printer friendly version

Is Hikvision spying on its customers?

Genetec surprised the industry with its announcement last year that its customers would be required to sign a waiver if they wanted to use Hikvision products with its management platform. Since then there have been many news items about Hikvision and the Chinese government having a backdoor into all Hikvision equipment.

Understandably, there has been some consternation about the allegations and this decision by Genetec. Adding fuel to the fire, additional comments made recently by the CEO of Genetec, Pierre Racz, in an article at http://www.securityworldhotel.com/int/News/Business-News/genetec-speaks-out-on-why-Genetec-sees-Hikvision-products-as-security-risks#.WMonj2997IU, have raised the stakes even higher.

In this interview, Pierre Racz’s comments reflect similar comments on IPVM.com. Hikvision refers to the site as “an American blogger site, whose sole business goal appears to be instilling fear, uncertainty and doubt about Hikvision because it is a Chinese company.”

To try and understand more about the issue and whether Hikvision customers need to be worried, Hi-Tech Security Solutions sent a few questions to Hikvision SA’s MD, James Dong, regarding the public disagreement between the companies. At the same time, Hikvision’s corporate marketing team sent Hi-Tech Security Solutions a statement concerning the comments made by Racz.

We have printed the statement below, which are followed by Dong’s answers.

Hikvision responds

‘Governments are concerned’: In the interview with Detektor magazine, Pierre Racz proclaims that “governments have told us they are extremely concerned with the origin of these [Hikvision] products.” Racz does not specify which governments are concerned, but those governments must have their proverbial heads in the proverbial sand, because there are no secrets about the origins of Hikvision products. All Hikvision products are proudly ‘made in China’.

Hikvision products are manufactured, inspected and tested in world-class factories in Hangzhou, China, a city that Westerners often refer to as the ‘Silicon Valley of China’. Hikvision regularly hosts security integrators and security professionals from the West and all over the globe for tours of our factories. Our visitors are interested to see our industry-leading cyber security best practices at work, and how we continually increase efficiency by using robots and other sophisticated processes, and they’re also interested in witnessing the sheer scale of our operation.

Chinese government access: Genetec’s leader regurgitates insinuations about Hikvision products providing access to the Chinese government. This claim is absurd. There is no motive for a commercial company to provide access to a government, whether it is an American or Chinese company. Hikvision has sold tens of millions of network-connected devices – IP cameras and NVRs – that sit on the Internet. There is no report anywhere that such access has taken place. Any claim otherwise is just hogwash.

Furthermore, anyone who knows anything about technology and engineering understands that these arguments are laughable. Interestingly, the Genetec leader appears to lack understanding of how the systems work, and he appears to have very little respect for the infosec professionals who protect their companies.

A video surveillance system is comprised of front-end devices, backend devices, network devices and a system platform. This is where the CISOs and other infosec professionals come in. If any change is made to an edge device – like a camera – it would immediately be detected by the network devices and security platforms.

False claims: Pierre Racz is fabricating disinformation about Hikvision’s ownership and financing. He says that Hikvision is “owned by the government and has been given a $6 billion subsidy”.

These claims are false, misleading, and irresponsible. Hikvision is a publicly traded company, listed on the Shenzhen Stock Exchange. As of 30 September 2016, our shareholders include government entities (42% of our stock is held by two state-owned enterprises). Major stockholders include a Hong Kong businessman, and common-shares investors, including international institutional investors. UBS AG and JP Morgan are among Hikvision’s top 10 shareholders.

Also, the subsidy myth has been debunked repeatedly. Like other major corporations, Hikvision uses different types of financing channels such as an IPO, bank credit facilities and bond issuances.

In August 2016, Hikvision closed a credit facility of more than $3 billion with the Export-Import Bank of China. In November 2015, Hikvision secured approximately $3 billion line of credit with the China Development Bank.

These are lines of credit. If and when Hikvision takes a loan on a credit line, the entire amount must be repaid with interest. It is not a subsidy or free gift. It works the same way as the other lines of credit that Hikvision has with other international financial institutions including Citibank, HSBC and Deutsche Bank, among others.

Genetec also makes assertions that Hikvision is not a commercial entity or is somehow not interested in commercial success. We are the world’s leading video surveillance provider with extremely strong growth. Our preliminary 2016 financial results, released last week show year-over-year overall revenues increased 26% and overall profits increased 24%. We’re also establishing a Research Institute in Silicon Valley in California and an R&D Centre in Montreal, where Genetec is located.

