China's Hikvision Has Probably Filmed You

Cybersecurity

China's Hikvision Has 

Probably Filmed You

22 May 2019

•  
  Cameras are installed at Army bases, airports and schools
•  
  Trump administration is concerned about Chinese spying tactics

The U.S. government is considering barring two Chinese video-surveillance giants from purchasing U.S. technology, but their cameras are already scanning suburban streets and Army bases across America.

Hangzhou Hikvision Digital Technology Co. and Zhejiang Dahua Technology Co. may not be household names but chances are their security cameras have filmed you. Together, the two companies control one-third of the global market for video surveillance, according to a report by Deutsche Bank AG, with their cameras securing businesses, airports, schools and government offices in the U.S. -- and around the world. In the U.K. for instance, they keep watch over London’s subway system and have reportedly been installed within the Houses of Parliament.

The tightening noose around Chinese technology firms is driven by the Trump administration’s view that China poses an economic, technological and political threat, a stance that country is likely to retaliate against. The two companies prompted concern that they could be employed in espionage, according to people familiar with the matter. Last week, the administration banned Huawei Technologies Co. from purchasing American technology amid similar suspicions of spying capabilities and Chinese laws that could require home-grown firms to hand over information if asked.

The U.S. is also considering curbs on China’s Xiamen Meiya Pico Information Co., Beijing Megvii Co., and Iflytek Co., that would bar them from buying U.S. components or software, people familiar with the matter said. All three are technology companies and Megvii is one of the world’s most valuable startups working on artificial intelligence.

Hikvision, which is controlled by the Chinese government, and Dahua are leaders in the market for surveillance technology, with cameras that can produce sharp, full-color images in fog and near-total darkness. They also use artificial intelligence to power 3D people-counting cameras and facial recognition systems on a vast scale.

Reports have tied the technology of both firms to the human rights abuses of hundreds of thousands of Uighurs, a mostly Muslim ethnic minority, who have been identified via facial-recognition scanning systems and then locked up in clandestine camps in China.

Lawmakers from both parties have called for U.S. sanctions against Chinese officials over mass surveillance in western China, and Congress in legislation last year called for adding Hikvision and Dahua to the Commerce Department’s blacklist, according to an April letter from 24 senators and 19 representatives. They called for stronger export controls to ensure that U.S. companies don’t help China’s surveillance system.

A spokesman for Hikvision said these concerns were taken “very seriously.” Hikvision has been engaging with the U.S. government to resolve the issue since last October and has retained human rights expert and former U.S. Ambassador Pierre-Richard Prosper to advise the company regarding human rights compliance, the spokesman said. Dahua did not respond to emailed requests for comment.

Hikvision and Dahua have already come under scrutiny in the West, with some security vendors refusing to purchase their equipment. One company removed hundreds of Dahua cameras in 2017 after it found a secret back door in the devices, according to Maryland-based cybersecurity company ReFirm Labs. ReFirm also found that company information had been trafficked off-site via the cameras to an unknown Chinese IP address, according to Terry Dunlap, the firm’s co-founder.

"Given that many other Dahua products contain this exact same backdoor, we strongly recommend against connecting any Dahua products to critical or sensitive networks," ReFirm said in its report of the incident.

Last year, President Donald Trump signed into law a ban on the U.S. government use of Dahua or Hikvision cameras. The law is due to take effect in August.

But already, the ban has slashed Hikvision’s sales in the U.S., said John Honovich, founder of IPVM, a video-surveillance researcher. The company recorded $7.42 billion in revenue in 2018, with about 6% of that from the U.S., Honovich said. Hikvision is likely the second-biggest provider of video surveillance cameras in the U.S., Honovich said. Its cameras are most commonly used in small to medium-sized businesses, like mom-and-pop restaurants, bodegas and corner stores. They’re also scanning affordable housing projects, municipal government offices and schools, he said.

Both Hikvision and Dahua were founded in Hangzhou in 2001 and now run offices in North America, employing hundreds of people. Cashing in on China’s obsession with monitoring its citizens has helped them build a dominant position in a market that BIS Research says was worth $32 billion in 2017 and will grow 16% a year by 2023. In April in Las Vegas, Dahua and Hikvision showcased new artificial intelligence and cloud-based video products at ISC West, the largest security-industry trade show in the U.S.

The U.S. isn’t the only nation blanketed by Hikvision cameras: it sells them in more than 100 countries -- including a contract to provide more than 100 closed-captioned TV cameras and a monitoring system to the parliament of Jordan.

In the U.K., where tens of thousands of government-run CCTV cameras make Britons the most surveilled population among Western democracies, Hikvision has found a ready market for its cameras and increasingly for facial recognition software it sells to go along with them.

Alan West, a retired British admiral who now serves in the House of Lords, said he was concerned the U.K. government had not properly considered the security risks of deploying Hikvision’s cameras or taken steps to limit any risks.

"I don’t mind if someone has looked at this issue in detail and ascertained a way of ameliorating any risks that arise," he said. "But I am not sure that people have actually addressed this issue."

West said he was especially concerned that in the future, with the advent of 5G wireless networks, such cameras could easily be turned into listening devices, providing both audio and video to a hostile power.

Other companies may join the five under consideration in the U.S. on the so-called Entities List, which prohibits the sale of American technology without a special license, according to people familiar with the matter. Hikvision and Dahua’s smaller rival Yitu Technology also makes surveillance hardware, while others such as SenseTime Group Ltd. and Face++ parent Megvii specialize in image processing software and are less reliant on American components.

Hikvision, one of the most popular Chinese stocks for foreign investors, dropped to its lowest price since January. Foreigners have been selling Chinese stocks as a whole: they’ve offloaded 47 billion yuan of mainland-listed equities via exchange links this month, already more than double the total for April, a monthly record.

Morgan Stanley said in a note to investors that it expects Ambarella Inc., which sells video processing chips to Hikvision and Dahua, to be impacted with total revenue exposure “likely in the high teens percentage of sales.”

Hikvision hired Mercury Public Affairs, LLC in August for services that included contacting public officials about the National Defense Authorization Act, according to documents filed with the Justice Department.