At a location he keeps secret, John Honovich was on his laptop, methodically scouring every link on a website for a conference half a world away. Hikvision, the world’s largest security camera manufacturer, was hosting the event–the 2018 AI Cloud World Summit–in its hometown of Hangzhou, a city of about 10 million people not far from Shanghai. Honovich, the founder of a small trade publication that covered video surveillance technology, wanted to find out what the latest Hikvision gear could do.
He zeroed in on one section of the conference agenda titled “Eco-Friendly, Peaceful, Relaxed” and found a description of an AI-powered system installed around Mount Tai, a historically sacred mountain in Shandong. A video showed Hikvision cameras pointed at tourists climbing the thousands of stone steps leading to the famous peak. Piano music played as a narrator explained, in Mandarin with English subtitles, that the cameras were there “to identify all visitors to ensure the safety of all.” The video cut to a shot of a computer screen, and Honovich hit pause. He saw a zoomed-in view of one visitor’s face. Below it was data that the camera’s AI had inferred. Honovich downloaded the video and took screenshots of the computer screen, for safekeeping.
Later, with the help of a translator, he scrutinized every bit of text on that screen. One set of characters, the translator explained, suggested each visitor was automatically sorted into categories: age, sex, wearing glasses, smiling. When Honovich pointed at the fifth category and asked, “What’s this?” the translator replied, “minority.” Honovich pressed: “Are you sure?” The translator confirmed there was no other way to read it.
Honovich was shocked. In his many years in the industry, he’d never seen a surveillance company set out to automatically detect racial minorities. The feature seemed completely unethical to him, and he immediately wondered how China might use it against the Uyghur people, a mostly Muslim ethnic minority group, in the province of Xinjiang. Honovich had seen reports trickling out in the West of Uyghurs being subjected to constrictive surveillance and mass detentions. Clicking through the AI Summit website, Honovich couldn’t tell whether Chinese authorities were using this technology to oppress minorities, but he saw that danger coalescing. He quickly wrote up an article about Hikvision’s ethnicity-detection technology, including the video, screenshots, and a no-comment from the company, and posted it on the website of IPVM, the trade publication he had founded.
He talked about the discovery with one of IPVM’s reporters, Charles Rollet, a Frenchman who lives outside the US and also keeps his location secret. Rollet had written about how Hikvision and Dahua, the second-largest video surveillance manufacturer in China, were reaping huge profits from government work in Xinjiang. Rollet had a newspaper background and, though he was 25, talked like an ink-stained newsie twice his age, all “scoops” and “calling out abuses” and “hard-hitting news.” By trawling through publicly available materials online, Rollet had learned that Hikvision had landed a deal to build a mass face-recognition system to cover one Xinjiang county–including a “reeducation” center and some of its mosques–and a contract to install videoconferencing systems in mosques, presumably so attendees could watch sermons broadcast by the government. Dahua won the bigger contract: $686 million to build camera-equipped police stations in another part of Xinjiang. The deals specified that the companies would install these systems, run them for a number of years, and then pass them off to the government. In many aspects of the government’s video surveillance in Xinjiang, Rollet reported, the two companies were “deeply involved.”
Hikvision and Dahua cameras also happened to hang on houses, businesses, and public buildings in the US and much of the world. Security system installers eagerly sold huge numbers of the cheap cameras. Global financial institutions, such as Fidelity International and Norway’s sovereign wealth fund, were enthusiastic investors in the profitable, fast-growing Chinese companies. American chip giants Intel and Nvidia sold them silicon to power their face recognition.
That would all soon change. Over the next few years, IPVM’s writers unearthed one damning detail after another on Chinese surveillance gear. Their scoops would end up influencing national policy, changing those companies’ fortunes, and placing the reporters themselves squarely on the front lines of the US-China cold war.
I first met Honovich on a summer day in New York, in Brooklyn’s Marine Park, not far from where he grew up. There are no pictures of him on IPVM’s site or on his LinkedIn, a decision I would later understand. He is a small-framed man, with glasses over close-set eyes and a boyish face. We sat at a small table with an inlaid chessboard, and Honovich, dressed in shorts and a T-shirt, started telling me about the surveillance industry in rapid-fire sentences.
