BRIG HEMANT MAHAJAN NATIONAL SECURITY: June 2026

Tuesday, 2 June 2026

INDIA IS REPLACING CHINESE CC TV CAMARAS PART 2

This Dependency Didn’t Happen by Accident

The Engineering Phase Begins

The penetration of Chinese surveillance and IoT hardware into India—and globally—was not just free-market competition. It was engineered. And the engineering has entered a new phase.

China’s 2026–2028 IoT Action Plan

In mid-March 2026, nine central Chinese ministries jointly released a new action plan for China’s IoT industry covering 2026–2028. It builds on directives dating back to 2009, when Beijing designated IoT as a “strategic emerging industry” and a “commanding heights” driver of industrial competition.

From Gadgets to Cyber-Physical Control

This plan defines IoT not as consumer tech, but as a total cyber-physical environment—aimed at “ubiquitous intelligent connections among people, machines, and things,” linking the digital and physical worlds.

Five Layers of Control

The industry is structured across five layers:

Sensing (physical devices like cameras and sensors)
Networks (communications infrastructure)
Platforms (software aggregating, storing, processing data)
Applications (services built on top of everything)
Security (access, authentication, and trust frameworks)

Control the layers, and you control what runs on them.

Standards as the Strategic Weapon

The most consequential element is standards. The plan calls for improving the IoT standards system and mapping the “core industrial chain.” Standards determine discovery, authentication, data movement, and interoperability. If the country writing the rules also controls the largest base of connected devices, the rest of the world must comply.

Alignment With China’s 15th Five-Year Plan

Read alongside China’s 15th Five-Year Plan (also released in March 2026), the vision becomes vertically integrated: pooled computing power, satellite internet for coverage beyond terrestrial networks, telecom modernization from 5G through 6G, and data systems governing authentication and access.

A Vertically Integrated Stack

Together, the IoT action plan and five-year plan imply a cyber-physical system where China supplies multiple layers—from endpoints and platforms to compute, connectivity, and standards.

Dependency Becomes Interoperability

This is what much commentary misses: it’s not merely cheap devices being sold. It is architecture being defined—so that even “local replacements” may still operate within rules written elsewhere.

Every Layer Deepens the Attack Surface

Each layer increases interoperability, remote manageability, and embedding into city, factory, power, and transport systems—expanding the surface area for attack even without increasing the number of devices.

The “Secure and Controllable” Meaning

“Backdoors” as a Recognized Risk

Chinese security discussions acknowledge that connected products can include backdoors enabling remote control or covert data collection.

Control Over the System—not Just the Equipment

When leaders emphasize “secure and controllable” digital infrastructure, “controllable” functions as political-technical leverage: shaping who benefits, who can access systems, and what happens when relationships turn adversarial.

How India Is Trying to Fix It

STQC: The Most Immediate Lever

While Delhi removes Hikvision cameras, the policy framework enabling this shift has been building. The clearest tool is STQC certification.

The Essential Requirements (April 2024)

In April 2024, the Ministry of Electronics and Information Technology introduced Essential Requirements for CCTV cameras and video surveillance systems. Internet-connected cameras sold or imported in India must be tested and certified at accredited STQC labs before entering the market. Manufacturers must declare the origin of critical components—especially SoCs and firmware—and submit both hardware and software for vulnerability testing.

Compliance Deadline: 1 April 2026

The industry had two years to comply. That window closed on 1 April 2026.

Who Gets Denied Certification

STQC is significant not only for testing—it also restricts access. As described in the text, Indian authorities refused to certify products from Hikvision, Dahua, and TP-Link, and also devices using Chinese-origin chipsets or firmware. Without STQC clearance, those products cannot legally be sold.

Certification Numbers and Market Control

As of early 2026, 507 camera models had been certified. Indian brands reportedly control over 80% of the domestic CCTV market. Companies like CP Plus, Sparsh, Prama, Matrix, and Qubo have shifted supply chains toward Taiwanese chipsets and locally developed firmware, while global players like Bosch and Honeywell focus on premium segments.

Delhi’s Replacement Plan

Delhi’s PWD announced an initial rollout of 50,000 cameras, replacing Chinese units with “secure and trusted systems,” using a phased approach to avoid disrupting live surveillance coverage.

But the Problem Is National

Delhi is the beginning. Hikvision and Dahua hardware remains embedded across metro systems and central government buildings, and eventually each installation would need similar treatment.

Can CP Plus Rebuild Its Independence?

CP Plus’ Three Moves

With Dahua distribution effectively ended, CP Plus is investing in three areas:

Developing indigenous Indian-IP SoCs via collaboration with L&T Semiconductor Technologies
Working with VVDN Technologies for embedded systems and IoT device design/manufacturing
Establishing an R&D center in Noida (with 86 engineers as of March 2025)

The Speed Challenge

The direction is correct, but the pace is the question. Designing production-grade vision-processing SoCs that compete with a decade of refinement is a multi-year effort—measured in years, not quarters.

