NSA Director Keynoting Dahua and Hikvision Sponsored Cybersecurity Conference [Canceled]

As he is an appointed official as part of the NSA, do you have contact information for this individual so that we may contact him or anyone involved to voice our concern and disgust at this situation?

Reactions:

(1)

John Honovich

In reply to Undisclosed Distributor #1

IPVM

We don't have his direct contact information but I forwarded it through some US government contacts last week.

I bet he is not even aware of this, as he speaks at many conferences and I would assume he reasonably assumes that banned companies would not be allowed to sponsor him.

Reactions:

(4)

(1)

Undisclosed Integrator #2

Allowing Dahua and Hikvision to sponsor such events undermines US law and interests, allowing these PRC organizations and their paid off partners (like SIA), to pretend everything is fine and that the US government is mistaken and that the real allies of the US are organizations like Dahua and Hikvision, happy to fund these events.
Industry Bought Off
Those outside the physical security industry may find it confusing that a US non-profit like SIA would accept cybersecurity sponsorships from PRC organizations banned for security risks, including one owned by the PRC government.
Unfortunately, many physical security 'leaders' have effectively been bought off by the unprecedented amount of marketing money these now US government banned organizations are willing to spend.

Great summary and conclusion to your article. I am in no position to know the reasoning behind the decision to allow "The technical director for the NSA’s Cybersecurity Threat Operations Center will be keynoting a physical security cybersecurity conference that is being sponsored by Dahua and Hikvision, banned by the US government for security risks". However, it deserves investigation and explanation.

Hopefully, there is some logic to having an NSA cybersecurity official of this caliber, whose agency has "banned for US government uses" the very parties' products who are standing "shoulder to shoulder" with himself and the Security Industry Association officials at such an event. At the same time we, as security solution integrators, are charged with making decisions as to whether these same manufacturer partners qualify for being specified and used in those facilities and communication networks other than the federal government owned and operated communication networks?

Reactions:

(3)

Undisclosed Manufacturer #3

Mirrors to the video excerpt? No good anymore....

Reactions:

John Honovich

In reply to Undisclosed Manufacturer #3

IPVM

I fixed the video, viewable above and viewable here.

Reactions:

(1)

Undisclosed Manufacturer #3

Thanks. Are government employee keynote speakers paid or is this a fee that goes directly to the agency/branch? I know someone would probably spin this as "NSA Director Paid By China!".

Interesting how this will play out, but I can imagine his staff would probably at least let him know about this potential conflict now.

Reactions:

John Honovich

In reply to Undisclosed Manufacturer #3

IPVM

I doubt the NSA director is being paid. This strikes me as more of an outreach to industry than a money-making opportunity. The NSA has a reported ~$11 billion budget so they have no need for handouts.

Hikvision excels at this game, like with the FIPS certification. They use it to cast doubt and sow confusion. "Hey all I can say is last week we sponsored the NSA director's keynote and they were really happy to have us."

Reactions:

(5)

Undisclosed Integrator #4

In reply to Undisclosed Manufacturer #3

I do not think it will be something where he is noted as being paid, but rather ignorant. I have to admit that as much as the NSA seems like an omniscient cyber-boogeyman this article sure does show some serious flaws in the NSA intelligence gathering for this event.

Reactions:

Undisclosed #5

IPVMU Certified

Is this conference primarily sponsored by Hikua or are they one of many?

Reactions:

John Honovich

In reply to Undisclosed #5

IPVM

SIA is looking for 31 sponsors total:

There are 14 sponsors so far listed, no Gold and Platinum. Dahua and Hikvision are bronze.

Reactions:

(1)

Undisclosed #6

I am in a position to purchase a sponsorship for this event, however it is clear this is going to be more of a superficial boondoggle than a worthwhile event. I wish more manufacturers would pressure SIA to actually have a backbone.

Reactions:

(4)

(1)

Jon Dillabaugh

Pro Focus LLC

There are speaking fees, and then there are room comps, flights, car service, dinners, gifts, etc. How much does SIA provide to the keynote speaker? This would be where I would dig. As a Fed employee he should be barred from these comps as well. Right?

Reactions:

(1)

Rich Moore

In an unrelated story, Deputy Administrator Andrew Wheeler of the Environmental Protection Agency will be the keynote speaker on global warming sponsored by Dow Chemicals, Westmoreland Coal and Exxon Mobile.

Reactions:

(1)

(6)

Undisclosed Distributor #1

In reply to Rich Moore

And the original shill, Ajit Pai, will continue to play Santa Claus at the Verizon Christmas party.

Reactions:

(4)

Undisclosed Integrator #2

In reply to Rich Moore

But Trump said global warming is a hoax and fake news anyway.

Reactions:

(3)

Undisclosed Integrator #8

In reply to Undisclosed Integrator #2

and we all know Trump knows more about both subjects than probably anyone else ! lol

Reactions:

Undisclosed #5

IPVMU Certified

Allowing Dahua and Hikvision to sponsor such events undermines US law and interests...

where are you placing blame here? the gov or SIA?

