Congress Probes ADI & Costco Over Selling Dahua and Hikvision

Two of the largest sellers of security products globally, Resideo's ADI and Costco, are being questioned over "threaten[ing] national security" and "subsidizing the Chinese Communist Party’s atrocities" for selling Hikvision and Dahua.

This represents a major escalation against ADI and Costco, who have so far continued to support these companies despite NDAA and now FCC bans.

In this report, we examine Congress' letters to ADI and Costco, the questions they asked, and what the impact on ADI and Costco could be.

Background: ADI Hikvision/Dahua Sales

ADI, run by CEO and former Naval Officer Rob Aarnes, is the largest distributor of Hikvision and Dahua in the United States. In contrast to Wesco/Anixter, which dropped Dahua and Hikvision, ADI continues to promote them avidly.

For instance, earlier this year, ADI touted Hikvision as "today's best IP security cameras":

Plus, in an email blast a month ago, ADI said Hikvision has "unrivaled" access control:

Indeed, in April, ADI placed a huge order with Hikvision - estimated at tens of millions of dollars - just after Wesco/Anixter’s announcement.

ADI once secretly relabeled Dahua for an in-house camera series, only stopping in 2022.

Background: Costco Dahua/Lorex Sales

Costco currently sells Lorex equipment despite Best Buy, Lowe's, and Home Depot all dropping Lorex in 2021.

Lorex was long owned by Dahua, selling Dahua products relabeled as "Lorex." In February 2023, Dahua sold it to Skywatch, a Taiwan company. But this change of ownership does not mean Lorex products are not still Dahua. Even if Skywatch wanted to manufacture its own video surveillance equipment, it has never done so, and it would take significant time to start production.

Congress Probes ADI and Costco

On October 31, 2023, the Congressional-Executive China Commission (CECC) sent letters to ADI and Costco regarding their ongoing sales of Dahua and Hikvision. The CECC is a bipartisan commission composed of Members of Congress and the executive branch.

In each letter, Congress questioned the companies about selling Hikvision and Dahua products, given multiple human rights and national security concerns. Both asked a series of questions of the companies and indicated they could be called to testify before Congress.

The letters were signed by CECC Chair Congressman Chris Smith (R-NJ) and Co-Chair Senator Jeff Merkley (D-OR). The full release is now available.

Accuses ADI of Marketing Dahua and Hikvision as NDAA Compliant

In its opening, the letter to ADI accuses them of marketing Dahua and Hikvision equipment as "NDAA compliant":

In addition, the sales of Hikvision and Dahua cameras to US federal agencies is prohibited by the National Defense Authorization Act. Despite this, we found ADI’s U.S. website still lists nearly a dozen Hikvision or Dahua security equipment as NDAA compliant, apparently marketing to those covered by the ban. [emphasis added]

While IPVM has not previously covered this, we confirmed that Hikvision and Dahua cameras was both listed (March 2023) on ADI's page for NDAA compliant solutions:

So was a Dahua camera:

(UPDATE 11/06/23) IPVM confirmed that several other banned products were listed on ADI's NDAA-compliant page prior to the letter, and product pages clearly identified them as NDAA compliant (e.g. 1, 2, 3).

Now, rather than changing "Yes" to "No", the field has simply been removed:

Currently, ADI's NDAA Compliant page no longer lists Hikvision/Dahua.

"Recognized Threat": National Security Concerns Examined

The letters raise numerous national security concerns about selling Hikvision and Dahua, with the letter to ADI stating:

• "Equipment manufactured by these companies is a recognized threat to American users" as they are NDAA-banned and "could be leveraged" by PRC intelligence agencies.
• The products "posed an 'unacceptable risk' to national security" the FCC has found as part of its November 2022 ban.
• Hikvision and Dahua gear is "vulnerable to spying from hackers", worsened by Hikvision using PRC servers from PRC firms Tencent, Alibaba, and state-owned Chinanet.
• US intelligence found that Hikvision Relabeling May Compromise US Military Networks, with the CECC asking ADI if it is "engaged in such practices".

The letter to Costco cites most of the above while adding:

• Lorex products are a "known security risk" to US consumers as "critical vulnerabilities are regularly discovered in Dahua products" (e.g. Dahua New Critical Vulnerabilities 2021, Dahua Wiretapping Vulnerability).
• The PRC's 2017 National Intelligence Law "requires Dahua to support national intelligence work" (see PRC's 5 Cybersecurity And Data Laws Explained).

