Without a private APN, there's no network-level isolation. Traffic that should be accessible only to authorised parties is instead routed through infrastructure shared with millions of other users. SIM cloning (where a malicious actor replicates the SIM to intercept or redirect traffic) is a real, documented risk on mobile broadband SIM cards. And because static public IPs are constantly reassigned, maintaining any kind of access control or audit log becomes genuinely difficult.

There's also the GDPR dimension. UK GDPR requires that personal data processing systems maintain confidentiality and integrity. CCTV footage is personal data. If the connectivity layer introduces a meaningful risk of interception or tampering, that's not a theoretical compliance concern; it's an active one.

What IoT SIMs Actually Fix

IoT SIMs operate on private APNs, which create a logically isolated network path for your devices if using a solution that routes the traffic securely over the internet, for example, using an IPSec VPN. This creates an encrypted tunnel through the internet, which means your devices are not visible or scannable, and you can control who can reach the device within your network.

Advanced encryption via IPSec VPN options adds further layers of security. Tools like Shodan.io are unable to scan your device IPs. You can't exploit what you can't find.

Multi-network IoT SIMs (across EE, Vodafone, O2 and Three) also remove single-network dependency, which matters on construction sites where coverage is variable. A camera that drops off a single network at 2am on a remote site isn't just an operational problem; it's a monitoring gap in your client's security record.

The Signal Strength Factor Nobody Talks About

A device working hard to maintain a connection on a weak signal consumes significantly more power, and estimates put it at two to five times more energy for a one-bar connection versus a strong four-bar connection. On off-grid sites, this means more frequent site visits, more battery swaps, and more opportunities for devices to be offline during the swap window.

Unsteered multi-network SIMs allow the device to initially connect to the network with the best signal, therefore stabilising power consumption and optimising uptime. This isn't just an operational efficiency point; fewer offline windows mean fewer gaps in the security footage.

The Problem With Mobile Broadband SIMs on Construction Sites

Mobile broadband SIMs were designed for laptops and MiFi devices. They allocate dynamic public IP addresses, route traffic through shared public infrastructure, and offer no private APN by default. That architecture is fine for a sales rep working from a coffee shop. It's a liability for a camera feed transmitting footage of an occupied site.

Without a private APN, your data travels across shared network infrastructure. Any device sitting on a static public IP address is, by definition, reachable, and reachability is what attackers and bots look for first.

Construction sites add specific risk factors. Remote and semi-remote locations, extended deployment periods, limited physical access for maintenance, and footage that carries real contractual and reputational weight. A camera compromise on a construction site isn't a minor IT incident, it can mean footage gaps, client disputes, and serious data protection exposure.

What You Can Do Today

Audit your current SIM estate against two questions: are your cameras running on mobile broadband SIMs with static public IP addresses?

If the answer to this is yes, you have a structural exposure that no amount of firmware updates will fully address. The fix isn't complicated, it requires switching to IoT SIMs with private APN, static IP, and multi-network capability, but it does require making the switch deliberately rather than assuming your current setup is adequate because nothing has gone wrong yet.

The cameras on your sites are already being scanned. The question is whether they're findable.

Cellhire provides IoT SIM connectivity for temporary CCTV and security deployments, with options such as private APN, with private static IP, overlaid with VPN options and access to all four UK networks on a single SIM.