Blaze News original: The true cost of cheap surveillance: How Chinese tech puts US safety at risk

Is the Chinese government spying on you through cameras manufactured by Chinese companies? According to the FCC and several state governments, the answer might well be “yes,” and regulators are attempting to take action to protect Americans’ privacy.

Two of the largest surveillance camera manufacturers in the world — Hikvision and Dahua — are based in China and have strong ties to the Chinese Communist Party government. Because of the “unacceptable risk” their equipment allegedly poses to U.S. national security, the FCC banned sales and import of new technology from Hikvision and Dahua in 2022.

In recent years, several governments — including Australia, the U.K., and India — have also taken action against the companies.

Blaze News wanted to know to what extent the equipment manufactured by Hikvision and Dahua remains available in the U.S. and whether users are at risk of unwittingly sharing their data with China.

The answers are in some respects disturbing, but in others encouraging.

‘Related to the Communist Party of China’: Hikvision and Dahua

Cameras have become nearly ubiquitous in American culture, and we've embraced them because of their clear benefits. Cameras record precious memories, help secure private property, and even allow governments to identify toll-road users without disrupting traffic flows and nab speeding drivers at low cost.

While few Americans, especially those in younger generations, worry about possible privacy concerns associated with these cameras, even fewer concern themselves about the implications of relying on equipment manufactured by a foreign adversary.

They should.

According to Radio Liberty, a Ukrainian outlet, 20% of all video surveillance cameras in the entire world are manufactured by Hikvision and another 10% by Dahua.

The state of Nevada, for example, prohibits Hikvision and Dahua equipment at all state government offices and agencies out of 'security concerns.'

What’s more, 37% of Hikvision is owned by CET HikGroup, which answers to other organizations run by the Chinese government. Chinese law reportedly demands that businesses share with the Chinese Communist Party some — if not all — of the critical information they glean through normal operations.

“It should be understood that the companies of the People's Republic of China are companies that are closely related to the Communist Party of China. That is, there is no large, completely independent business in the PRC,” said Agia Zagrebelska, head of the Department of Minimization of Corruption Risks at the Ukrainian National Agency on Corruption Prevention, according to Radio Liberty.

“This is not my subjective assessment,” Zagrebelska continued. “These are the requirements of their legislation.”

Federal and state governments here in the U.S. are likewise highly concerned about Hikvision and Dahua. The Department of Defense included both companies on its list of designated “Chinese military companies operating in the U.S.,” a list released the same year the FCC banned sales and imports of the companies' new equipment.

“These new rules are an important part of our ongoing actions to protect the American people from national security threats involving telecommunications,” FCC chair Jessica Rosenworcel said at the time in a statement, according to Tech Crunch.

In April, a federal court upheld the inclusion of Hikvision and Dahua on the FCC’s Covered List, though it ruled that the FCC had likewise defined “critical infrastructure” too broadly when issuing the bans.

At least 10 U.S. states have also imposed their own restrictions on Hikvision and Dahua equipment, IVPM reported. The state of Nevada, for example, prohibits Hikvision and Dahua equipment at all state government offices and agencies out of “security concerns.”

In a statement, Hikvision told Blaze News:

Hikvision disagrees with the FCC’s decision to include Hikvision into the “Covered List,” but it is important to note that the Court “vacated” and rejected the scope of the FCC’s “overbroad” and “entirely implausible” restrictions. Hikvision has always been clear that the company and its products present no threat to national security of the U.S. or the security of American consumers. No respected technical institution or assessment has concluded otherwise.

Possible threats to American consumers

Though federal and state governments have sounded the alarm about Hikvision and Dahua, surveillance cameras manufactured by these companies are still readily available for purchase in the U.S.

A quick search of Amazon reveals that surveillance cameras emblazoned with the Hikvision name are available for as little as $50, with an average cost of about $100. The company even has its own Amazon store, offering an array of products, though notably, no surveillance cameras are advertised there, and the webcam tab is empty.

