REL: Chinese cameras increase risk of Russian attacks in Ukraine

As Ukraine's full-scale Russian invasion nears its second anniversary, hundreds of thousands of security cameras of Chinese companies -- Hikvision and Dahua -- used by government-led security systems and private companies across Ukraine -- are increasing the risk of Russian Army attacks, Ukrainian digital security experts warned and government officials.

When Russian missiles attacked Kiev on January 2nd, killing at least three people, two regular security cameras CCTV one located in one building, others in a parking lot helped Ukraine State Service (SBU) support their claims.

After the cameras were hacked, the Russian intelligence service used them to “spy out the Protection Forces in the capital” and recorded “images of critical infrastructure buildings”, the SBU said.

One of these cameras was a device of the 2016 Chinese Hikvision production, said a ranking officer for the Ukrainian Radio Service Research Unit Free Europe Schema. This official sought to remain anonymous because of the sensitivity of the case.

“Such cameras are usually connected only to the internet and are but old-fashioned means, with software that has not been updated for a long time and there are many weaknesses”, said Serhiy Denysenko, executive director of the Ukrainian information safety company Digital Forensics Labatory.

The camera manufacturer “base” means that “bakers either, in this case, Russian special services that control the internet, can find this camera and have access to”, Denysenko said.

To test SBU's claims, a Digital Forensics Laboratory specialist managed to avenge a 2015 Hichvision CCTV camera for 15 minutes.

From 2014 to 2022, three Ukrainian companies imported over 875,000 CCTV cameras and other video surveillance devices produced by Hikvision. Only one company imported about 1.1 million cameras and other surveillance devices produced by Dahua, according to data for import-export of the database, ImportGenius.

Other companies also imported smaller numbers of equipment produced by Hikvision and Dahua, companies that dominate the world market for video surveillance and rank as the most imported CCTV cameras in Ukraine.

They also rank among the most controversial cameras in the world. In 2022, the United States Federal Communications Commission banned new authorisations for import or sale of “communication devices” of Hikvision and Dahua. The argument of this commission was that they presented “as an unacceptable risk to national security”. Australia, Taiwan, the United Kingdom and other countries have also imposed bans or restrictions on the use of these cameras.

But such regulations do not exist in Ukraine, even though in 2023 the state named them as “international war sponsors” Hikvision and Dahua Technology because they pay taxes in Moscow and sell equipment that has military uses”.

A Chinese Foreign Ministry spokesman told Reuters on February 1st that China “staunchly objects to the inclusion of 14 Chinese companies on the Ukraine list, and “requires Ukraine to correct its mistakes immediately and eliminate the negative effects”.

However, this spokesman did not address the issue of possible consequences from the retaliation of Chinese-made CCTV cameras.

Hikvision and Dahua cameras and software make up 74 percent of the CCTV systems used in Ukraine's national system for surveillance through street videos, parks, residential buildings and other public spaces, according to the Interior Ministry.

Another 24,000 cameras of Hikvision and Dahua companies are used in similar public surveillance systems, the Ukrainian Interior Ministry said in a reply. REL.

Russian video surveillance system T REL reported in December that it was used in the closed Chernobyl nuclear plant, but also in several other Ukrainian countries and sensitive buildings, such as the Ukrainian naval ports administration of Odea é in many cases uses Hikvision cameras, though T A SSIR has its own software.

REL has asked President Voldymyr Zelensky's office, the cabinet of ministers, the National Security and Protection Council and the SBU if they believe these cameras pose security risks and if Kiev plans to remove these devices from Ukraine. None of these institutions answered.

Experiments conducted by Digital Forensics Labority and Digital Security Labatory, a nongovernmental organisation in Kiev, showed that the cameras of Hikvision and Dahua companies are vulnerable to hackers and that they send encrypted data to servers controlled by Chinese companies, which are partly or under full control of the state.