India’s Security Layers Beyond CCTV

Telecom: Trusted Vendors and Managed Risk

India blocked Huawei and ZTE from 5G and new telecom infrastructure contracts years ago through security directives beginning December 2020 and tightening over time. The framework requires operators to procure equipment only from “trusted sources” approved by the National Cyber Security Coordinator. Huawei and ZTE were excluded from 5G trials in 2021.

Telecom Act 2023 and Tightening Enforcement

The Telecommunications Act 2023 replaced the Indian Telegraph Act 1885 and established a modern telecom security framework. Since then, oversight has expanded: formal cybersecurity policies, always-on monitoring, and appointment of senior security officers.

Time-Bound Breach Reporting

Breach reporting has become more time-bound, aligning with CERT-In’s six-hour disclosure expectations. The government also reserves audit and intervention rights when vulnerabilities are discovered.

IoT Certification Schemes and Code of Practice

For consumer IoT devices more broadly, India introduced the Code of Practice for Securing Consumer IoT Devices and the IoT System Certification Scheme under ITSAR. These may not yet match STQC’s enforcement readiness, but they extend security-by-design and certification direction beyond CCTV.

Patchwork Instead of One Big Law

Rather than a single sweeping law like the EU’s Cyber Resilience Act, India is assembling a layered patchwork—trusted telecom vendors, national security directives, STQC for surveillance devices, telecom cyber rules for detection and response, and IoT certification schemes for a wider set of connected products.

The Contest Still Isn’t Finished

STQC Fixes Endpoints, Not the Stack

STQC addresses endpoints (cameras and terminals) but not the deeper layers underneath.

What China Covers—and India Still Doesn’t

Beijing’s model covers sensing, networks, platforms, applications, security, and standards. India is contesting sensing and beginning guardrails on networks, but the platform and standards layers remain largely open.

Replacing Devices May Not Replace the Rules

If standards and protocols remain defined elsewhere, swapping a camera or base station won’t fully fix the underlying dependency—because systems will still operate within externally set interoperability rules.

Still, Every Replacement Creates Leverage

Even incomplete progress matters. Each removal forces integrators to compete with non-Chinese components, builds a procurement pipeline, and creates market momentum toward alternatives.

The Risk of Declaring “Finish Line” Too Soon

Replacing a camera brand isn’t the same as replacing the architecture it was designed to plug into. The ceiling camera was a symptom. The disease is dependency on an ecosystem built to keep that dependency invisible until it is too late.

India Has Begun the Surgery

The question is whether the surgery will go deep enough to reach the architecture—not just the hardware.

India Is Replacing Chinese Cameras—but That’s Only the Start PART 1

A Quiet Access Problem Hidden in Plain Sight

Poorly secured, internet-exposed cameras running outdated firmware can provide the kind of quiet, persistent access a state-backed actor needs for long-duration operations—especially inside critical infrastructure.

A Hikvision Camera Inside a Defense Drone Program

A Chinese-made Hikvision CCTV unit was found monitoring the control station of an indigenous Indian military drone program.

The Real Issue Is Systemic Dependence

The camera was the symptom. The disease was an ecosystem—engineered so dependency remains invisible until it is too late to reverse.

What DRDO Showed in June 2023

In June 2023, DRDO’s official X account posted photographs from the 200th flight demonstration of the indigenous TAPAS medium-altitude long-endurance unmanned aerial vehicle at the Aeronautical Test Range in Karnataka’s Chitradurga.

The Ground Control Station: The Nerve Center

The images showed the ground control station—the nerve center where a tri-services team was introduced to the UAV’s capabilities for the first time. Screens displayed flight telemetry and surveillance feeds, with equipment racks lining the walls. Senior officers in flight suits gathered around the consoles.

A Camera Watching the Screens

Mounted on the ceiling, aimed directly at those displays, was a Hikvision CCTV camera.

Why Hikvision Matters

Hikvision is the world’s largest video surveillance equipment manufacturer. It has partial Chinese state ownership through the China Electronics Technology Group Corporation (CETC), one of China’s major defense electronics conglomerates.

What the Camera Could—and Couldn’t—Do

The camera was likely air-gapped, operating on a closed-circuit local recording system with no internet or external network connection. In that setup, it cannot “phone home” or transmit data to a remote server.

But Risk Doesn’t Depend on Internet Connectivity

Still, the vulnerability in Hikvision products is not speculative.

The 2017 CISA Warning

In May 2017—six years before the photograph—CISA issued an advisory about an improper authentication vulnerability affecting several Hikvision camera series.

A Flaw That Could Grant Full Control

Rated 9.8/10 for severity, the flaw could let a remote attacker bypass authentication entirely, escalate privileges, and gain full administrative control—enabling live video viewing, configuration access, credential extraction, and data downloads.

Exploitation Confirmed Years Later

In March 2026, CISA added this issue to its Known Exploited Vulnerabilities catalog, confirming active exploitation. Public offensive tooling has been documented using the weakness to retrieve configurations, credentials, and video snapshots.

A Compromised Camera Can Enable Lateral Movement

A compromised camera can become a launching pad into the broader network where it sits—turning “local surveillance” into a pathway to deeper compromise.