Ace, who lived in Pennsylvania, was an experienced security system installer and frequent commenter on IPVM’s posts. With a big red beard and shaggy hair, he sometimes thought about living off the hilly Pennsylvania land near where he grew up, making omelets from eggs laid up the road. In 2013, Ace wrote one of the publication’s first posts testing Hikvision cameras, comparing four of them against models from other manufacturers. He was impressed to find that they were as good as the other brands while costing much less.
Those early posts established not just a voice and market for IPVM but also an ethical framework based on uncompromising integrity. If IPVM gave a product a positive review, Honovich would bar its maker from using the site’s words as a promotional tool and threaten to cancel the subscription of any company that broke this rule. Honovich also felt that the term “Chinese company” could be interpreted as having racist overtones, so he had writers use the idiosyncratic term “PRC company” instead. Whatever the term, those companies were about to dominate the IPVMers’ world.
In 2015, ace flew to Shenzhen to attend the China Public Security Expo at a colossal convention center. Throngs of people stood outside in hour-long lines waiting to get in. Ace saw people selling their entrance badges as they left. A few entrepreneurial folks were hawking packets of company brochures they had collected from booths. Once inside, Ace walked over to the large Hikvision exhibit. It was mobbed by people gawking at demonstrations of face recognition cameras, biometric doors, and other products that hadn’t yet made it to the US. Once in a while, a drone would pop into the air. It struck him that the well-known Western and Japanese brands that had long dominated the market were afterthoughts here; Panasonic’s booth was sparsely attended. Ace could see that surveillance wasn’t a niche business in China–it was part of popular tech culture, and Hikvision was leading the pack. Within two years, Hikvision would become the number two seller of security cameras in the US.
But as Honovich kept an eye on the emerging powerhouse, he began to notice problems. In its English-language materials, Hikvision portrayed itself as an ordinary company, separate from China’s government. But Honovich wrote a series of posts showing that it had spun out of a government-owned firm, which remained its largest and controlling shareholder, and that it had received billions of dollars in government loans. Hikvision’s dazzling growth, he argued, was mostly fueled by government contracts. By Honovich’s reckoning, Hikvision wasn’t functionally separate from the Chinese government.
China’s other surveillance giant, Dahua, also came under IPVM scrutiny. In March 2017, a security researcher going by the name Bashis published a post in the subscriber area of IPVM.com. “I’m speechless, and almost don’t know what I should write,” he began. Bashis described a security vulnerability in numerous Dahua products that revealed the devices’ usernames and inadequately obscured versions of the passwords. Bashis wrote, “This is like a damn Hollywood hack, click on one button and you are in,” and he said it seemed like a “backdoor” left intentionally by the creator. Anyone who exploited the vulnerability could potentially watch the camera’s videostream and–since IP cameras are networked computers–also use the camera to access the rest of the victim’s internal network or as a bot to launch online attacks. A well-known security writer covered the leak in a blog post and called it “an embarrassingly simple flaw.” In Bashis’ post, he included a short section of code to show how easy it was to exploit the vulnerability. Honovich quickly took down the code, but it spread on email lists and other sites. Dahua scrambled to distribute patches over the next few days.
IPVM was becoming a hub for people who worried about these companies’ security. Andrew Elvish had seen the problems up close and spoke about some of his concerns to IPVM reporters. Elvish was the vice president of marketing at Genetec, a maker of software for video surveillance systems. In one incident, a Genetec client was using a Hikvision camera and needed some help. When the client opened a customer support case with Hikvision, the company sent back images from the client’s camera without asking for the login information, according to Genetec security chief Christian Morin. It seemed clear to Morin that Hikvision and Dahua had “magic keys” to access their cameras whenever they wanted. “These devices can serve as beachheads,” Morin says, through which nefarious actors “can take down the rest of your network.” Genetec eventually stopped using Hikvision and Dahua gear. IPVM “played an instrumental role” in exposing these “very suspicious cybersecurity flaws,” Elvish says.
