US Congress Passes Bill Banning Dahua and Hikvision

I'm beginning to wonder if Congress has seen a credible threat to infrastructure security. I'm not referring to the typical "cold war" mentality we see from not wanting to do business with the Chinese because they're the Chinese. But because the government has seen code or other hard evidence that something nefarious is going on within Hikvision cameras. 

This Facebook commenter has an interesting marketing strategy to sell Dahua and Hikvision:

Hard to see how this does not imact OEMs, particularly given change in bill language you report.

e.g., Honeywell puts their label on equipment produced by Dahua or Hikvision

But they don't just relabel the products, they heavily customize the firmware to make it their own. (/SARCASM).

Seems to be more of an effort aligned with the Trump "Trade War" than actual protection of US government facilities. These companies sell OEM version of the camera that run their standard FW with a bit of rebranding dress-up in the GUI but essentially no different that a standard Hik or Dauha camera. Are these OEM products also banned? Seems narrow and short sighted only aimed at the big Chinese brands to make a political statement rather than protect infrastructure critical to national security. Don't get me wrong, I like the bill but it could have gone further if the true goal was to protect the country.

The wording in the bill infers that these products are a security risk but I don’t see wording that really describes what the security risk is exactly.  Perhaps the Bill doesn’t need to explain that but I don’t want to assume. 

If someone really knows what drove this could they let me/us know? 

To be clear – I am asking about what the bill sponsors learned about specifically that got them to add Hikvision and Dahua? 

I know about all the issues related to these two manufacturers, so I don’t need someone to say that was it, unless that is the real answer, i.e. that someone in the industry got the ear of the bill sponsors etc.

OR, do we know that someone within the federal government literally brought these two manufacturers to our law makers attention because of specific incidences that were egregious that went above other typical Chinese manufacturers.

OR, are we saying this is only a political move, as some have suggested this is just part of the China tariff war that is ongoing and growing.

Would be great to know so that we can take advantage of this information and use it to inform our customers more effectively.

Referring to the physical security surveillance of critical infrastructure, does this ban extend to the projects funded by the Government only, or by the commercial entities as well that own critical infrastructure like utilities and chemical plants?

Pentagon Creates 'Do Not Buy' List of Chinese and Russian Software Providers

Would this be banned?

Asking for a friend, (J.D.) ;)

Stock update: Both Dahua and Hikvision stocks have been hurt by recent US government actions, Dahua more so.

Dahua was down 6% overnight and is now almost down 50% from its peak earlier this year:

Hikvision was down ~4% overnight and is down ~28% from its peak earlier this year but still higher priced than it was a year ago ($31.91 now vs $28.01 a year ago):

Both are still richly priced relative to Western video surveillance manufacturers.

YouTube video talking about the ban:

Also, SecurityInformed article: Congress Passes Government Ban On Hikvision And Dahua Video Surveillance

Still waiting on similar announcements from:

Do you think this will spark any innovation on the camera side of things?  With +100 plus companies OEMing them with basically the same cameras and different firmware which are going to have to look at other options I would think we might see some new camera innovation out of this.  yes/no?

NOTICE: This comment has been moved to its own discussion: Do You Think The US Government Ban Will Spark Any Innovation On The Camera Side Of Things?

Looks like that HikVision Source Code Transparency Center only for government agencies just became a white elephant... 

So if this is really a security issue, and given the modular nature of camera components, and the overall Chinese manufacturing base, then how can other Chinese manufacturers be overlooked? 

And then let's take this a step further.  What are the requirements for a US company to manufacture there? 

While focusing on market leaders might be efficient on getting to the most Chinese camera/lenses/lighting/storage/etc. units it still leaves a lot of thing still open. 

Does beg the question: Does GSA say no Chinese made IT products period?

Thanks John, appreciate you confirming this.  It pretty much has always been the case for infosec and physical access, so I guess this is a lot about closing a gap that should not have gotten by in the first place.  The GSA Approved Products List for physical security has, as you point out, pretty clear provisions on source of manufacture, it seems that these are example of (video surveillance) security systems skirting rules already in place for things like PACS basically due to the absence of domestic (or trading partner country) approved sources.

going main stream

see youtube link

I can't believe I had to explain to a security integrator why he shouldn't use Hikvision in a high end application THIS MORNING, five years after this post.

NOTICE: This comment has been moved to its own discussion: I Can't Believe I Had To Explain To A Security Integrator Why He Shouldn't Use Hikvision In A High End Application