With its many options and affordable prices, Hikvision views small- and medium-sized businesses as its target client base, according to the Record.

At about $70 per unit, Dahua cameras on Amazon are roughly in the same price range as Hikvision cameras and target the same business market, though Dahua does not have its own Amazon store.

Some may be surprised to learn that equipment manufactured by companies red-flagged by the government may still be sold legally in the U.S., but the reason is rather simple: The FCC banned only new technology from Hikvision and Dahua. Older technology is still available, though it could be banned later should regulators determine that such a step is necessary.

‘Physical separation’: Guarding against cyber menaces

By all appearances, Hikvision and Dahua cameras look like typical surveillance cameras and in and of themselves do not pose a security risk upon installation. Potential problems arise only when these cameras are connected to the internet.

'You've now just given them the keys to the kingdom.'

Many individuals and businesses prefer to connect cameras and servers to the internet to avail themselves of cloud storage and remote-access capabilities. However, users must segment their systems to prevent bad actors — like some foreign companies and governments — from tapping into the devices from the outside.

“It's like having a fence in your yard,” Rob Coté, owner of a small cybersecurity company called Security Vitals, explained to Blaze News. “You have a physical separation, and it … thwarts the potential of a remote data grab.”

“If the cameras had malicious content or the ability for remote access from an external resource built into them and you connect them to your core network, you've now just given them the keys to the kingdom.”

In addition, businesses also ought to position surveillance cameras so as to prevent them from capturing sensitive or proprietary information, knowing that images captured on surveillance could be accessed in the case of a cyberattack.

Thus, while the risk of possible data compromise is significant, average American consumers, even those who are not tech-savvy, can take steps to protect themselves and their sensitive data.

First, they should take the time to do basic research into equipment before making any purchases and, as they would with other products, remain wary of attractive price tags.

Secondly, they should consider purchasing other key cybersecurity equipment such as firewalls from a reputable vendor. Such vendors specialize in securing cyber environments for those without the means or inclination to do so themselves.

“Make sure that those cameras are on a separate network that doesn't touch your key corporate assets or your core resources,” Coté further advised.

In a statement, Hikvision told Blaze News:

Hikvision’s business model in overseas markets generally involves selling products via distribution networks to integrators who then install the equipment at end-user facilities. Hikvision does not install devices at end users’ sites and end users have full control over how the equipment is used, which means that Hikvision, as an equipment manufacturer, has no visibility or access into end users’ video data.

Dahua did not respond to Blaze News’ request for comment.

‘Close rapport between Beijing and Moscow’: Other concerns

As IPVM noted, governments from around the world have likewise banned or at least restricted the use of Hikvision and Dahua products at and by state agencies. Ukraine in particular became wary of the two camera manufacturers because of the recent political alliance between China and Russia.

According to a January report from the Kyiv Independent, Hikvision and Dahua cameras are widely used in Ukraine in both private and public sectors. Should those companies access Ukrainian data and exfiltrate it to China, the data could make its way to Russian military leaders who might exploit it.

'Although the information is sent in encrypted form ... for the manufacturer and developer of these cameras, decoding such information will not pose a problem.'

In fact, the outlet indicated that may have already happened: “Russian intelligence services have reportedly managed to access surveillance cameras, including older Hikvision devices, to guide strikes against Ukraine's cities, for example, during a mass missile attack on Jan. 2.”

While the outlet could not confirm whether Russia had gained access to sensitive Ukrainian data, it insisted that “the close rapport between Beijing and Moscow makes the data transmission a security risk.”

Furthermore, the outlet noted that the older Hikvision and Dahua models — some of which are almost assuredly in use in the U.S. — were easily hacked, creating other security complications.

In practice tests conducted at the behest of Radio Liberty, the Ukrainian outlet cited above, skilled experts could hack into an older Hikvision model within 15 minutes.