Dahua and Hikvision deny leaving intentional backdoors, saying such security problems are normal for any major tech manufacturer and that they patched them appropriately. “There is no evidence anywhere in the world indicating that Hikvision’s products are used for unauthorized collection and transit of information or data of end users. Hikvision would never compromise or harm our customers’ interests,” Hikvision told me in a statement. Dahua put out a statement saying, “We have provided remedies to correct those issues with our customers. We take cybersecurity very seriously.”
In May and June of 2017, Hikvision lashed out at Honovich in four posts on its own blog. “Does the online blogger devote 100 percent of his time to writing tabloid-style headlines and sensationalist anti-China rhetoric?” asked one post. “Hiding behind a keyboard, the tabloid’s staff takes unfounded potshots at our entire industry, bullying one company at a time. It is cyberbullying, and it is a cyberattack on hard-working people.” One post suggested that the default name given to anonymous commenters on IPVM posts–“Undisclosed”–might be a Honovich sock puppet.
A few days after the sock puppet post, Jeffrey He, the president of Hikvision USA, emailed Honovich to invite him to an off-the-record meeting at a hotel at New Jersey’s Newark Liberty International Airport. Honovich had talked with He a number of times in the course of reporting, and he figured Hikvision leadership wanted to clear the air. Honovich showed up at a small conference room in the hotel, where He and two other senior Hikvision employees were waiting. They faced each other across a conference table. One of the Hikvision people held a clipboard, Honovich recalls, and began asking him questions from a written list: Why did he write the things he posted on IPVM? How did the company really make money? What did he have against Hikvision? Honovich was taken aback and tried to explain that he had no hidden agenda or revenue source beyond subscribers. To him, the meeting felt like a criminal interrogation–“Where were you on the 4th of May?”-type stuff. (A Hikvision representative said that Honovich and He had agreed the meeting would be off the record and declined to comment further.)
After about 15 minutes of grilling, Honovich went to the bathroom to catch a breath. He was surprised to take that much heat in person, but he saw himself as someone who could handle it. As he told me during our meeting in Marine Park, “I get satisfaction out of standing up.”
Soon, IPVM’s coverage caught the attention of policymakers in Washington, DC. Intelligence agencies and news outlets in the US and other Western countries were already sounding alarms about networking equipment made by Chinese companies–particularly Huawei, one of the world’s tech giants. Now parts of the US government were concerned about Hikvision and Dahua, too, and began imposing sanctions on them. In August 2018, Congress passed a law barring the federal government from buying gear from Huawei, Hikvision, and Dahua, among other Chinese tech companies. The Congressional Executive Commission on China, a bipartisan group that monitors human rights and the rule of law in the country, cited Rollet’s coverage in its 2019 annual report, writing that “IPVM provided evidence that the video surveillance company Hangzhou Hikvision Digital Technology was directly involved in the construction, operation, and ongoing maintenance” of the Xinjiang surveillance system.
As IPVM waded deeper into big policy questions, Honovich decided to hire someone to deal with government officials and research how surveillance affected the public. Conor Healy, just out of college and trying to figure out what to do with his life, came across IPVM’s posting on a job board and was intrigued: It didn’t say much about qualifications, instead emphasizing that the company needed someone with a strong sense of ethics. Healy saw himself as principled and eager to stand up for his beliefs, and in an interview he convinced Honovich of the same. Healy started working for IPVM in the middle of 2020 and soon joined an investigation into “fever scanners” that many venues bought during the pandemic. IPVM’s engineers were skeptical of the scanners’ abilities to detect fevers under real-life conditions and wanted to test them at the company’s new headquarters in Bethlehem, Pennsylvania. Healy was brought in to help with the research.
