Hikvision Sues Over Brazilian Airport Loss

Hikvision was excluded from a Brazilian airport project because it is owned by the PRC government. Hikvision sued the airport's operator but has lost with a Bosch / Genetec / Dell solution being installed instead.

Inside this note, we examine:

• The Airport Project
• CCTV Tender & Exclusionary Clauses
• Hikvision Files Suit
• Arcade Wins Bid, Court Initially Rules in Hikvision’s Favor
• Infraero Challenges Court Decision
• Infraero & Arcade Win, Hikvision Loses on Appeal
• Arcade & Infraero Confirm Delivery Is Underway
• Genetec: Confirms Solution Has Been Deployed at Congonhas
• Hikvision: No Comment
• UPDATE Infraero: Hikvision Could Have Bid, But Declined to Sign Declaration Promising Not to Share Images from Cameras
• Challenges for Hikvision in Brazil

This is the second in a series of posts covering Hikvision in Brazil. For previous coverage, see Brazil Assembly Powers Hikvision Local Expansion.

The Airport Project

São Paulo's Congonhas Airport (Congonhas) is the city's second-largest as well as Brazil's second-busiest airport, serving as a major domestic air transit hub for central and southern Brazil.

Congonhas is operated by Infraero, a Brazilian SOE which operates over 40 airports nationally. Infraero has invested tens of millions of dollars into upgrading Congonhas over the last decade, with a new control tower opening in 2013, among other improvements.

CCTV Tender & Exclusionary Clauses

In September 2019, Infraero announced Tender No. 022/LALI-7/SBSP/2018 for the "Contracting of a Specialist Company for the Execution, Provision, and Installation of the Modernization of the CCTV and Surveillance Monitoring System of São Paulo/Congonhas Airport."

However, the CCTV tender featured three exclusionary clauses that would eventually be challenged by Hikvision. According to court records (see p. 145), the clauses are as follows:

1. a restriction of participation by companies owned or controlled by a foreign government;
2. a requirement that manufacturers adhere to the terms of European data protection legislation (EU GDPR); and
3. certifications from foreign governments.

Hikvision Files Suit

Hikvision filed a lawsuit against Infraero (the suit's file number 5018084-11.2019.4.03.6100 indicates a November 2019 filing date) challenging the "abusive clauses" that excluding them from Infraero's Congonhas CCTV tender.

The Brazilian integrator who won the project, Arcade Tecnologia Projetos e Engeharia Ltda. (Arcade) spoke with IPVM about the suit. Milton Balieiro, their executive director, told IPVM:

Hikvision was out of the competition. This was the reason why they went to court, to be able to participate in the process.

A separate source with knowledge of the court case confirmed to IPVM that Hikvision sued for the right to partake in the Congonhas bidding process:

The specifications were written in such a way that it prohibited Hikvision to bid via language that excluded companies that had majority ownership by a government entity. It is Hikvision that went to the Justice Department and asked them to stop the process in order to make it more open—claiming that the government ownership clause was overly discriminatory.

Arcade Wins Bid, Court Initially Rules in Hikvision’s Favor

In the meanwhile, Mr. Balieiro confirmed to IPVM that Arcade won the Infraero tender with a solution comprising Bosch cameras, Genetec software, Dell servers and storage, and HPE networking equipment.

Following Arcade's successful bid and contract signing, in January 2020 the 14th Federal Civil Court of São Paulo, part of the Federal Regional Tribunal of the 3rd Region (pictured below) delivered a verdict (see pp. 145–46) on the Hikvision-initiated suit and exclusionary clauses in the Infraero tender.

The court verdict is summarized below.

• The court struck down Infraero’s argument that foreign-owned entities should be barred from bidding as Brazilian law establishes a prohibition on the unequal treatment of Brazilian and foreign businesses.
• The court struck down Infraero’s argument that the CCTV system be GDPR-compliant as GDPR is not Brazilian legislation.
• The court struck down Infraero’s argument that Hikvision did not have certifications from foreign authorities as Infraero itself demonstrated that Hikvision does have these certifications.
• The court ordered the bidding process be suspended.
• The court ordered any contract with Arcade be rendered null and void. [emphasis added]

Infraero Challenges Court Decision

Infraero opted to appeal the court's decision in late January / early February 2020.

Mr. Balieiro from Arcade told IPVM that perceived vulnerabilities behind Hikvision products drove Infraero's thinking.

The PRC-based companies are well-known for having products that are very vulnerable to cyber attacks and data theft. PRC-made products do not offer the security that the [Congonhas] Airport was looking for in comparison to other manufacturers; this was the key reason why the Airport did not allow the [PRC-based manufacturers] to participate. What is more, a company with PRC government ownership could more easily obtain access to the Airport's information. [emphasis added]

At this point, integrator Arcade joined end-user Infraero as a co-defendant in the litigation in order to keep the contract and deliver the Bosch / Genetec / Dell / HPE solution.