"Linked To PRC's Genocide": Human Rights Record Raised

Human rights concerns are also prominently addressed, with the letter to ADI noting:

• Hikvision and Dahua have both been sanctioned for "providing equipment to PRC government facilities used to arbitrarily detain over one million ethnic Uyghurs".
• Hikvision cameras are used by PRC police to "arbitrarily identify specific innocent individuals" for detention such a "Uyghurs returning from abroad" (see Hikvision Cameras Used to Catch Uyghurs Featured in Xinjiang Police Files.)
• Dahua is "linked to the PRC's genocide through its development of 'Uyghur alert' and tracking technology" and "discriminatory facial recognition" (see Dahua Racist Uyghur Tracking Revealed and Dahua Provides "Uyghur Warnings" To China Police.)
• Dahua authored ethnicity tracking standards within China (see Dahua and Hikvision Co-Author Racial And Ethnic PRC Police Standards).

The letter to Costco largely cites the same findings as above.

Why Still Selling Hikvision and Dahua, Letters Ask

The CECC is asking ADI why it is still selling Hikvision and Dahua, given its competitor Wesco/Anixter dropping them:

Given that major retailers and your competitor are no longer selling Dahua or Hikvision products, and given concerns about consumer safety and supply-chain problems, what is the rationale for your continued marketing of these products to American customers? What is your plan to comply with FCC restrictions on the sale of telecommunications and security equipment manufactured by Hikvision and Dahua moving forward? [emphasis added]

The CECC also asks Costco "why didn't Costco follow suit" after Lowe's, Home Depot, and Best Buy dropped Lorex in 2021:

Given that your competitors have stopped selling Lorex products citing human rights and sourcing concerns, why didn’t Costco follow suit? Does Costco have information that contradicts the concerns raised by your competitors? If so, can you share it with us? [emphasis added]

Many other companies have dropped Hikvision and Dahua, notably the UK's largest retailer Tesco.

Other Questions Examined

The CECC is asking ADI 10 questions, including:

• Does ADI notify customers the US Defense Intelligence Agency finding that "Hikvision is a partner with Chinese intelligence entities" or of Hikvision and Dahua's NDAA-banned status?
• Whether ADI has "done an analysis of the security risks associated with Hikvision and Dahua" and if so, is it " easily available to customers?"
• Whether ADI is "disguising [i.e. relabeling] products made by Dahua and Hikvision for sale to federal agencies" and if so under "what brand names"?
• Whether ADI has "done an assessment of the material and reputational risks associated with the sale of brands linked to genocide and crimes against humanity in the PRC?"

Similarly, Costco is being asked 11 questions, including:

• How is the sale of Lorex "consistent with Costco’s commitment to the United Nation’s Guiding Principles on Business and Human Rights?"
• Would Costco ever "commit to ending the sale of Lorex security equipment, given its continued association with Dahua components?"
• Whether Costco has warned US customers of "security vulnerabilities associated with Lorex equipment"?
• Whether Costco's leadership has "met with Uyghur-Americans to discuss the genocide and forced labor experienced by their families in China" and if it would "commit to doing so?"

Note that companies are not obligated to respond to all questions posed; for example, when US Senators questioned Amazon for buying Dahua despite Dahua's Uyghur warnings, Amazon ignored questions about Uyghurs, but did pledge "we do not intend" to buy Dahua again.

IPVM Cited

The letter to Costco directly cites IPVM for its reporting that Lorex kits sold in Costco had "Made In The USA" labels despite being made in China. The letter asked why "no further explanation of who was responsible for this mistake" was given or "why the Lorex name stayed on Dahua equipment".

Impact Of Congressional Letter On ADI and Costco Examined

ADI and Costco have resisted all previous calls to cease selling Dahua and Hikvision, but Congress' probe represents a significant escalation.

It is not legally mandatory for companies to respond to letters from Congressional committees. For example, in 2017, US Congress members sent a letter to Costco about labor abuses at one of its trucking partners, and Costco did not respond, although it did drop the partner.

Nevertheless, ignoring such a letter - especially without taking any action - risks inviting further scrutiny and, at worst for the company, Congress invoking its subpoena power to compel executives to testify; avoiding this is considered Contempt of Congress, a criminal misdemeanor.

IPVM could find no history of Congress members sending a letter to ADI, so this is a new situation for its owner, Resideo, which also lacks the lobbying power and knowledge of much larger corporations like Amazon and Costco.

Update 11/05/23: This report has been updated to reflect that IPVM confirmed ADI listed several Dahua and Hikvision products under their NDAA-compliant section, and as NDAA-compliant on product pages, based on archived links.