Ireland National Children's Hospital Chooses Hikvision End-to-End With Facial RecognitionBy: Charles Rollet, Published on Dec 05, 2019
The world's most expensive hospital project ever, the New Children's Hospital in Ireland, has chosen an all-Hikvision surveillance system including specialized facial recognition cameras, IPVM has found.
Privacy experts and an Irish politician raised serious concerns about this to IPVM, due to the sensitivity of deploying facial recognition in a children's hospital and the use of Hikvision cameras given its recent human rights sanctions and China government control.
The NCH, which is currently under construction in Dublin, has already attracted controversy for its spiraling price tag which now stands at $2 billion.
In this report, IPVM examines:
- NCH Background/Scope
- Ireland Hikvision Scrutiny On Parliament Cameras
- FOI Request Reveals Hikvision Cameras/Equipment
- Integrator: Stanley Security
- No Further Contract Details
- NCH Says Face Rec Details "Not Yet Been Decided"
- "Less than 3%" of Cameras Face Rec Model"
- Privacy Experts: Facial Recognition Cameras in Children's Hospital "Alarming"
- Concerns Over Using Hikvision Given Recent Human Rights Sanctions
The NCH, planned for decades, is meant to centralize Ireland's three main children's hospitals into one.
It is mostly known for huge cost overrun issues, with costs almost tripling to about $2 billion, as the video below shows:
The NCH will be "one of the largest buildings in Ireland" according to its builder, with seven stories, 470 beds, and 1,000 parking spaces. The full complex, including 4 acres of gardens, will total around 1.7m square feet (160,000 square meters).
Prior Hikvision Scrutiny on Parliament Cameras
There are no restrictions to using Hikvision equipment in Ireland, however, Hikvision cameras have raised concerns chiefly due to their use in Irish parliament (Leinster House):
- In June 2018, as the US NDAA ban was set to pass, the Irish Sun reported that Leinster House and Garda (police) stations were using Hikvision cameras.
- In April 2019, a member of Ireland's parliament, James Lawless, raised concerns about potential espionage over the Hikvision cameras in Leinster House.
FOI Request Reveals Hikvision Cameras
IPVM made a Freedom of Information request about the NCH's video surveillance system, and we received one detailing all the "equipment brand and models being used on the NCH project":
- iDS-2CD8426G0/F-I DeepinView Dual-Lens Face Recognition Camera
- DS-2CD2755FWD-IZS 5 MP WDR Vari-focal Network Dome Camera
- DS-2TD2136T-10 Thermal Network Bullet Camera
- iDS-2CD6810F/C Indoor Dual-Lens People Counting Camera
- DS-2DE4A425IW-DE 4 MP 25× Network IR PTZ Camera
- DS-2DF8425IX-AEL(W) (C) 4MP 25× Network IR Speed Dome
- DS-2CD63C2F-I (V) (S) 12 MP Network Fisheye Camera
- DS-2CD4A26FWD-IZ(H)(S)/P 2MP Low Light ANPR IR Camera
- DS-2CD6D54FWD-(I)Z(H)(S)(/NFC) EXIR Flexible PanoVu Network Camera
- DS-2CD2555FWD-I(W)(S) 5 MP EXIR Fixed Mini Dome Network Camera
As well as various servers including Hikvision's AI recorder:
- DS-96000NI-I16/H SERIES NVR
- iDS-96000NXI-I16/I24 DeepinMind Series NVR
- DS-6900UD Series Decoder
And managing the entire system, Hikvision's proprietary VMS / CMS:
- HikCentral V1.2 Central Management System
Hundreds of Cameras or More, IPVM Estimates
While NCH would not disclose the camera counts or pricing, we estimate in the range of a million Euros for the project including at least hundreds of cameras. Given the size of the hospital campus, the variety of high-end models selected (facial recognition, ANPR, PTZs, people-counting, etc.), this is a large project.
Stanley Security Integrator
The FOI request also named Stanley Security as the integrator:
Stanley Security, despite its parent company Stanley Black & Decker touting its all-American history, is a major Hikvision camera buyer and even boasted of making a "multi-million dollar investment" into Hikvision products just days before the USA NDAA ban.
No Further Details
IPVM requested full contract details, including price, but these were not granted to us as this was deemed "commercially sensitive" information.
NCH No Comment on Hikvision Use/Human Rights Concerns
IPVM asked about Hikvision's Xinjiang sanctions and we received a generic response ignoring this question:
The safety of patients, visitors and staff at the new children’s hospital is of paramount importance to everyone working on the new children’s hospital project.
Stanley Security Systems, who have been working in this area for more than 25 years, were successful in the competitive procurement process for the installation of the security systems at the new children’s hospital.
