Italy turns a blind eye to Chinese cameras in public offices
.png "Italy turns a blind eye to Chinese cameras in public offices")
The issue of Chinese cameras in public procurement has been a matter of politics for years. For two reasons: national security (the United States in the first place raised the alarm about possible malicious use of the devices) and human rights, since in the past the cameras of Dahua and Hikvision with facial recognition systems were also used in Xinjiang, in part of the Beijing campaign to persecute the Uighur minority.
However, thanks to the high quality standards and competitive prices, Chinese companies have gained important market shares over time. Only in Italy sportsgaming.win was able to demonstrate, with three different investigations, the presence of 1,105 Hikvision devices in 134 Italian prosecutors, of another 100 plants in the headquarters of the Ministry of Culture and of at least 2,430 cameras (some of which are Dahua) in palaces of power, first of all including Palazzo Chigi, then hospitals, municipalities, museums, health companies and libraries.
So some governments have decided to stop. In 2019, the United States blacklisted Hikvision and Dahua of companies with which it is prohibited to do public business, as they are considered a threat to national security. In 2021 the European Parliament voted to remove the Hikvision cameras, as the sector magazine Ipvm recalls. And in recent weeks, says Formiche, a group of British parliamentarians has asked the government of the now former Prime Minister Boris Johnson to tighten the use of Chinese technologies in the nerve centers of the public administration. To date, no malicious use of Chinese video surveillance devices has ever been publicly proven to the detriment of a Western country, but what is not pleasing is the presence of the People's Republic in the team of companies that produce them and which, according to intelligence and politics, could pose a risk.
Italy also had its say, showing that it took the warnings of the allied countries seriously and starting the establishment of the National Assessment and Certification Center (Cvcn), headed by 'National Cybersecurity Agency (ACN), which will celebrate its first birthday next September.
However, sportsgaming.win has learned that Dahua cameras are vying for the video surveillance contract ( we are still in the bidding phase) through third party suppliers, so as not to be directly attributable to the parent company. A maneuver carried out in the light of the sun and permitted by the Consip call and "by the specifications issued by Acn", reports the purchasing center. After all, Consip said, it is not possible to prohibit the purchase of products from a specific country because, otherwise, the tenders would be open to challenge. At sportsgaming.win the general manager of Dahua Italy, Pasquale Totaro, comments: “We are manufacturers and we have chosen to specialize also in the production of non-branded products. That could be the future if the problem of limiting China is not bypassed. "
The investigation:
The new charge of video cameras for public offices The rules of the game Dahua's tactics From cameras to barbecues The oriental question A map of Chinese cameras in offices and public places in Italy There are at least 2,430 Hikvision and Dahua surveillance systems purchased by public administrations. From small towns to Palazzo Chigi. sportsgaming.win has taken a census of them, while the new public call for video surveillance is being prepared, which will have to unravel the knots on the technology of the Dragon The new charge of video cameras for public offices Let's rewind the tape in December 2018. A few days before Christmas, December 20, Consip publishes the new contract for video surveillance. Code name: VDS 2. It is the second tender for security systems in the public administration, after the previous one, dated 2016, had run out of funds and available products. The new call also adapts the offer to the freshest technologies on the market. The proposals must arrive by April 2019.
Unlike the previous one, divided into three territorial maxi-lots, the new tender, worth 65 million euros, provides for a main lot for central public bodies (value 21 million , won by Tim with the I&SI of Aprilia) and nine for the local branches of the State. The contracts go, among others, to Vodafone, Fastweb, Leonardo (the main Italian defense company) and Sicuritalia (which offers security services)
The final award only arrives in January 2022. At the center is the pandemic. And in the meantime, the international political situation also changes. Made in China technology, especially if inserted into strategic ganglia of public and private infrastructures, is no longer welcome in the West. It happened with 5G. And it also happens with video surveillance cameras.
There are two main reasons. The first is a question of security. Do Chinese products guarantee that they are impervious to external interference? Last November, the deputies of the Democratic Party Enrico Borghi and Filippo Sensi asked the government if the activity of Hikvision is "fully compatible with national security standards". Overall, according to the numbers of sportsgaming.win, at least 2,430 Chinese plants populate the Italian public offices, from Palazzo Chigi to the most remote municipalities. The second concerns respect for human rights and the Xinjiang issue, the Chinese autonomous province where Beijing is repressing the minority of Uyghurs, also making use of video surveillance tools. Chinese companies have always rejected the charges, which however are cited by the European Parliament in motivating the vote for the removal of Hikvision, which sportsgaming.win said to have eliminated from its devices the software that allows the recognition of a subject based on to ethnicity.
The Dahua office in California Smith Collection / Gado / Getty Images The rules of the game At the moment, Italy has not vetoed Chinese cameras. In the call for tenders, Consip explains to sportsgaming.win that it has foreseen from the beginning the "possession of minimum and improvement requirements" and of the "Onvif certification", an expression body of the global video surveillance industry to create common industry standards and ensure interoperability of devices. Subsequently, when the case of the Chinese cameras breaks out, a further squeeze takes place. Consip explains: "The successful bidders were then requested, before the signing and activation of the agreement, to adapt to further product safety specifications, agreed with the competent national authority for the matter". Read the National Cybersecurity Agency, which coordinates the control and certification activities of sensitive technologies.