We decided to respond, arguing that the right of the client to opt for technology that does not have foreign government interference, for technology that does and has adhered to the data protection law, which is the LGPD here in Brazil. One of the justifications was that the PRC manufacturers do not comply with this law, which comes into force next year (it was due to come into effect this year, but was postponed until next year) and thus it would fall to the client to choose a product that meets these security requirements.

Infraero & Arcade Win, Hikvision Loses on Appeal

In February 2020, the court issued a new ruling, reversing its January decision and accepting Infraero's and Arcade's argument that Infraero should have the right to select a solution free of foreign government interference. According to Infraero, their claim that Hikvision cameras could be used for digital espionage compelled the judge to rule in their favor:

There is a case filed by Hikvision do Brasil Comercio de Equipamentos de Segurança Ltda against Infraero, in which the first-level judgment awarded the injunction establishing the suspension of Electronic Tender No. 022/LALI-7/SBSP/2018, which had as its purpose the contracting of a company for the provision and installation of the modernization of the CCTV and surveillance monitoring system of Congonhas Airport. However, this decision was suspended by the Federal Regional Tribunal of the 3rd Region on February 27, 2020, on account of an appeal presented by Infraero about the argument that digital espionage is a real concern, in such a way that the restriction of the announcement of impeding companies that are the property of or controlled by a Foreign State is fully justified. It should be noted that at no time did the Infraero announcement restrict Chinese technology limiting itself to conform to the legal requirements related to National Security. [emphasis added]

Infraero's point is summarized more succinctly by Mr. Balieiro from integrator Arcade:

The judge accepted, judging in favor of the continuity of our contract and the closing of the legal matter where he decided it best to maintain Infraero and Arcade as the companies with the right to carry out the contract.

Additionally, a third person with knowledge of the matter told IPVM that:

Infraero won the appeal and the bid process continued as it was originally written.

Arcade & Infraero Confirm Delivery Is Underway

In the months since the appeal verdict, Arcade and Infraero have moved forward with deployment of the Bosch/Genetec/Dell/HPE solution at Congonhas. According to Arcade, the Bosch cameras are being bought this week and work should be completed in Q1 2021:

Our work is already under way, we are ahead of schedule. This week we will buy the cameras to finalize the installation and delivery of the project; the forecasted completion date is at the beginning of next year. The contract length is 15 months, we are already well into [the work] and we believe that we will complete the delivery in the first quarter of the next year.

In a statement to IPVM, Infraero also confirmed the 2021 completion date:

It is worth highlighting that the tender process was closed in December of the past year and the contract for the provision of the activities was published in the Official Diary of the Union in the same month. At present, the services are being provided and the estimate is that they will be finalized in 2021. With respect to the solutions adopted for the improvement in question, they are from Bosch, Genetec, Dell, and HPE.

Genetec: Confirms Solution Has Been Deployed at Congonhas

Genetec told IPVM that:

Genetec is proud to be a valued partner of public authorities throughout Brazil. We were very pleased to learn that Arcade Tecnologia Projetos e Engenharia Ltda. won the tender in question with a Genetec solution and can confirm that the Genetec solution is operational at Congonhas Airport.

Hikvision: No Comment

A Hikvision spokesperson declined to respond to IPVM's request for comment.

UPDATE Infraero: Hikvision Could Have Bid, But Declined to Sign Declaration Promising Not to Share Images from Cameras

Infraero released the following statement to IPVM following the original publication of this report:

In accordance with the tender notice, Infraero only provided that, in the case that the manufacturer of the equipment to be provided has a foreign government as a shareholder, such shareholding must be a minority interest (less than 50%) and the manufacturer must release a declaration notifying this condition, as well as promising not to share any data or imagery generated by way of their cameras.

It is worth highlighting that the Congonhas Airport is counted as a Facility of Authorities, where authorities such as the President of the Republic [Jair Bolsonaro], Ministers, and the Chief of Staff, among others, frequently embark and disembark. As such, the images generated are confidential and fall under the provisions of Article 13 of Law No. 7.170/2010 and its subsections, it is compulsory that the manufacturer must not be the property of or controlled by a foreign government. [emphasis not added]

PRC government entities only have a 41% interest in Hikvision, thus Infraero's statement confirms that Hikvision was unwilling, or unable to produce the required declaration guaranteeing the confidentiality of data recorded by its cameras.

Challenges for Hikvision in Brazil

Despite having a production center in Manaus and courting local politicians, Hikvision continues to have challenges competing at the highest, enterprise level of Brazilian video surveillance.

Similar to the US NDAA, in Brazil, as is the case in Chile, cybersecurity and perceived vulnerabilities with Hikvision's technology dissuade would-be end-users from deploying the PRC-controlled manufacturer's solutions.

While Hikvision has benefited immensely from its PRC government ownership, it is also increasingly facing challenges, viewed not as a private-sector security manufacturer, but as an arm of the PRC government.