The HQ was a big step up from the storage facility in Honolulu. Inside the century-old, 12,000-square-foot former silk mill, in two cavernous, concrete-floored rooms, IPVM employees tinkered with piles of security gear. Ethan Ace rigged a bunch of fever scanners to a rolling cart and began probing them. In one extreme test, an engineer rode by the rig on a skateboard to see how the scanner behaved when given little time to register his temperature. In another, he held a hot bag of water on his forehead until he couldn’t stand it anymore, then walked by.
The scanners, they learned, were measuring people’s skin temperatures from afar, then using an algorithm to try to divine their internal temperatures. When Ace compared the raw readings with the algorithm’s interpretations, he could see that the software was squeezing nearly all of the measurements–no matter how high or low–into the small range of normal human body temperatures. The fever scanners, Ace said, were in fact “rigged” to almost never show fevers. The devices were giving customers a false sense of comfort, the testers concluded, while pulling in hundreds of millions of dollars for their makers.
As Healy looked at the graphs and their meaning became clear, he was astonished by the companies’ greed. He took a walk with Honovich and confessed to having some doubts–what if they’d made a mistake? Honovich, having spent 20 years fighting mendacity in the security industry, told Healy to follow the data and not be swayed by corporate claims. “That’s one of the founding premises of IPVM: Being dishonest and unethical is a competitive advantage,” Honovich told me. Negating that advantage was IPVM’s raison d’?tre.
Healy and Ace pulled the data together, wrote up an academic article, and got it published in the Journal of Biomedical Optics. Within days, the US Food and Drug Administration warned the public that fever scanners could be inaccurate and sent warning letters to some manufacturers. Healy’s first leap into a policy argument had gone well. Soon, he would be helping IPVM wage much bigger wars, with much bigger opponents.
In december 2020, an IPVM employee made a blockbuster discovery. The reporter, who keeps his identity secret because of the harassment some IPVMers get for their controversial work, discovered that Huawei and a Chinese AI unicorn called Megvii had tested a literal “Uyghur alarm”: The system used AI to analyze people’s faces, and if it determined that a passerby was Uyghur, it could send an alert to authorities. At the time, Huawei wasn’t publicly known to be participating in China’s racial surveillance system. IPVM partnered with two Washington Post tech reporters to get the information out.
The Post published an article on the same day as IPVM and credited the security outfit with the discovery. Dozens of publications picked up the story. For the first time, an IPVM report was national news. Reacting to the Post report, US senator Ben Sasse from Nebraska said, “While Huawei sells contracts with fancy talk about connecting people around the world, they’re working to send Uyghurs to torture camps in China.” Senator Marco Rubio from Florida tweeted, “The sick people at @Huawei developing software to recognize the faces of #Uighur Muslims & alert the communist government of #China.” Antoine Griezmann, a French soccer star who had appeared in prominent ad campaigns for Huawei, canceled his sponsorship deal. Huawei released a statement saying it wasn’t involved in ethnicity detection, yet the Post reporters promptly found other documents on a Huawei website showing it had worked on race-detecting systems with at least four other partners besides Megvii.
Spurred by his colleague’s discoveries, Rollet, the former newspaper reporter, began turning up more evidence of racial surveillance in China. He found product support documents for Dahua cameras that provided “real-time Uyghur warnings” to police. Another document showed that Dahua cameras could track people in the illegal sex business, thieves, and “Uyghurs with hidden terrorist inclinations.” Sitting at a caf? and goggling at the file on his laptop screen, Rollet felt that he was face-to-face with “the banality of evil”–bland technical manuals for an automated system of brutality. Thinking of movies he had seen about historical genocides, he started to cry. IPVM provided the documents to the Los Angeles Times, and the paper published its own investigation in February 2021.
IPVM’s reporters went on a tear, digging up more damning evidence and providing it to bigger publications to disseminate. The BBC published a report on Huawei’s patent filings for AI race detection in China; Reuters wrote that Hikvision and Dahua had helped draft technical standards for mass face recognition systems; The Wall Street Journal revealed that Hikvision had deep, long-standing ties to the Chinese military. And so on. Each time, the companies involved insisted that the project was a one-off test, an unimportant slipup, or regular corporate behavior.
