United States. A report by Bloomberg notes that U.S. federal agencies have five weeks to remove Chinese-made surveillance cameras in order to comply with a ban imposed by Congress last year in an effort to thwart the threat of espionage from Beijing.
But thousands of devices are still in place and most likely won't be removed before the Aug. 13 deadline. A complex web of logistics agreements and supply chain licensing makes it nearly impossible to know whether a security camera is actually made in China or contains components that would violate U.S. rules.
The National Defense Authorization Act, or NDAA, which outlines the budget and spending for the Department of Defense each year, included an amendment for fiscal year 2019 that would ensure federal agencies do not purchase Chinese-made surveillance cameras. The amendment singles out Zhejiang Dahua Technology Co. and Hangzhou Hikvision Digital Technology Co.
The report notes that Hikvision is 42% controlled by the Chinese government (allegations denied by the company). Dahua, in 2017, cybersecurity firm ReFirm Labs discovered that it had cameras with covert backdoors that allowed unauthorized people to access them and send information to China. Dahua said at the time that he fixed the problem and took out a public notice about the vulnerability. The U.S. government is considering imposing more restrictions by banning both companies from buying U.S. technology, people familiar with the matter said in May.
"The video surveillance and security equipment sold by Chinese companies expose the U.S. government to significant vulnerabilities," said Rep. Vicky Hartzler, a Missouri Republican, who helped draft the amendment. Removing the cameras "will ensure that China cannot create a video surveillance network within federal agencies," he said at the time.
Dahua declined to comment on the ban. For its part, Hikvision said in a statement that it complies with all applicable laws and regulations and has made efforts to ensure its products are safe. A company spokesman added that the Chinese government is not involved in Hikvision's day-to-day operations. "The company is independent in the business, management, assets, organization and finances of its controlling shareholders," the spokesman said.
Despite the looming deadline to comply with the NDAA, at least 1,700 Hikvision and Dahua cameras still operate in places where they have been banned, according to San Jose, California-based Forescout Technologies, which has been contracted by some federal agencies to determine that systems are running on their networks. The actual amount is likely to be much higher, said Katherine Gronberg, vice president of government affairs at Forescout, because only a small percentage of government offices actually know which cameras are operating. Agencies that use software to track devices connected to their networks should be able to comply with the law and remove cameras in time, Gronberg said. "The real problem is that organizations don't have the tools to detect banned devices," he added.
Several years ago, the Department of Homeland Security attempted to force all federal agencies to protect their networks by tracking all connected devices. As of December, only 35% of the required agencies had fully complied with this mandate, according to a 2018 report by the Government Accountability Office. As a result, most U.S. federal agencies still don't know how many or what kind of devices are connected to their networks and are now left trying to identify the cameras manually, one by one.
Source: Bloomberg.