A 2015 Hikvision camera easily accepted a password that easily retaliated “1234567890” to lock in. A 2023 model of this company demanded a more complicated password with symbols, but it sent encrypted user data and registration data to a Chinese-owned China-owned server, which is a provider of Chinese state-owned internet services.

A 2019 camera of the Dahua company, even when its connection to the server was turned off, again sent encrypted information, including the password and name of the user, to the servers in Germany, run by UCloud of China, a state company, and to the private American company Zenlaer.

The security of information transfers from CCTV depends on the manufacturer, connection to the server and “anyone can use this information and like”, said expert from Digital Security Labority, Ivan Antonyuk. “The question is: Do you trust Chinese developers or not?

Although the information is encrypted, “the definition of such information will not pose a problem for the producer and developer of these”, Denysenko said.

Our “Experts are convinced that when such a service is used, if necessary, the manufacturer's representatives may easily have access to camera”, he said. “also, given the current reports between China and Russia, this may carry some security risks”.

Radio Free Europe did not find direct evidence that China has transferred images from Chinese CCTV cameras in Ukraine to the Russian Army, but there is legal framework for such transfers.

China, whose ties with Russia from both states are described as being of a strategic partnership “without borders”, publicly does not support Russia's fight against Ukraine.

China's National Intelligence Law envisions that companies hand over government data if this is necessary because of security reasons. Beijing has access, “essentially unhindered”, to internet servers in China, CPO Magazine reported, which is a Singapore website that tracks data privacy.

Chinese companies have no power to protect users from digital rights violations by one of the most powerful and irresponsible governments in the world”, Ranking Digital Rights, an international project of the Washington-based New America Institute, wrote in 2020.

The largest Hikvision card, with 36.35 percent of shares on the company's website, is the state-owned Electronics Technology HIK Group, which is a subsidiary of China Electronic Technology Corporation Group. This firm, known as CETC, has listed contributions to China's defence industry, including “electronic warfare” and fears.

Dahua Technology also has an important government shareholder: China Mobile, a telecommunication firm with 9.5 percent of the company's shares. China Mobile is owned by the state and Dahua has said that this company has no “operational control” or “unnecessary impact on decision-making” of the camera company.

In 2022, the U.S. Department of Defense named the companies Dahua and Hikvision, but also the Chinese state companies China Mobile and CETS, such as the “Chinese military company” Corporation, whose technical skills the Chinese army uses.

In a report published in July 2023 by the US National Intelligence Director's Office found that despite international sanctions and export restrictions, China “is offering several dual-use technologies that the Moscow Army is using to continue the war in Ukraine”.

The sharing of intelligence information is also part of the Guide of China and Russia towards Military Co-operation 2021-2025, Congress Research Service noted.

REL contacted Hikvision and Dahua companies to ask for the safety of their cameras in Ukraine and if they co-operate with Russia, but these companies did not answer the questions sent.

The American branch of Dahua Technology, however, claimed in July 2023 that the technology giant only sends “products and peripheral access” to Russia and that “none of our global products is currently not designed for military use”.

The SBU said on 2 January it has blocked more than 10,000 CCTV cameras in Ukraine since Russia began its full-scale invasion on February 24th 2022.

Responding to a question sent by REL in January, Ukraine's Interior Ministry said that “does not recommend or adopt” the purchase of CCTV cameras of Hikvision and Dahua companies, and that this institution is demanding that such cameras used by Government-controlled video surveillance systems be replaced.

According to the Ukrainian public procurement database Prozorro, several government organs, such as the Zolochiv village council in the Kiev region, have begun to scrap cameras contracts, calling for security concerns after Hikvision and Dahua were named as the “international war sponsors”.

The existing surveillance systems using cameras of Hikvision and Dahua companies were deliberately placed “in a closed local network” without access to “on the public internet” so that “prevents the risks of leaking information” to China, Ukraine's Interior Ministry said.

This minister has proposed a bill for a unified “system” of CCTV that would function with software produced by Ukraine and Israel. However, such legislation has not yet been submitted for vote.