China-made surveillance cameras are still watching over US military bases, just weeks before a federal ban on such equipment comes into force, according to a review of defence contracts.
Cameras made by Hikvision, which is 42 per cent owned by the Chinese government, remain in place at the Peterson Air Force Base in Colorado, the home of North American Aerospace Defense Command (Norad) and the headquarters of Air Force Space Command.
The Peterson base spent $112,000 on Hikvision cameras in 2016 and a spokesperson said these were “not associated with base security or classified areas” and were not connected to the internet or air force networks. The base added that it now had a plan to “evaluate these systems and replace them”.
Meanwhile, a US Navy research base in Orlando, Florida, bought $4,000 of Hikvision cameras even after the passage last year of the National Defense Authorization Act (NDAA), which bans federal agencies from buying cameras and telecoms equipment from Hikvision and two other Chinese suppliers, Dahua and Hytera, from this August.
Officials said the contract was unrelated to base security and that the cameras, which were being used as part of a training system, were not connected to the internet.
Police departments in states including Massachusetts, Colorado and Tennessee are also still relying on Hikvision cameras. The Memphis Police Department alone has at least 1,500.
State department buys Hytera radios
Meanwhile, the US state department bought more than $20,000-worth of replacement Hytera radio parts for the US embassy in Guatemala, again after the NDAA was passed — as part of its work with the Policía Nacional Civil. Future restrictions would be reviewed as they come into effect, said a state department official.
In 2017, an army memo said Hytera radios were being used for special forces training since the brand was “extensively used by Islamic State”.
Concerns about the safety of China-made technology have escalated during the past 18 months, as relations between the US and China have worsened.
The NDAA will also bar federal agencies from buying from China’s Huawei, which supplies microchips to US surveillance camera makers, and will extend to include how federal loans and grants are spent from July 2020.
Hikvision said it was “disappointed” with the legislation, which was “quickly drafted without sufficient evidence, review or investigation”.
Officials reluctant to disclose cameras
In the years leading up to the ban, Hikvision cameras were purchased by several arms of the military, although officials were reluctant to disclose whether they remained in use. The Fort Drum army base, which acquired $30,000-worth of Hikvision cameras in June 2018, declined to comment.
A tender for security cameras by Marine Corps Base Camp Lejeune last January noted that only Hikvision equipment would “work in network with other cameras”. The base declined to say whether the network still relied on the China-made cameras.
Since 2015, the Defense Logistics Agency has spent almost $180,000 on Hikvision cameras, for US forces in Korea and a naval base in Florida.
The DLA said it “plans to inform the military customers who ordered the material that they should review the applicable section of the NDAA and determine whether or not it is appropriate for them to continue to use the equipment”. Authorities in Korea and Florida were unable to confirm whether the cameras remained in use.
Price is main focus
Hikvision’s rapid expansion into the US surveillance market began in the 2010s, when it started selling cheap alternatives to devices made by brands such as Axis and Bosch.
By 2016 it had become the second-largest supplier of video surveillance products in the Americas, with 8.5 per cent of the surveillance camera market, up from nothing at the turn of the century, and second only to Axis’s 11 per cent, according to IHS Markit.
Low prices attracted small businesses and local law enforcement, in particular. Former Memphis PD surveillance manager Joseph Patty, who now runs a security consulting business, said the brand became so popular because price was often the “bottom-line factor”.
But cyber security experts say all internet-connected devices, including cameras, can pose a threat to the networks they are connected to if they have security vulnerabilities. They could be used by rogue actors as back doors to sensitive networks: once in, such actors could steal information or shut down entire systems.
Even those with security features are not immune from being breached.
“Any device creates an attack surface — a way into anything it’s connected to,” said Steven Humphreys, chief executive of security company Identiv. For example, a local police department’s network might be connected to larger organisations: “all you need is one [way in] . . . that is why the American government is worrying”.
Pressure to switch to alternatives
This year, US lawmakers have been increasingly vocal in warning that certain China-made technologies could be used by Beijing for hacking.
In January 2018, the US army removed Hikvision cameras from Fort Leonard Wood, a base in Missouri, amid cyber security fears, according to the Wall Street Journal newspaper.
Hikvision has also been strongly rebuked for selling surveillance tools to authorities in Xinjiang, where Beijing is accused of human rights abuses.
Many authorities are now under pressure to switch to alternative systems. One security company said that more than a dozen federal agencies had approached it for advice, about half a dozen of which were working to replace the cameras. Hospitals, local government and sensitive businesses, such as banks and critical infrastructure companies, had sought similar help, the company said.
In 2018, Hikvision’s US sales fell for the first time. Its share price has slumped 20 per cent since the NDAA was announced.
Some are unconvinced that the Chinese government would want to access their camera footage. But this is a misunderstanding, said a spokesperson for security company Genetec: “They don’t care what it’s pointed at, but that there’s a central processing unit attached to your network.”
White-label cameras often made by Hikvision
Muddying the water, and making it difficult to track the spread of Hikvision cameras, many US brands have “white-label” agreements with the company, under which they buy Hikvision’s hardware, repackage it and sell it under their own names.
This was a “real concern” for government security managers, said John Honovich, founder of video surveillance research site IPVM, some of whom are unsure of the provenance of their cameras.
The NDAA does not explicitly ban the purchase of these products. But the software on devices made by Hikvision can be altered by the Chinese company, which sends updates to resellers, such as United Technologies-owned Interlogix.
Large-scale Hikvision resellers, including United Technologies and TRENDnet,declined to comment. Panasonic-owned Advidia, which also sells Hikvision-made hardware, said it was monitoring the situation but did “not anticipate any changes at this point in time”.
Similarly, many US camera manufacturers use chips made by Huawei’s HiSilicon. They were “fairly pervasive” in “nominally American” brands, said Identiv’s Mr Humphreys.
Hikvision equipment is generally sold through third-party distributors. Buyers often “blindly trust” that devices have working security features, said Cesar Cerrudo, fellow at the Institute for Critical Infrastructure Technology and chief technology officer at security company IOActive.
Smaller agencies are not always aware of the risks and do not always have the cash to replace systems, although comparably cheap alternatives to Hikvision have begun to emerge.
“This is a broad problem . . . about how we as consumers and organisations use and trust technology,” said Mr Cerrudo. If you don’t test it, “the reality is you don’t really know if it has back doors”.
