US federal agencies have five weeks to rip out Chinese-made surveillance cameras to comply with a ban imposed by the US Congress last year in an effort to thwart the threat of spying from Beijing. However, thousands of the devices are still in place and chances are most would not be removed before the Aug. 13 deadline.
A complex web of supply chain logistics and licensing agreements make it almost impossible to know whether a security camera is actually made in China or contains components that would violate US rules.
The National Defense Authorization Act (NDAA), which outlines the budget and spending for the US Department of Defense each year, included an amendment for fiscal 2019 that would ensure federal agencies do not purchase Chinese-made surveillance cameras. The amendment singles out Zhejiang Dahua Technology Co and Hangzhou Hikvision Digital Technology Co, both of which have raised security concerns with the US government and surveillance industry.
Hikvision is 42 percent controlled by the Chinese government, while Dahua, in 2017, was found by a US cybersecurity firm to have cameras with covert back doors that allowed unauthorized people to tap into them and send information to China.
Dahua said at the time that it fixed the issue and published a public notice about the vulnerability.
The US government is considering imposing further restrictions by banning both companies from purchasing US technology, people familiar with the matter said in May.
“Video surveillance and security equipment sold by Chinese companies exposes the US government to significant vulnerabilities,” said US Representative Vicky Hartzler, a Republican who helped draft the amendment.
Removing the cameras will “ensure that China cannot create a video surveillance network within federal agencies,” she said at the time.
Dahua declined to comment on the ban.
In a company statement, Hikvision said it complies with all applicable laws and regulations and has made efforts to ensure its products are secure.
A company spokesman added that the Chinese government is not involved in the day-to-day operations of Hikvision.
“The company is independent in business, management, assets, organization and finance from its controlling shareholders,” the spokesman said.
Despite the looming deadline to satisfy the NDAA, at least 1,700 Hikvision and Dahua cameras are still operating in places where they have been banned, according to San Jose, California-based Forescout Technologies, which has been hired by some federal agencies to determine what systems are running on their networks.
The actual number is likely much higher, said Katherine Gronberg, vice president of government affairs at Forescout, because only a small percentage of government offices actually know what cameras they are operating.
The agencies that use software to track devices connected to their networks should be able to comply with the law and remove the cameras in time, Gronberg said.
“The real issue is for organizations that don’t have the tools in place to detect the banned devices,” she added.
Several years ago, the US Department of Homeland Security tried to force all federal agencies to secure their networks by tracking every connected device.
As of December, only 35 percent of required agencies had fully complied with this mandate, according to a report last year by the Government Accountability Office. As a result, most US federal agencies still do not know how many or what type of devices are connected to their networks and are now left trying to identify the cameras manually, one by one.
Those charged with complying with the ban have discovered it is much more complicated than just switching off all Hikvision or Dahua-labeled cameras. Not only can Chinese cameras come with US labels, but many of the devices, including those made by Hikvision, are likely to contain parts from Huawei Technologies Co, the target of a broad government crackdown and whose chips power about 60 percent of surveillance cameras.
“There are all kinds of shadowy licensing agreements that prevent us from knowing the true scope of China’s foothold in this market,” said Peter Kusnic, a technology writer at business research firm The Freedonia Group. “I’m not sure it will even be possible to ever fully identify all of these cameras, let alone remove them. The sheer number is insurmountable.”
Video surveillance is big business in the US. Sales of video cameras to the government are projected to climb to US$705 million in 2021 from US$570 million in 2016, according to The Freedonia Group.
Hikvision is the world’s largest video-surveillance provider, with cameras installed in US businesses, banks, airports, schools, military bases and government offices. Its cameras can produce sharp, full-color images in fog and near-total darkness, and use artificial intelligence and 3D imaging to power facial recognition systems on a vast scale.
Once they arrive in the country, some of Dahua and Hikvision’s cameras are sent to their US-based warehouses. Others go to equipment manufacturers like Panasonic Corp or Honeywell International Inc, and are sold under those brands, said John Honovich, founder of video surveillance site IPVM. The cameras are then bought by intermediaries, such as security firms, which go on to sell them to government agencies and private businesses.
The NDAA also covers Dahua and Hikvision’s extensive agreements with original equipment manufacturers, sweeping up any vendor who re-sells the devices or uses the companies’ equipment.
Effectively, two cameras running identical Hikvision firmware could carry completely different labels and packaging. This means it would be nearly impossible to tell if the thousands of video cameras installed across the nation are re-labeled Chinese devices.
A Honeywell spokeswoman said the company could not track these re-labeled products, even if asked.
Panasonic did not respond to e-mailed requests for comment.
This convoluted supply chain has left government agencies confused over how to obey the law.
“We’ve been trying to get our arms around how big the problem is,” said a government worker at the US Department of Energy, who asked to remain anonymous because he is not authorized to speak publicly.
“I don’t think we have the full picture on how many of these cameras are really out there,” he said.
The law itself is vague on whether it means agencies must remove the cameras or simply stop renewing existing contracts. A group of government officials and experts is to meet this week in Washington to try to parse the legislation.
Hikvision has about 50,000 installation companies and integrated partners that are all wondering how broadly the law is likely to be interpreted. Many have contacted the company, asking how they could be affected, a person familiar with the discussions said.
Some security vendors are already refusing to purchase equipment from Hikvision and Dahua. Shares of both companies have tumbled since March amid speculation of US sanctions.
If someone is routinely tapping into cameras to spy on federal agencies, they could easily determine the identities of those who work in government departments and even CIA operatives, said Stephen Bryen, former deputy undersecretary of defense for trade security policy.
“This is extremely dangerous,” he said. “It can’t be tolerated and quite frankly every agency should be writing its own directives to make sure the job gets done.”
Chinese strongman Xi Jinping (習近平) hasn’t had a very good spring, either economically or politically. Not that long ago, he seemed to be riding high. The PRC economy had been on a long winning streak of more than six percent annual growth, catapulting the world’s most populous nation into the second-largest power, behind only the United States. Hundreds of millions had been brought out of poverty. Beijing’s military too had emerged as the most powerful in Asia, lagging only behind the US, the long-time leader on the global stage. One can attribute much of the recent downturn to the international economic
An outrageous dismissal of the exemplary Taiwanese fight against COVID-19 has been perpetrated by the EU. There is no excuse. I presume that everyone who reads the Taipei Times knows that the EU has excluded Taiwan from its so-called “safe list,” which permits citizens unhindered travel to and from the countries of the EU. As the EU does not feel that it needs to explain the character of this exclusive list, perhaps we should examine it ourselves in some detail. There are 14 nations on the list that have been chosen as safe countries of origin and safe countries of destination for
Filmmakers in Taiwan used to struggle when it came to telling a story that could resonate internationally. Things started to change when the 2017 drama series The Teenage Psychic (通靈少女), a collaboration between HBO Asia and Taiwanese Public Television Service (PTS), became a huge hit not just locally, but also internationally. The coming-of-age story was adapted from the 2013 PTS-produced short film The Busy Young Psychic (神算). Entirely filmed in Taiwan, the Mandarin-language series even made it on HBO’s streaming platforms in the US. It is proof that a well-told Taiwanese story can absolutely win the hearts and minds of hard-to-please