Bloomberg Warns Of Huawei Hisilicon IP Camera UsageBy Charles Rollet, Published on Jan 30, 2019
Bloomberg has picked up IPVM's December exclusive - "Huawei Hisilicon Quietly Powering Tens of Millions of Western IoT Devices" and ran its own report:
Bloomberg's report, which includes warnings from a sitting US congressman about HiSilicon chips, brings renewed attention to the ubiquity of HiSilicon chips in the video surveillance industry.
That is is now a major issue due to the NDAA banning the US government from purchasing Huawei products. HiSilicon is fully-owned by Huawei, and the NDAA ban, which comes into force August 2019, has many wondering if they should stop selling cameras with HiSilicon chips altogether.
The Bloomberg report also included highly dubious claims about Honeywell's production model and ability to track vulnerable camera sales to the US government.
In this note, we examine:
- Congressman: Chinese Chips/Cameras "Cause for Alarm"
- More Evidence HiSilicon Chips Will Be Covered By NDAA
- Who Is Dropping HiSilicon?
- Dubious Claims on Honeywell Tracking & Manufacturing
- Risk of Ban Spreading?
- Still No Official Stance from SIA
Congressman Says HiSilicon Chips "Cause for Alarm," Certainly Covered by NDAA
A major issue is that the NDAA's Section 889, which imposes the Huawei ban, leaves some ground open for interpretation over whether it imposes a ban on US government purchasing of cameras with HiSilicon chips. Another major point of contention is whether the section 'blacklists' private firms selling covered equipment to non-government entities from ever selling to the government.
The precise rules actually implementing Section 889 are currently being drafted and expected to be made public for comment from industry in February.
The Bloomberg report, however, has brought additional evidence that cameras with HiSilicon chips will be covered by the NDAA, thanks to a quote from Rep. Mike Gallagher (R-WI), a member of the House Committee which drafted the NDAA:
Gallagher, the congressman from Wisconsin, said the National Defense Authorization Act unequivocally applies to products from HiSilicon since it’s a fully-owned subsidiary of Huawei.
Recall that this is also the view of the House Committee spokesman previously interviewed by IPVM:
If a company has an end item with HiSillicon chips that they sell to anyone, they will be unable to do business with the federal government.
Bloomberg also quoted Gallagher stating that Chinese security cameras/HiSilicon chips are a "cause for alarm" (the NDAA also bans federal purchases of Hikvision/Dahua equipment):
“It’s related to what China is doing on its own territory: using surveillance cameras to construct a massive, Orwellian state,” [Gallagher] said in an interview. “The prospect of them doing something surreptitiously outside their borders is a cause for alarm.”
Who Is Dropping HiSilicon?
The Bloomberg report prominently mentioned Pelco as a company that is interpreting the NDAA as meaning that HiSilicon chips are "covered" equipment.
Indeed, Pelco has released an online statement identifying its new GFC Professional 4K camera series as using HiSilicon chips. Bloomberg reported that after the NDAA was passed, Pelco "lowered sales goals" for the line and "scrapped any thought" of selling it to the US government.
Bloomberg also incorrectly described the GFC Pro line as "a model with sharper video resolution and other cutting-edge features". However, the line is a 'value' (i.e., low-cost, not "high-end") play and includes common industry features, not "cutting edge" ones.
Regardless, other major players are weighing whether to drop cameras with HiSilicon chips as well. Hanwha marketing director Miguel Lazatin told IPVM it was waiting for clarity from the government:
We are waiting for further clarification and a clearer interpretation of the NDAA next month, if in fact that does happen. The outcome would certainly influence our strategy and direction on the use of 3rd party SoCs including HiSilicon. In the meantime, we are investigating all options but have not made any commitments or determinations.
IPVM has not received news of other major players dropping HiSilicon, however as noted by Hanwha that will likely come when rules are announced next month.
Hanwha: HiSilicon Cameras "Probably" Sold to Government
Lazatin was also interviewed by Bloomberg, and told the outlet (honestly) that it was difficult to tell if Hanwha USA cameras with HiSilicon chips ended up being used by the government, due to the complex web of "distributors and re-sellers":
We probably do sell it to government institutions, but we don’t have good visibility
This is a concern for many manufacturers as the predominant form of selling IP cameras in North America is through wide distribution. Avigilon, now owned by Motorola, is an exception here in both respects, not selling their products through North American distribution and not using any Huawei Hisilicon chips, the company tells IPVM.
Honeywell Dubious Claims
Honeywell, however, was not so upfront. Its spokesman Scott Sayres [link no longer available] told Bloomberg that:
a very small percentage of the company’s cameras use HiSilicon chips and those models aren’t sold to the U.S. government.
This is a highly dubious claim since it is virtually impossible for Honeywell to track where its cameras actually end up. Honeywell sells cameras to distributors who then often re-sell to integrators, and has no say or mysterious tracking ability over where the cameras are actually installed.
The Bloomberg report also stated that Honeywell "produces cameras using manufacturing designs from Dahua." This clunky phrasing leads to the impression that Honeywell cameras are substantially different from Dahua ones, which is inaccurate since the cameras are OEM'd and therefore include Dahua code as well. However, it's worth noting that phrasing was written by Bloomberg and is not a Honeywell quote.
IPVM contacted Honeywell's Sayres by email and telephone for clarification but has not received a response; if we do we will update accordingly.
NDAA Ban Spreading?
Interestingly, Bloomberg also noted concern that the ban spreading beyond the federal government to state & local authorities:
One concern is that the ban may extend beyond the Federal government to local agencies, according to two people familiar with the conversations.
This has already happened to some extent, with the first US city (Suffolk, VA) banning Hikvision last August.
SIA: Still No Position on HiSilicon Chips
Bloomberg quoted the Security Industry Association's October letter urging the government to clarify "ambiguities" in the NDAA.
IPVM has reported one of those requests is "developing a risk-based protocol" that determines whether a product is covered by the NDAA if it has NDAA-covered suppliers. If such a protocol is established, it could lead to a loophole allowing cameras with HiSilicon chips.
To clarify, IPVM reached out to SIA to see if it supported or opposed including HiSilicon chips as part of a prohibited items list. SIA did not take a stand on the issue, instead responding:
While the Bloomberg article raises an interesting question, substantial ambiguities in the statute mean that many implementation details cannot be interpreted with precision until the corresponding federal acquisition regulations are finalized. SIA will continue to work with our video manufacturers as we gather information on the significance of these elements to global supply chains and any potential for impact.
Such a response is nothing new for SIA, which has refused to take a formal stand on the NDAA ban and played dumb over whether OEM products are covered.
Huawei Concerns Rising
With the US government indicting Huawei in 2 cases this week - one for money laundering and sanctions violations and another for theft of trade secrets, Huawei is going to face intensified legal and media scrutiny. This is spilling over into video surveillance, giving renewed attention to HiSilicon chips. After years of ignoring such issues, manufacturers and integrators alike need to pay close attention to what kind of chips their cameras use and what the NDAA implementation rules finally look like.