Concerns about the companies’ security and human rights issues finally erupted. In November 2021, President Biden signed a law that blocked the introduction of new video surveillance equipment from Hikvision and Dahua and communications equipment from Huawei in US telecom networks. Models that the companies had already sold in the US would become obsolete over time, gradually consigning them to irrelevance. IPVM played a crucial role in “exposing the Chinese government’s gross human rights abuses perpetrated with the help of its video security and surveillance systems,” US representative Claudia Tenney from New York, a cosponsor of the law, told me. “IPVM’s work is key to unearthing the full extent of the security risks posed by the CCP and state-controlled or -directed technology companies.”
Even the security industry–much of which had continued to support Chinese manufacturers because of their cheap and popular gear–largely turned against them. The Security Industry Association trade group expelled Dahua, and Hikvision quit soon after, leaving no doubt about who it blamed for its departure. “It has been disappointing and frustrating to witness the cynical, anti-competitive, unscrupulous, and disingenuous efforts of IPVM to target member companies and undermine the mission of SIA with its invective and opaque financial motives,” Hikvision wrote in a resignation letter obtained by the website Security Info Watch.
Honovich banged out a feisty response: “We are only ‘opaque’ to Hikvision because they cannot understand putting ethics over profits,” he wrote in a post on IPVM. “A PRC government organization with 40,000+ employees, Hikvision cannot control IPVM, an American small business with just 25.”
The fight for the US market was over, and Hikvision began a slow retreat. But IPVM wasn’t done with China.
In september 2021, Conor Healy, IPVM’s government liaison, flew to London to participate in a people’s tribunal chaired by the lead prosecutor of the war criminal Slobodan Milo?evi?. The goal of the trial was to determine whether the Xinjiang crisis amounted to genocide, and Healy was there to testify on IPVM’s scoops in the region. At a reception for participants, a human rights researcher told Healy about an ethnic minority family that was in trouble. The father, Ovalbek Turdakun, an ethnic Kyrgyz and citizen of China, had spent a year in a “reeducation” center in Xinjiang. He, his wife, and their son had fled to Kyrgyzstan, but they were at risk of being deported back.
Healy reached out to some of his contacts. A US State Department official suggested the family try to get to a neutral country such as Turkey and from there petition the US government to let them in. A Christian organization agreed to pay for the family’s exit, but Healy was having trouble finding someone who could shepherd them to Turkey. He decided to do it himself.
In December, Healy flew to Bishkek, Kyrgyzstan, and found himself in a child’s bedroom sitting across from Turdakun. The Kyrgyz man sat in silence, drawing on his palm with a pen. His wife sat beside him, a calm and determined look on her face, while their 11-year-old son smiled happily, unaware of what was about to unfold.
Healy was going to try to escort them across the border that day. A Russian man who transported kids for a local school pulled up in a small bus, and they filled it with seven suitcases stuffed with almost everything they owned. As the group left the city and drove down dark roads, Healy bought plane tickets on his phone, having left it until the last minute to keep Chinese authorities from tracking them. He couldn’t shake what he’d heard from a human rights contact: If the Chinese government was going to kill them, it would likely be in the car on their way out of the city.
They made it to the airport, and Healy and the family nervously approached border control. Healy took their passports and, along with his own, handed them in a stack to a customs officer. The officer flicked through Healy’s, looked at the other passports, frowned, and walked off. A few minutes later, he returned with a more senior officer whose uniform was covered with ribbons and medals. The two officers argued with each other in Kyrgyz for a few minutes. Then the senior officer turned to Healy and asked whether he loved Kyrgyzstan. Healy nervously blurted out something about the beauty of the mountains before realizing he sounded ridiculous, since the city was blanketed in thick smog. The officer paused for a minute, then let them through. The clang of the stamp on the passports was the sweetest sound Healy had ever heard. As Turdakun, who didn’t speak much English, walked through, he smiled at Healy and said, “Nice.”