James Dong, MD of Hikvision SA responds

Hi-Tech Security Solutions: What is Hikvision’s comment on the claims that it has a backdoor into its equipment?

James Dong: please refer to the above answers: Chinese Government Access. It’s important to consider the source and motivation of anyone who would make this kind of baseless allegation. Those who promote the absurd idea should be asked to provide facts rather than sensationalist headlines and innuendo.

Hi-Tech Security Solutions: How does Hikvision respond to Genetec’s decision to restrict access to its equipment? Are other software providers doing the same? Given the number of Hikvision cameras and recorders in the market, what do you think prompted this unprecedented move from Genetec?

James Dong: We believe this is an unfortunate move by Genetec, which purports to be ONVIF compliant and an ‘open’ platform. It’s also unfortunate for integrators and end-users. Genetec has not produced any evidence that this decision is based on product technology. We believe it is politically motivated and designed to negatively influence perceptions about Hikvision’s approach to cyber security.

At Hikvision, we always stand up and take responsibility and we always will. While some do a lot of talking, we’re taking action every day to make Hikvision products as secure as possible. Constant improvement is built into our product development processes. In addition to our Network and Information Security Lab, The Hikvision Security Response Centre (ISO/IEC 27001 certification), and Hikvision Security Centre. We are working with CISCO and other top-notch companies to benchmark product security requirements, security design and security testing.

We regularly invite international organisations, such as Ernst & Young, to further evaluate and advise on our security system. We have also worked closely with renowned security companies such as Symantec, Synopsys and IBM. We are willing to cooperate on enhancing product safety with companies from all over the world.

Fortunately, Hikvision works with a number of excellent, and truly open VMS providers. We’re in touch with our customers and partners and can always discuss options.

Hi-Tech Security Solutions: In your opinion, what is the reason behind this sudden uncertainty and the allegations against Hikvision?

James Dong: Those allegations are baseless and irresponsible. Hikvision is the largest video surveillance provider in the world, with the largest R&D team in the industry. We’ve created thousands of good jobs around the world in the regions where we do business and we’ve made significant, positive contributions to the communities where we do business. Helping security professionals combat terrorism and criminal behaviour is why we’re in this business. We are focused on working with leading systems integrators and their end-user customers to safeguard people, property and assets.

There are a few industry people who intentionally downplay Hikvision’s engineering capability and capacity in the blogosphere. Perpetuating the idea that China-based engineering and innovation is not as advanced as Western countries is fundamentally wrong and discriminatory.

We try to answer any questions that may arise from this kind of article from legitimate news outlets such as Hi-Tech Security Solutions, but mainly we’re focused on running our business.

Hi-Tech Security Solutions: One of the comments made is that Hikvision is owned by the Chinese government. Is this true or is Hikvision listed on the stock exchange like any other company?

James Dong: I’m happy to discuss Hikvision’s ownership as this is public information, readily available on our website for anyone to see since our IPO and début on the stock market in 2010. Hikvision is a global, publicly traded company. There are four major shareholder groups in Hikvision: state-owned enterprise shareholders (SOEs); an individual investor; company founders and executives; and, common-share/international institutional investors. So, while Hikvision has shareholders who are SOEs or ‘government controlled’ entities, Hikvision itself is not an SOE.

Please refer to the above answers on ‘False Claims’ about Hikvision’s current shareholder structure.

Hi-Tech Security Solutions: What would Hikvision say to its customers in Africa who may be concerned that their Hikvision installation may be insecure or that third parties may be able to access their surveillance equipment?

James Dong: Hikvision is a security equipment manufacturer. Hikvision products are sold through authorised distributors to system integrators and installers. Authorised system integrators and installers install, maintain and service Hikvision products. We work with our integrators, installers and end users on best practices for cyber security.

Hi-Tech Security Solutions: If anyone is concerned about the security of their Hikvision equipment or installation, where can they go, or who can they speak to for clarity?

James Dong: As aforementioned (in your second question), Hikvision has the industry-leading cybersecurity practices. Besides, Hikvision Security Centre, (www.hikvision.com/en/list01_435.html) on the Hikvision website provides up-to-date security notices, tips for best practices, and contact information to report a security concern or potential vulnerability. Additionally, the Security Centre has detailed instructions on how to change passwords and upgrade firmware on Hikvision IP cameras and recorders.

This year, in our road shows and seminars which will be held throughout Africa and in other regions/countries, we will have our cybersecurity expert to speak on cybersecurity best practices and keep our distributors, integrators and end users informed about potential cybersecurity risks.

Share this article:

Further reading: