LAST UPDATE | 14 Feb 2023

THE NATIONAL CYBER Security Centre is drafting formal procurement recommendations on the use of certain types of IT equipment for Government data services. 

It comes as the The Irish Council for Civil Liberties (ICCL) sought clarity around media reports that the Office of Public Works (OPW) will conduct a review of best practice regarding CCTV systems.

The human rights group last week raised concerns about the use of Hikvision surveillance cameras inside and outside the Houses of the Oireachtas in Dublin. Hikvision has been linked to the Chinese Communist Party. 

A spokesperson for the Taoiseach told reporters today that they do not comment in detail on security matters, but added that the Oireachtas and An Garda Síochána work closely on security arrangements for Members of the Oireachtas and the parliamentary estate.

“The Government is fully conscious of the importance of technology security across Government and other State buildings.

“The National Cyber Security Centre works with Government Departments and Agencies to mitigate the risks associated with IT products and services,” they added. 

RTÉ reported yesterday that the OPW, which has responsibility for public buildings, said that “in light of recent developments regarding CCTV” it is to review best practice. 

The OPW said it would “implement any recommendations as necessary” after a review “in collaboration with industry experts”. 

The ICCL has today written to the OPW and the Houses of the Oireachtas Commission seeking clarity around reports that a review of best practice will be carried out. 

“While we acknowledge that the OPW has responded swiftly to the concerns we have raised, we currently have no information about the details of this review,” ICCL executive director Liam Herrick said. 

“There are a number of outstanding questions relating to how and when the surveillance cameras currently in the Oireachtas were procured, and the processes and procedures relating to CCTV systems which the OPW and the Houses of the Oireachtas currently have in place,” he said. 

Herrick said it is “essential the OPW makes public the intended scope and remit of the reported review and articulate publicly its Terms of Reference, who will conduct the review, what bodies will be consulted as part of the review and the review’s durations and timeline for publications”. 

He added that the review needs to address how the OPW assesses questions of data protections, national security and human rights in its procurement processes. 

“Finally, given the serious concerns regarding Hikvision, we have asked again whether the OPW and the Houses of the Oireachtas will now remove Hikvision cameras pending outcome of the review,” Herrick said. 

Hikvision

Hikvision has been banned in several Western jurisdictions and institutions because of security concerns. This week, Australia removed hundreds of the firm’s cameras from its defence sites due to issues relating to national security.

In November, the US government said it was banning telecommunications and video surveillance equipment from several prominent Chinese brands, including Hikvision, in an effort to protect its communications network.

Security cameras made by Hikvision were also banned from British Government buildings in November.

In a letter to the Oireachtas commission earlier this month, along with the political party leaders, the ICCL raised concerns about the Chinese Communist Party being a controlling stakeholder in Hikvision, and said its devices in Italy had sent data back to China.

“In addition to the risk that cameras inside the Oireachtas may be reporting back to China, security researchers regularly find new security vulnerabilities that allow hackers to seize full control of various types of Hikvision cameras,” the ICCL’s technology fellow, Dr Kris Shrishak, said. 

“Hackers can record what the cameras see and, potentially, what they hear.

“ICCL has directly observed Hikvision cameras inside the Oireachtas Buildings and about its grounds. The cameras are positioned at locations where they can capture video of TDs, senators and staff, and their private conversations. They may also capture what was said,” he added.

Speaking at the Foreign Affairs and Defence Oireachtas Committee today, Tánaiste Micheál Martin said that Hikvision security cameras have only been identified by the Department of Defence at a Civil Defence building in Rosscrea, Co Tipperary. 

In a statement to The Journal, a spokesperson for Hikvision said “it is categorically ralse to represent Hikvision as a threat to national security”. 

“No respected technical institution or assessment has come under this conclusion,” they said. 

The spokesperson said that as a manufacturer, Hikvision “does not store end-users’ video data, does not offer cloud storage in the Republic of Ireland and therefore cannot transmit data from end-users to third parties”. 

They said Hikvision cameras are “fully compliant with the applicable Irish laws and regulations and are subject to strict security requirements”. 

“Hikvision takes all reports regarding human rights very seriously and recognises our responsibility for protecting people,” the spokesperson said. 

“The company has been engaging with governments globally to clarify misunderstandings about the company and our business and address their concerns.” 

With reporting by Tadgh McNally