Other tests conducted on older models revealed that some servers in countries like Ireland and Germany were actually owned by American companies, including Amazon Web Services, but rented by Hikvision or Dahua, meaning that these Chinese companies effectively retained access to servers in foreign countries thousands of miles away.

“We see that even when the user wants to turn off the connection to the Dahua cloud service, such a connection still continues and information continues to reach the servers rented by Dahua via the internet,” Serhiy Denysenko, executive director of Laboratories of Computer Forensics, told Radio Liberty about a Dahua unit released in 2019.

“And although the information is sent in encrypted form, I believe that for the manufacturer and developer of these cameras, decoding such information will not pose a problem,” Denysenko continued. “And these are precisely the security risks for the user, about which the manufacturer did not inform him.”

In a statement, Hikvision told Blaze News:

As a publicly traded commercial manufacturer, all of Hikvision offerings are designed for civil use. Hikvision declines to comment about the use of its equipment in specific markets. Separately, Hikvision becomes aware of a hack of any kind, it acts swiftly and takes every possible step to address it.

Dahua and Amazon Web Services did not respond to Blaze News’ request for comment.

By far, the most secure “older” model camera that Radio Liberty tested was a Hikvision camera released in 2023. Because the unit demanded a more complex password for sign-in purposes and did not automatically transmit data upon connection to a network, Denysenko described it as “much safer.”

Without more specific details about the model, it is difficult to determine whether that particular Hikvision model is available for purchase on Amazon. But with the FCC banning new technology from Hikvision and Dahua, the agency may have inadvertently prevented Americans from purchasing newer cameras with more advanced, built-in security protections.

'Always on and watching': Hikvision and Chinese detention camps

Bet_Noire/Getty

Another serious problem with Hikvision is its apparent history with the detention camps in China. According to one former detainee, Hikvision cameras installed in the camps ostensibly allowed guards to detect the slightest sound or movement and rebuke prisoners angrily for speaking without authorization.

Ovalbek Turdakun — an ethnic Kyrgyz and a Christian — spent 10 months in a concentration camp in the Chinese region of Xinjiang in 2018. While incarcerated, Turdakun was subjected to horrific torture as well as onerous surveillance reportedly facilitated through Hikvision cameras.

Though prisoners were crowded into cells and shut in for months at a time, they kept almost entirely silent because surveillance cameras installed there were “always on and watching,” Turdakun — who has since defected to the U.S. with his wife and son — told Tech Crunch through a translator.

Prisoners even raised their hand and asked permission when they had to use the latrine hole “because of the cameras watching, always,” Turdakun reiterated. The slightest attempt at conversation incited angry censure transmitted through surveillance cameras.

When shown the Hikvision logo, Turdakun claimed he saw it on all the cameras in the detention camp and in the surrounding Chinese city. While on house arrest, Hikvision cameras positioned in the city would alert authorities to Turdakun’s movements, prompting further harassment, he said.

“The cameras are about [6 feet] in height — also Hikvision — and they’re on every sidewalk,” Turdakun explained to Tech Crunch.

“There are so many of them, they don’t need to change the directions of the cameras. It doesn’t matter how long the road is, even the shortest road will have cameras. The whole entire city has cameras watching.”

Tech Crunch admitted that it could not independently verify Turdakun’s reports but claimed they aligned with other reports given by survivors of Chinese detention camps.

In a statement, Hikvision did not deny its previous association with Chinese detention camps, telling Blaze News:

Hikvision takes all reports regarding human rights very seriously. As a market leader, we recognize our responsibility for protecting people and firmly oppose all forms of forced labor, child labor, and modern slavery. …

Hikvision’s products and technologies serve vital roles in protecting people and society in more than 150 countries. Since entering global markets, Hikvision has and will continue to strictly comply with applicable laws and regulations in the countries where we operate and follow internationally accepted business ethics and business standards. We also continuously review and refine our personal data protection practices and policies to prevent misuse of our products.

Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!