Risky Chinese security systems could be used to spy on Ukrainian cities

Several Ukrainian experts have pointed out the potential risks of using internet-connected surveillance cameras, which may provide Russia with better options for intelligence gathering than their native tools, such as spy satellites.

In May, the investigative group UnLawyers highlighted the risks posed by Chinese-made surveillance cameras. In Ukraine, two Chinese tech companies, Hikvision and Dahua, have a near-monopoly in the security technology sector. Before the war, the government installed CCTV cameras supplied by these two companies throughout the country as part of its ‘Safe Cities’ project. Telecommunications equipment from the two companies is also widely used by the Ukrainian police.

Backdoor spying

Dahua and Hikvision are the global leaders in security technology, despite growing concerns about the privacy of their products. In 2022, the two companies had a combined revenue of $15 billion.

As Kyivpost highlighted, a backdoor was discovered in 2017 in several models of Dahua cameras and video recorders, allowing third-party access. In 2022, security researchers discovered vulnerabilities in more than 80,000 Hikvision surveillance cameras that could allow unauthorised people to take control of them. Last year, already during the war, hackers offered tens of thousands of users’ details for sale on Russian forums, with the data also giving buyers access to Hikvision cameras.

UnLawyers believes thet that Russian intelligence is aware of the vulnerabilities of Chinese devices, as the companies supply the Russian armed forces, among others.

Massive profits since the war started

Ukraine is also vary of Chinese security companies due to them still doing business in Russia. Ukraine has officially declared Hikvision and Dahua “international sponsors of the war” for allegedly supplying Russia with equipment used for military purposes, such as reconnaissance drones.

According to Ukraine’s state sanctions database, the revenue of Hikvision’s Russian subsidiary has increased by 42 percent since the outbreak of full-scale war in 2022, and its net profit by 1,526 percent, and doubled the number of its employees as a result. Dahua has not been so successful: according to a company profile by Russian business portal Tadviser, Dahua’s local company’s revenue fell 59 percent from 2021 to 2022.

Vulnerabilities in Chinese products are not necessarily due to design flaws: China’s 2017 National Security Law requires Chinese private companies to cooperate with intelligence agencies upon request. Unsurprisingly, tech companies are also involved in surveillance inside China, such as the Uighur crackdown. According to US and EU agencies, Hikvision has also supplied equipment to internment camps holding Uighurs.

Blacklisted in the West

Hikvision’s name has also previously appeared in leaked Pentagon documents. In a US government document cited by the BBC, Hikvision was described as a “partner of Chinese intelligence organizations” that specifically sought to sell “backdoor” equipment to US government agencies, including the Department of Defense.

Hikvision headquarters in Hangzhou, Zhejiang. Source: wikimedia commons

The US had already banned Hikvision products from government supply chains, and last November regulators went further, imposing a nationwide ban on them, citing national security risks.

In June this year, Chinese security equipment was also blacklisted in the UK: public organizations are no longer allowed to buy from Chinese companies and have been given six months to replace their existing equipment.

Although China is neutral in the war, it is Russia’s partner in geopolitics, so the Ukrainians and their allies believe there is a real risk that they could provide intelligence information to Moscow, including using data collected by security firms.

At the same time, Beijing is apparently careful not to appear as a proponent of Russian aggression. This policy is illustrated by China’s participation in the Jeddah Peace Conference on 6-7 August. Less publicized, but equally significant, is the fact that, following the discovery that Russian forces in Ukraine had deployed Chinese-made modified civilian drones, the Chinese government-imposed export restrictions on several drones and other related equipment.

Use by Hungarian law-enforcment

Despite security concerns, the Hungarian government has on several occasions ordered security systems from problematic Chinese companies. Systems from Chinese companies have been widely installed in state institutions, public authorities and strategic industrial facilities in Hungary.

The National Police Headquarters’ 2017 contract list includes two contracts with Dahua’s Hungarian subsidiary: one for server migration in connection with border guard tasks, the other for Robotzsaru, the police’s own case management system.

In 2021, another Hungarian security agency bought equipment from a troubled Chinese company. According to the Public Procurement Bulletin, the subsidiary of NISZ Nemzeti Infokommunikációs Zrt., Pro-M Zrt. ordered Hyteara brand radio terminals and accessories from a private company for HUF 9 billion. According to the announcement, the devices will be used in the national network for emergency preparedness, disaster management and disaster relief.

Hikvision products are also widely used by Hungarian public institutions. According to data in the Hungarian Electric Procurement System, several Hungarian universities and the Hungarian Academy of Sciences have purchased Hikvision products, and several municipalities use the Chinese company’s security systems, especially surveillance cameras. In 2021, the company’s name also appeared in two public procurement contracts of the Hungarian Police Service: the police ordered Hikvision dome and tube cameras.

In 2022, Hytera’s products were also banned in the US due to data and national security risks.

In July, HVG reported that the new flagship of the Hungarian military industry, the Zalaegerszeg military-industrial complex producing Lynx combat vehicles, almost ordered test chambers, a camera system monitoring the firing range and even a complete access control system from Chinese companies.

According to the newspaper, the Hungarian side would have bought security equipment from the Chinese company YLi, but the purchase was vetoed by the German partner, the Lynx developer Rheinmetall, citing security risks. On the Hungarian side, the plant is owned by N7 Holding through ZalaZone Ipari Park Zrt. The holding is owned by the Ministry of Defence and its director is former Minister of Innovation and Technology László Palkovics.

Written and translated by Zalán Zubor. Hungarian version of this story can be found here.