Around fifty Quebec public organizations use surveillance cameras from the controversial Chinese company Hikvision, suspected of posing a national security risk and participating in the repression of the Uyghur minority in China.
• Read also: Pierre Fitzgibbon’s company distances itself from a Chinese company
City of Montreal, Ministry of Transport, school service centers, universities, integrated health and social services centers and even future seniors’ homes; cheap Hikvision cameras are found almost everywhere in the public network, revealing more than a hundred requests and requests for access to information sent by our Investigation Office.
However, the company Hangzhou Hikvision Digital Technology has had bad press for years. In 2019, the Human Rights Watch organization sounded the alarm by revealing that it had created a facial recognition tool that would be used to monitor the Uyghur minority in China. The scandal had echoes as far as Quebec; the Caisse de dépôt et placement du Québec then decided to sell its shares in the company.
The company also raises concerns in terms of national security, especially since a law since 2017 has required Chinese companies to collaborate and provide information upon request to the Chinese government.
Last winter, Australia removed all cameras from Chinese companies, including Hikvision, from its Defense Ministry and its sensitive sites. The United Kingdom also followed suit by announcing a few months ago the banning of Hikvision from all its sensitive government sites.
In the United States, the sale of any new equipment from the company has been strictly prohibited since last year for reasons of national security.
The United States and the United Kingdom have restricted the installation of equipment from the Chinese firm from 2022.
Screenshots of CNN and The Wall Street Journal websites
Known issues
Over the past few years, several vulnerabilities have been discovered in Hikvision cameras. A group of American researchers experts in video surveillance, IPVM, even lists in a real-time interactive map the thousands of Hikvision cameras that are vulnerable or outright hacked in Europe and the United States.
IPVM lists in an interactive map the thousands of vulnerable or outright hacked Hikvision cameras in Europe and the United States.
Photo courtesy, IPVM
However, the level of risk is considered “acceptable” by the City of Montreal, since the cameras are not connected to the city network. “However, allegations regarding links between Hikvision and Chinese government repression, and regarding data privacy, raise concerns,” commented spokesperson Gonzalo Nunez.
An audit was undertaken by the City following the interview request from our Bureau of Investigation, but it was impossible to know the conclusion for “security reasons”.
In other places, the use of Hikvision is completely uninhibited. The Outaouais Integrated Health and Social Services Center told us that it “practically only has Hikvision in its facilities”.
On their guard
Other institutions that have these cameras say they are aware of the risks associated with their use.
For example, at the Navigateurs school service center in Lévis, they claim to have blocked all computer exchanges of these cameras with the outside world “as a security measure”.
Hydro-Québec, which still has a few Hikvision cameras for “complementary operating needs” has, paradoxically, completely excluded the Chinese company from its purchasing catalog.
The City of Saguenay, which also has Hikvision cameras, told us that it had not purchased other cameras of this brand for more than seven years for security reasons.
“When concerns about Chinese companies, like Huawei, emerged, we stopped using their equipment. For four or five years now, questions of quality and risks have caused information resources to move away from Chinese products in this type of purchase,” said spokesperson Dominic Arseneau.
Same approach at the McGill University Health Center. “For several years, we have no longer purchased Hikvision cameras because they do not meet current standards,” said spokesperson Fabienne Landry, referring to the American ban.
Not a “threat”
For its part, the Hikvision company swears that it has nothing to reproach itself for. She claims that an internal investigation, carried out in recent years at her request by a former American ambassador, proved that she had not been involved in projects in Chinese provinces with the aim of knowingly violating human rights. the person.
“Technical analysis of Hikvision products has never indicated that they pose a threat to national security interests. Hikvision products are subject to strict safety requirements and comply with the laws and regulations applicable in each country,” the company also indicated by email.
4000 Hikvision cameras at the Ministry of Transport
The Ministry of Transport has 4,000 Hikvision brand cameras, acquired in 2022 when the United States had already placed the Chinese company on a blacklist.
In March 2021, the Federal Communications Commission announced that it considered five Chinese companies, including Hangzhou Hikvision Digital Technology, to pose a risk to United States national security.
It was the following year that the Ministry of Transport and Sustainable Mobility (MTMD) acquired its Hikvision cameras to use them mainly for videoconferencing purposes.
Questioned on this subject, the MTMD told us that these cameras were secure and that it made sure to follow the guidelines of the Ministry of Digital Cybersecurity (MCN) in this area.
“To date, the MTMD has not received any directives or orientations from the MCN in relation to Hikvision brand cameras,” spokesperson Louis-André Bertrand told us.
In the dark
Does the Ministry of Digital Cybersecurity consider Hikvision cameras safe? Should public institutions continue to employ them? Impossible to know.
The MCN first told us that it had not issued “any guidelines or recommendations specific to Hikvision cameras”. After several email exchanges, the ministry finally told us that it had carried out “analyses”, but directed us to access to information, a procedure which can take several weeks, to know the conclusions.
However, the ministry should prohibit or “at a minimum” regulate the use of these cameras so that they are used without ever being connected to the web, believes cybersecurity expert and co-founder of Hackfest, Patrick Mathieu.
“If these cameras are used to hold meetings, it is certain that the meeting is connected to the cloud in some way, so it is necessarily possible for China to access that. “That’s not necessarily what it does, but it’s possible,” he explains.
“Even if the company calls itself independent, it is not because it comes from China. Even if she doesn’t do anything [de mal] Currently, that doesn’t mean that she won’t do anything tomorrow morning because China will force her to do so. By default, it is a danger. Not because something necessarily happened, but because it could be dangerous,” says Mr. Mathieu.
THEY HAVE HIKVISION CAMERAS:
- Ministry of Transport of Quebec;
- Hydro-Quebec;
- City of Montreal;
- City and police department of Gatineau;
- City of Laval (the cameras will be replaced soon);
- City of Terrebonne;
- City of Saguenay;
- Transport companies like those of Trois-Rivières and Laval;
- 14 integrated health and social services centers, including all those on the island of Montreal, Laval, Estrie, Outaouais and the Laurentians;
- Hospital Center of the University of Montreal (CHUM);
- Montreal Heart Institute;
- Universities like HEC Montréal and the University of Quebec at Rimouski;
- 23 school service centers, including those in the Capital and Laval.