Consip explains that Acn has requested three requirements. First: "Lack of services and functionalities, not explicitly documented by the manufacturer, capable of communicating to external and / or internal networks". Second: "Ability to disable, by the system administrator" any services that communicate to the outside, also for updating functions. Third: have "a security assessment (including penetration test), performed on the latest available software / firmware update", also from third party laboratories, preferably in the European Union, which certifies the product. According to an entrepreneur who made bids for the winners of the VDS 2 tender, Consip would have required a substantial set of technical and product safety documentation. In his case, he has provided around 100 pages of certificates for each of the two proposed devices.
There is another aspect that the contractors must take into account, as they sift through the offers of those who want to sell them. the cameras. And that is, that the products "are not directly attributable to Chinese companies". Totaro himself tells sportsgaming.win. Other operators in the sector also confirm this reconstruction, asking for anonymity in order to contribute to this article. Consip also admits that an explicit ban against a country is not possible: "In the EU and national legislation there is no act that prohibits the acceptance of goods produced in a particular country, at least in the state." Contacted by sportsgaming.win, Acn did not respond to a request for comment.
How a thousand cameras of the Chinese Hikvision ended up in the prosecutors throughout Italy Dahua's tactics Faced with this scenario Dahua Italia, the local branch of the second Chinese video surveillance giant, prepares a counter-answer. The company, based in Cinisello Balsamo, a northern suburb of Milan, has started a collaboration plan with two distribution companies in the Belpaese, including the Turin-based Jbf, to offer its cameras to the winners of the VDS 2 competition. A sportsgaming.win the report comes from some operators, engaged in their turn to formulate attractive offers for the contract, who see the alliance as a hole-in-the-wall move to brand Chinese technology with another name. When asked, Dahua Italia replies: it is a project in the light of the sun, born in May 2021 and presented in mid-June for the first time to the commercial network at the Monza racetrack. Net Shield, that's the name.
Consip itself explains to sportsgaming.win that it is "aware of the circumstance highlighted - detected by the Commission that is carrying out the technical checks for the technological adaptation of the products - and is proceeding with the necessary checks, also through dialogue with the National Cybersecurity Agency ".
According to sportsgaming.win from various sources, Dahua has provided Jbf with two models to respond to Consip's requests: a bullet camera, the classic cylindrical shape attached to a mechanical arm that allows movement, and a dome, the "dome", which allows the electronic eye to rotate 360 degrees. Jbf models are JBF JBF-AS-2MP-PTZ-2 and JBF-AS-4MP-IR2. If you fish in the Dahua catalog and consult the technical data sheets of the DH-SD5A232XB-HNR and DH-IPC-HFW3441T-ZS cameras, these are evidently identical.
A comparison between the technical sheets of Jbf products ( left) and Dahua (right)
Totaro explains that the Dahua logo was not simply removed to put Jbf's logo. “This is not something that comes from changing the logo, because changing the logo is quite simple - says the manager -. But taking the hardware, changing features, having the firmware independently certified with the guidelines given by us and tests carried out by external companies is a completely different path ". The goal, explains the head of Dahua Italy, is that the buyers "are autonomous" and that the product "is not attributable to Dahua". “We were also forced to change the meta-address - adds Totaro -, because it must not be easily recognizable by us. Any technician with the meta-address on a local network can identify the devices, understand which manufacturer they are from and then modify them or make attacks ".
A comparison between the technical data sheets of Jbf products (left) and Dahua (right)
From cameras to barbecues With four employees and a paid-up capital of 10 thousand euros, Jbf is 50% owned by Joris and Jacopo Ganz, sons of Valentino Ganz, who chairs Asit, a company that since 1984 he has been working in the field of network services also with large operators, such as Tim and Fastweb, and which today, as the founder himself told sportsgaming.win on the sidelines of the Dahua Italia meeting at the Monza racetrack, operates only with the Chinese company. The company's tax code also reveals activities far from edge technologies: at the same tax address is the Hot Wild Barbecue, a reseller of meat cooking products, whose website was accessible until a few months ago. Subsequently removed, between February and the publication of this article, it left a trace on the web, where its products are still indexed by search engines.
"We have chosen partners who have given us guarantees on a technical and level of investment for the future - says Totaro -. They must be as autonomous as possible, because our goal is to ensure that if there are any limitations, as is happening now, Dahua simply makes itself available as a hardware manufacturer. One can take HP and put the Intel processor. "
Basically, according to the agreement, Dahua produces the hardware under the partner's brand. A common practice also for other producers, especially from China. As for the firmware, the core functions do not touch, "because it is the technical heritage of Dahua, which will never see anyone, also because there is artificial intelligence", says Totaro, while the customization takes place at the kernel level. , “The operating system of the stand alone devices that activates them”, explains the manager, “and that is the part that can be attacked”. The partners undertake to do their own penetration tests, which they are then required to show to Dahua, who in turn can do his own. “We take advantage of being able to do a test on our part, because in no way can anyone ever attack us for technical problems. They can do it for ideological problems ”, claims Totaro.