Reactions:

(1)

John Honovich

In reply to Undisclosed #5

IPVM

SIA, for sure.

The NSA director does not go to a US telecom conference and expect it to be sponsored by Huawei, nor does he go to a physical security one and expect it to be sponsored by the Chinese's government video surveillance manufacturer.

SIA does not want to offend two of its largest members, even though it's pretty obvious that this is not the type of conference, given what US law is, that Dahua and Hikvision should be sponsoring.

I am curious to see how this will end up, will the NSA director really end up speaking behind a banner of sponsors featuring Dahua and Hikvision?

Reactions:

(2)

David Coughlin

Coughlin Security & Legal Advisers

It's not "malum prohibitum" but, it's definitely "malum in se". In other words, it may not violate a statute but, IMHO, it's inherently wrong by nature, independent of regulations governing the conduct.

Some food for thought:

Consider the ultimate authority for Dave Hogue, Technical Director, NSA, Cybersecurity Threat Operations Center, who's actions and words are often malum in se AND malum prohibitum.

Also, China's PLA Unit 61398 is the Military Unit Cover Designator (MUCD)[1] of a People's Liberation Army advanced persistent threat unit that "has been alleged to be" a source of Chinese Hackers. In 2013, China openly admitted to having secretive cyber warfare units in both the military and the civilian part of the government – however, the details of their activities were left to speculation. As a show of force towards the rest of the global community the Chinese government now openly lists their abilities when it comes to digital spying and network attack capabilities.

The Chinese government's involvement (directly through Hikvision and Dahua) in this Cybersecurity Conference is yet another action by our own government to subject the U.S. to vulnerabilities to known enemies. The words of Abraham Lincoln to honor soldiers that sacrificed their lives in order “that government of the people, by the people, for the people, shall not perish from the earth” were spoken at Gettysburg, but these words apply as well to the countless soldiers and intelligence officers that gave their lives or limbs for the cause of our democracy before and since Gettysburg. Allowing such vulnerabilities is yet another dishonor to the sacrifices of these heroes.

Let's not let our democracy perish from the earth from a catastrophic event or from the effect of "1,000 paper-cuts" (letting many seemingly innocuous vulnerabilities exist).

All this of course is my own humble opinion and not that of any other person or company.

Best,

David J. Coughlin, CPP, Esq.

Reactions:

(1)

John Honovich

IPVM

As if to prove our point, Hikvision is now marketing their sponsorship of the NSA director's keynote on social media:

Reactions:

(2)

John Honovich

•Jun 15, 2019

IPVM

Update: Now Hikvision has deleted their social media promotions of them sponsoring the NSA Director's keynote.

Reactions:

(1)

Undisclosed #5

•Jun 15, 2019

IPVMU Certified

unproving “your point” :)

Reactions:

(3)

John Honovich

IPVM

As a side note, SIA has reserved an hour for the manufacturers who are willing to pay them $25,000. Only problem, no one wants to pay that so far, so it is empty:

This is, unfortunately, not unique, see: ASIS Sells GSX 2019 Education Sessions and 'Independent' Security Consultant Organization Sells Off Speaking Slots To Manufacturers, though the IAPSC refused to take sponsorship money from Dahua and Hikvision, citing cybersecurity concerns.

Reactions:

John Honovich

IPVM

Update: the links announcing this keynote on SIA and the conference's website no longer work. We are checking with SIA to clarify what is the status (changed links, changed plans, etc.).

Reactions:

Undisclosed Manufacturer #7

I predict that the speaker will pull out due to a scheduling conflict, as other staff members scheduled it without consulting..

Reactions:

(2)

(1)

(4)

John Honovich

IPVM

Update: the keynote has been canceled, with SIA, the organizer, only saying "The NSA canceled due to a scheduling conflict and requested they be kept in mind for future sessions."

Reactions:

(5)

Undisclosed #6

I wonder when SIA (and Hik) are going to get their act together and realize people are done putting up with their lack of ethics when it comes to cybersecurity and product positioning.

Good to see this keynote has been cancelled. It should have never been scheduled in the first place.

Furthermore, it would be nice if a requirement for sponsoring a cyber security event were that the sponsors didn't have a collection highly critical CVE's amassed.

Reactions:

(2)

John Honovich

In reply to Undisclosed #6

IPVM

putting up with their lack of ethics

On a related note, SIA has just started an ethics committee:

Ethics and Tech Working Group

The SIA Board of Directors recently approved the formation of a working group to develop SIA’s position on the topic of ethical use of security technologies. As policymakers in the U.S. and the EU consider developing guidelines for the responsible use of technology, this new SIA working group will make recommendations to the SIA board on the application of certain technologies, such as artificial intelligence, for security in an ethical and appropriate manner that builds trust throughout the security ecosystem and with the general public. For more information and to get involved, contact me at derickson@securityindustry.org.

I joined it a few weeks ago but have not yet received any further word on progress nor meetings.

Reactions:

(1)

Undisclosed Manufacturer #7

Called it!! :)

Reactions:

(3)

(4)

John Honovich