NCH Says Face Rec Details "Not Yet Been Decided"
Using facial recognition on children is highly sensitive; in both Sweden and France, schools that attempted to use facial recognition were banned from doing so by data regulators due to the GDPR, which Ireland is also subject to.
IPVM asked the NCH directly why it had specified facial recognition cameras and we received this response:
It has not yet been decided which aspect of this technology’s many capabilities will be used in the new children’s hospital. This decision will be taken nearer the opening of the hospital by Children’s Health Ireland and will be in line with Irish and European data protection and privacy legislation and in such a way as to ensure that the occupants of the hospital have the right protections afforded to them, in line with their privacy rights.
The claim of 'not yet been decided' is questionable since specifying these specialized cameras that cost 5 to 10 times what a conventional Hikvision camera costs for the express purpose of delivering facial recognition indicates a decision to deploy facial recognition.
"Less than 3%" of Cameras Face Rec
IPVM emphasized this to the NCH, to which they responded:
Less than 3% of the cameras procured for the new children’s hospital are the iDS-2CD8426G0/F-I [facial recognition] model. Only the hardware of the cameras have been procured at this point. The software will be procured nearer the opening of the hospital. What software is procured – and consequently what aspects of the many capabilities of the cameras is utilised – will be determined by Children’s Health Ireland and will be in line with Irish and European data protection and privacy legislation and in such a way as to ensure that the occupants of the hospital have the right protections afforded to them, in line with their privacy rights. [emphasis added]
However, the software has already been procured from Hikvision. What the NCH misunderstands is that Hikvision bundles in the facial recognition software with their cameras and recorders that they have already purchased. Someone at Stanley or the NCH knows this because that is the sole reason to pick those specific Hikvision facial recognition cameras. If they intended to procure (or not) facial recognition later, they could simply buy far less expensive conventional Hikvision cameras.
Moreover, the 3% figure implies 10 or more facial recognition cameras, based on our estimate of total system size. 10 facial recognition cameras placed at entrances or key chokepoints (as is common industry practice for such designs) would be able to capture virtually all people that come to the hospital.
Privacy Experts: Facial Recognition Cameras in Children's Hospital "Alarming"
It is difficult to understand or accept what utility facial recognition has in a healthcare setting, or how it would be appropriate. It is important to know what the technology would be used to recognise. Any such system requires a database of faces to be effective, so we need to know whether the technology would be used for staffing purposes, patient tracking or for security reasons. All those uses raise serious issues, however, and one wonders where the hospital will obtain its database of facial scans to begin with. The fact that such technology could be used in a healthcare setting specifically constructed for children is alarming. [Emphasis Added]
I’d have immediate concerns about the lawfulness of using facial recognition in this context, as well as it being disproportionately invasive. The first thing I’d ask is “what is your lawful basis for using facial recognition?” and the second thing I’d ask is “where is your Data Protection Impact Assessment?” Any new installation of CCTV requires a DPIA, and potential use of facial recognition, recording information relating to people in hospital, and recording information about children are all specifically called out as higher risk operations that require extra care to avoid being unnecessarily invasive and to make sure what you are doing is lawful, necessary, and proportionate. [Emphasis Addded]
Concerns Over Using Hikvision Given Recent Human Rights Sanctions
James Lawless, the member of Ireland's parliament who previously raised concerns about Hikvision cameras in Irish parliament, called out the NCH's use of Hikvision over the company's Xinjiang ties (which it was recently sanctioned over) and PRC government backing:
Yes I would have similar concerns here. Why is the state installing advanced surveillance techniques from a source that is known to be dubious in one of the largest capital projects currently underway? When we see what has happened to the Uighur Muslims recently and the type of Orwellian state system that is in force in the Xinjiang province it had to raise questions about western governments use and purchase of similar equipment. All Chinese companies have a legal obligation to the Chinese state to collaborate and divulge information if required. I understand that Hikvision is in fact a wholly owned subsidy of the Chinese government. Ireland already has a defence exposure due to a lack of investment in cyber security and now with Britain leaving the EU we may have less cover from our neighbour in terms of intelligence sharing. It is time we accustomed to modern espionage and state capitalism techniques and protected ourselves and our citizens accordingly. [Emphasis Added]
Stanley Security No Response
IPVM did not receive any response to questions we sent Stanley Security.
No Response on DPIA
IPVM asked the NCH and Ireland's data protection regulator, the DPC, whether the NCH had submitted a DPIA but we have received no response on this yet.
There are clearly serious questions being raised about the NCH's video surveillance system, but the hospital's responses provide little clarity.
On the positive side for Hikvision, this shows that large corporations like Stanely and governments like Ireland continue to stand by purchases of Hikvision.
However, privacy and political concerns, especially over GDPR and human rights concerns, portends increased scrutiny over Hikvision's use in high-security projects.