“Launching Pad” Isn’t Just a Phrase

It is literal in real-world campaigns.

Recorded Future’s Account of TAG-38

In April 2022, Recorded Future’s Insikt Group published a threat analysis describing a campaign by a likely Chinese state-sponsored actor it designated TAG-38. The group had targeted Indian power grid infrastructure since at least September 2021, including at least seven State Load Despatch Centres (SLDCs) in North India near the India–China border in Ladakh.

Why SLDCs Are High-Value Targets

SLDCs manage real-time electricity dispatch and grid control. They maintain access to SCADA systems. These are not “soft” targets; they are operational nerve centers of India’s power grid.

Command-and-Control Through Hijacked Cameras

What TAG-38 used for command-and-control was striking: compromised internet-facing DVR and IP camera devices. Many of these cameras were geolocated primarily in Taiwan and South Korea—not India—and were used as relay nodes for ShadowPad malware deployed inside victim networks.

Making Malicious Traffic Look Normal

After separate breaches placed ShadowPad inside Indian networks, the malware needed covert communication with its operators. Configured to talk to hijacked cameras, its traffic could resemble benign connections to random surveillance devices in Seoul or Taipei—rather than communications with a Chinese intelligence operation.

The Pattern Repeats

Poorly secured, internet-exposed cameras running outdated firmware provided the quiet persistence such operations require.

The Broader Implication: Cameras as Infrastructure

Even if not all cameras in those cases were Chinese-made, the core problem remains the same: weakly authenticated, outdated internet-connected surveillance hardware—exactly the class dominated globally by Chinese CCTV manufacturers like Hikvision and Dahua.

The Risk Scales With Concentration

The vulnerability is architectural: any insecure camera can be turned into attacker infrastructure. But when the world’s largest vendors are state-linked and have a decade-long trail of known issues, the overall risk compounds.

What’s Already Inside the Walls

Delhi’s Camera Footprint

Delhi alone has about 2.74 lakh CCTV cameras installed by the Public Works Department since 2020. Of those, about 1.4 lakh cameras installed between 2020 and 2022 were sourced from Hikvision—and the account indicates every unit was Hikvision.

More Cameras Added Later

Another 1.34 lakh were added between 2025 and 2026, though the government states these are now being procured from compliant sources.

A Reference Point: Israel’s Tehran Camera Hacking

The risk is easier to understand by looking at what has happened elsewhere. During the shadow conflict with Iran, Israel reportedly hacked Tehran’s traffic camera network over several years—at one point accessing feeds across the city to track the movements of senior leadership, including Ali Khamenei. The footage was used to build “pattern of life” profiles—routes, routines, and security behaviors—turning a civilian camera grid into a powerful intelligence layer.

Delhi’s Replacements, But Not the End

Hikvision units in Delhi are reportedly being removed. But Delhi may have been the most visible case—not the only one.

Chinese Surveillance Hardware Embedded Nationwide

Hikvision and Dahua surveillance systems are embedded across India’s critical infrastructure: railway stations, airports, power plants, and port terminals. For years, these two vendors dominated the market with cheap, feature-rich equipment available at scale—while scrutiny on where data went, and what firmware did once online, was limited.

Cameras Are No Longer Just Cameras

A modern CCTV system is a networked computing device. It runs firmware, processes video through onboard SoCs, connects to cloud platforms for storage and remote access, and often runs AI analytics like facial recognition, motion detection, and number-plate reading.

“A Computer With a Lens”

Functionally, it’s a computer with a lens. Like any computer, it is only as trustworthy as its code and chip design.

The Supply-Chain Contradiction

CP Plus as the Market Leader

India’s CCTV market is led by CP Plus, the flagship brand of Aditya Infotech, with roughly 21% market share. When the company went public in July 2025—raising Rs 1,300 crore—it leaned on “Make in India” and “national security,” citing the STQC certification framework as a structural tailwind.

The Prospectus Tells Another Story

But the filings show a complicated dependence: in FY25, around 24.7% of Aditya Infotech’s revenue (roughly Rs 770 crore) came from products supplied by Dahua, the world’s second-largest surveillance equipment maker. Historically, Aditya Infotech was Dahua’s exclusive distributor in India.

A Security Brand With Chinese Revenue

In effect, a company positioning itself as a pillar of indigenous security was deriving about a quarter of its sales from a Chinese supplier.

Gradual Reduction, Not Immediate Exit

That dependence declined over time—34% in FY22, 32% in FY23, 28% in FY24, and 25% in FY25—ending in practice as STQC rules took effect.

Growth Supported by Chinese Supply

The trajectory suggests something important: the leading Indian brand rose partly because it could scale with Chinese hardware, while building distribution and recall.

Materials Still Flow Through a China-Adjacent Chain

Supply-chain dependence also matters. A significant share of inputs comes via AIL Dixon (a joint venture involving Dixon Technologies and Aditya Infotech), which accounts for about 52% of materials consumed, with roughly 85% imported. Given China’s dominance in surveillance components and electronics manufacturing, a meaningful portion of inputs may come from Chinese or China-linked suppliers.