Hikvision Contradicts FCC Anti-Ban Claims, Admits 'Cloud' Will be 'Essential'

While Hikvision argues to the FCC that their equipment can and should be used without the Internet, this argument is in bad faith, something Hikvision effectively admits in contradictory remarks in its top trends for the year.

In this report, IPVM examines Hikvision's arguments to the FCC and contrasts them with what the PRC China firm actually markets.

Hikvision in 2022: Cloud is 'Essential'

Hikvision HQ published its top 2022 trends, widely-disseminated, including on PR Newswire, LinkedIn, Twitter, Facebook, etc. Hikvision predicted a surge of end-users demanding internet-connected surveillance products in 2022:

Like AI, the cloud is not a new trend in our industry, but it is an expanding one. From small business markets to enterprise levels, we can see the momentum push more and more businesses to leverage cloud-based security solutions and services. [emphasis added]

Hikvision emphasized that all businesses want cloud, touting the benefits of providers like Hikvision providing cloud services:

All businesses want platforms or services that offer simplicity, with as few assets to manage as possible, and a setup that's as simple as possible. This is precisely where the cloud delivers. With a cloud-hosting infrastructure, there is no need for a local server or software. Users can conveniently check the status of their assets and businesses in real time, receive security events and alarms quickly, and accomplish emergency responses simply using a mobile app. For security business operators, the cloud enables them to remotely help their clients configure devices, fix bugs, maintain and upgrade security systems, and provide better value-added services. [emphasis added]

Hikvision To FCC: Connected Devices "Uncommon", "Unnecessary"

However, in multiple lengthy FCC filings, Hikvision has repeatedly emphasized that Hikvision devices do not require an internet connection and are "not commonly" used with the internet, describing in technical detail the various possible "air-gapped" configurations of Hikvision devices.

What's more, Hikvision's first FCC comment - a 79-page legal argument - refers to internet connectivity 59 times, including:

Hikvision’s cameras and recorders do not require an Internet connection to operate.

While many of Hikvision’s products include Internet connection capabilities, end-user businesses can (and often do) operate Hikvision equipment on an entirely standalone basis unconnected to outside networks (including the Internet).

Hikvision cameras—including those with Wi-Fi—do not require Internet connectivity to function, and end users can and do choose to operate their devices while remaining physically or logically isolated from the Internet.

Only a very small percentage of Hikvision devices appear to be directly connected to the Internet.

Even in the rare case of an Internet-connected deployment, an installer would likely set up a firewall between its network and the Internet. [emphasis added]

Additionally, despite claiming cloud services are on the rise, Hikvision conversely said of its main cloud services app, Hik-Connect:

Hik-Connect represents a very small percentage of Hikvision’s business in the United States

Furthermore:

Hikvision advises that access to Hik-Connect should be enabled only if needed.

Hikvision's second 64-page FCC comment in October doubled-down on the argument, and included a consultant's 5-page report on internet-free configurations. Moreover, addressing the September 2021 9.8/10.0 critical vulnerability, Hikvision said:

This vulnerability could have affected only those devices that end users chose to connect to the Internet—which is not necessary for operation and not commonly done.

In our October FCC reply comment, IPVM expressly disagreed with Hikvision's position, arguing it offers little reassurance because end-user demand for cloud services is on the rise, and Hikvision's products are designed to meet that demand:

Hikvision, Dahua, and their supporters argue such equipment does not pose a risk because end users can voluntarily choose to not connect them to the internet. The Commission should be wary of this argument, which is specious to the point of actually being irrelevant. It is akin to suggesting laptops never connect to WiFi to ensure they can never be hacked; moreover, it is akin to a laptop manufacturer suggesting that because users may choose to not use WiFi, it does not matter that the laptops have vulnerabilities. The fact is these surveillance products are designed to be used with the Internet; Internet connectivity is a titular feature of Hikvision and Dahua’s equipment, and this is increasingly what end users expect from surveillance products.

In its November comment, Hikvision again reiterated its point, and claimed security professionals "confirm that Hikvision security cameras are often secured by a closed network, so that they never have direct access to the Internet."

FCC Commissioner: "Odd Argument"

In an interview with IPVM, FCC Commissioner Brendan Carr said Hikvision's focus on possible air-gapped configurations "strikes me as an odd argument,” because the equipment authorization program is not about internet connectivity:

We're looking at the fundamental question of equipment authorization. So regardless of whether you have a license, or whether you connect to the internet, you can't have any electronic device in this country without an FCC authorization.

Commissioner Carr also said that the FCC generally takes transparency into account in its decisions:

We do not take kindly to the hiding of information or misleading about core important facts. The FCC's own record shows this, we take into account lack of candor when we discover it, when we make these decisions.

Hikvision "We decline to comment"

Hikvision Global Communications and PR Director Karl Erik Traberg declined to comment.

Bad Faith Argument

Hikvision, IPVM, and physical security industry professionals widely agree that the cloud and Internet connectivity is core to video surveillance devices. Even Hikvision's newest Top Trends marketing stresses this. By contrast, Hikvision's FCC arguments against Internet connectivity are in bad faith and deceive the US government from Hikvision's actual intentions and operations.