B4| Monday, October 21, 2019 THE WALL STREET JOURNAL.
fect, Hikvision and Dahua cam-
eras were still available for
purchase on a U.S. govern-
ment-operated marketplace
where departments and agen-
cies buy equipment, The Wall
Street Journal found last
month.
An effort across the govern-
ment, led by the Office of
Management and Budget, may
draw up directives on what
equipment agencies could buy
and continue using, Ms. Man-
fra said. One civilian depart-
ment that Forescout declined
to identify had 4,277 security
cameras installed on its prem-curity, said the government
was juggling the potential need
to replace the suspect cameras
with security demands that
could require them to remain in
place—while also considering
the cost of replacing the items.
“It’s not that agencies
aren’t concerned about the
risk, or that they’re unwilling
to take actions,” Ms. Manfra
said. “It often just comes
down to, they’ve got to bal-
ance all these different needs.”
Efforts to curb the use of
Chinese equipment have run
into roadblocks. After the
sales ban on cameras took ef-TECHNOLOGY WSJ.com/Tech
JOHN G. MABANGLO/EPA/SHUTTERSTOCKing to have the provision re-
pealed and would consider le-
gal steps to fight it. Dahua
said its addition to the black-
list lacked any factual basis
and called for a reconsidera-
tion. “I think everyone is re-
ally concerned right now,” said
a Senate staffer involved in
legislative efforts to curtail
the use of Chinese technology
by the U.S. government. In ad-
dition to specific credible
threats, he said lawmakers
were anxious about broader,
less-well-understood cyber
threats linked to China.
Although there are known
vulnerabilities with some of
the Chinese equipment, get-
ting some departments to take
the threat seriously has been a
challenge, according to a high-
ranking IT official who re-
cently left the government.
“There are a significant num-
ber of people who are in de-
nial,” he said. “They don’t be-
lieve the problem is that big a
deal, and can be managed and
mitigated in other ways.”
Security researchers for
some time have raised con-
cerns about vulnerabilities in
Dahua and Hikvision cameras.
ReFirm Labs, a Maryland-
based cybersecurity company,
found in 2017 that some Da-
hua cameras could allow in-
truders access to the video
feeds. Dahua released updated
firmware to address the issue,
although ReFirm co-founder
Terry Dunlap said a different
backdoor appeared in the new
firmware version.
A Dahua spokesman said
the company constantly posted
cybersecurity updates to its
website and was committed to
release fixes to any vulnerabil-
ities as they were discovered.
The Department of Defense
has long been ahead of civilian
agencies in addressing cyber-
security risks, said Greg
Touhill, a retired U.S. Air Force
general and the first Federal
Chief Information Security Of-
ficer, until he stepped down in- But, in some cases, the
military keeps equipment
when the cost to remove and
replace it outweighs security
concerns, said Mr. Touhillt.
Thousands of Chinese-made
surveillance cameras remain in
use at U.S. military installa-
tions and other government
sites after purchases of such
devices were banned, highlight-
ing the hurdles in replacing
costly equipment to address
national-security concerns.
More than 2,700 of the
banned cameras are in opera-
tion across the federal govern-
ment today, according to data
from Forescout, a security-
technology company that de-
tects equipment on networks
under contract with the fed-
eral government. The total is
likely higher because Fo-
rescout doesn’t have contracts
to monitor all government
networks and not all of its
customers share their data
with the company.
Congress last year passed
legislation that prohibits fed-
eral agencies from buying
equipment made by several
Chinese companies, including
Hangzhou Hikvision Digital
Technology Co., 42%-owned
by the Chinese government,
and Dahua Technology Co., a
privately owned Chinese sur-
veillance-equipment maker.
The legislation was driven
by concerns that using the
equipment on U.S. military in-
stallations, police departments
and embassies posed security
vulnerabilities the Chinese
government might exploit.
China has relied heavily on
Hikvision to monitor its 1.4
billion citizens, including eth-
nic minority Uighur Muslims.
The legislation directed
agencies not only to stop buy-
ing the equipment but also not
to renew contracts involving
use of the cameras. The provi-
sions don’t require removal of
already installed cameras, but
experts suggest that was the
spirit of the legislation.
“That is a clear expression
BYASAFITCH
U.S. Still Uses Suspect Chinese Cameras
Thousands of the
surveillance devices
are in use at military
and government sites
ises. Of that total, according to
Forescout data, 659—or about
15%—were made by a pair of
Chinese companies whose
equipment has since been ex-
plicitly banned.
The Department of Com-
merce this month added Hikvi-
sion and Dahua to an export
blacklist that requires their
U.S. suppliers to gain licenses
to ship components. The com-
panies, along with others
added to the list, “have been
implicated in human-rights vi-
olations and abuses in the im-
plementation of China’s cam-
paign of repression, mass
arbitrary detention and high-
technology surveillance
against Uighurs, Kazakhs and
other members of Muslim mi-
nority groups” in northwest
China’s Xinjiang region, the
department said.
A Hikvision spokesman said
the company went to great
lengths to ensure its products
were secure and adhered to
federal-government standards.
A person close to Hikvision
said the company was lobby-of intent in my mind,” said
Katherine Gronberg, the vice
president for government af-
fairs at Forescout. It is also
common sense, she said, that
if technology is found to pose
a risk it should be removed.
Attempts to reach Rep.
Vicky Hartzler (R., Mo.), who
led the inclusion of the camera
ban in the National Defense
Authorization Act that passed
last year and which took effect
Aug. 13, were unsuccessful.
A Defense Department
spokeswoman said the agency
wouldn’t comment on security
risks of specific products but
said measures were being
taken to ensure the security of
the supply chain and to in-
spect equipment for vulnera-
bilities.
Agencies have been slow to
remove such items from their
networks, in part because of
the cost and complexity of re-
placing them, former govern-
ment IT officials said.
Jeanette Manfra, the Depart-
ment of Homeland Security’s
assistant director for cyberse-After the sales ban took effect, Hikvision products were still available on a U.S. government-operated marketplace.NG HAN GUAN/ASSOCIATED PRESSBUY DIRECT
FROM THE ARTIST
AT BROOKLYN’S
LEADING ARTIST FAIR
130 ARTISTS
GLOBAL MEDIA PARTNER1000S OF ARTWORKS INSTALLATIONS WORKSHOPS DJS
USE CODE ‘FAIR25’ FOR
25% OFF FRIDAY-SUNDAY TICKETS
BOOK NOW AT NYC.THEOTHERARTFAIR.COM
IN PARTNERSHIP WITH