In Istanbul, Healy interviewed the parents for three days in a hotel room, over glasses of Turkish tea, to find material for their application to immigrate to the US. Turdakun described in detail how he was shocked with electric batons, injected with noxious chemicals, and tied to a steel interrogation chair in a room by himself for over 24 hours at a time. The ever present masters in his cell were three security cameras. If he talked to another inmate, a guard watching the videofeed would bellow at him through a loudspeaker to stop. When he wanted to use the rudimentary toilet, he would look at a camera and ask for permission. Even outside the camp, Turdakun said he was watched by face recognition cameras hanging all over Xinjiang, and when he went out, police often quickly appeared and interrogated him. Healy showed Turdakun an image of the Hikvision logo on his phone and he recognized it. “Ah, that’s a brand of video camera. They’re everywhere,” he said. The same logo, he said, was on the cameras in his cell.
Healy flew back home after the interviews but continued to help the family with their application, as did other advocates. A human rights lawyer who wants to call Turdakun as a witness at the International Criminal Court in The Hague wrote a letter to the US government on the family’s behalf. “It is vital that his evidence is available for the ICC and for the international community,” he wrote in the letter, as quoted in The Guardian. “It is crucial to keep them safe and secure.” After three months in Istanbul, the family got a special type of immigration visa for people called to testify in court, and in April 2022 they flew to the US. As they exited security at Washington Dulles International Airport, Healy was there to welcome them to the United States. He and Turdakun hugged. Now that the family was safely in the US, Healy wrote a post on IPVM about Turdakun’s experiences: the first direct evidence of Hikvision cameras being used in detention cells in Xinjiang.
as a reporter, I was never going to get as involved in the story as Healy did. Still, I wondered whether I might be able to peek inside the dark world of Chinese surveillance myself. Using what I’d learned of IPVM’s reporting techniques, I made a short list of search terms, starting with “minority” in Chinese, and began scouring the internet.
When I got a result that looked promising, I copied the text into a translation tab. It didn’t seem like much, so I went back and tried different searches, sometimes incorporating new terms I came across. Within half an hour, I found a Chinese page on Hikvision’s Indonesian website describing a server that analyzed surveillance video. One of the facial attributes that the server’s software was supposed to detect: “Minority: unknown, yes, no.” The translation was stilted, but in the context of everything IPVM had reported, clear enough.
I’d stumbled on what appeared to be another tiny part of China’s racial-persecution system. I thought of something Honovich had told me: “If the Nazis were here, they would probably design user manuals for everything they built.” A sickening feeling came over me. This wasn’t evidence filtered through someone else’s description, subject to interpretation–it was a vile secret the internet had whispered just to me.
When I went back to the page a few weeks later, it had all been translated to English, the bit about detecting minorities scrubbed. I scrambled through documents on my hard drive and realized I’d made the rookie mistake of failing to archive the page: no screenshots, no PDFs, no proof. I copied and pasted the URL as fast as I could into the Wayback Machine, an archive of websites, and found an old version of the page. It was as I’d remembered it, touting the server’s minority detection. I quickly saved it in three formats.
Even as our faces are increasingly tracked and analyzed by computers, and distant sirens of dystopia ring louder, the US has largely declined to regulate video surveillance and face recognition. In the absence of restrictions, Honovich says he’s watching for trouble. “AI can do magically positive things for society, but you can do terrible things as well,” he says. “There’s a risk of police using it, there’s a risk of companies using it, there’s a risk of people using it.”
By now, I understood why Honovich was so careful to limit his own exposure to face recognition. “They can start mining all these videos and figuring out where you are,” he says. “I try to keep basically a low profile on the internet. It’s not gonna 100 percent stop it, but I’m not sure why I want to give them more shots to identify me all over the place.”
“Who’s them?” I ask.
“The them. Could be the US, could be China. Could be whoever.”
With a prick of anxiety, I wondered what “the them” might know about me and whether I should take down public pictures of myself. I concluded there was no point. My face was already out there in the cloud, available for anyone to analyze. That loss of privacy was forever.
Post Disclaimer
The information provided in our posts or blogs are for educational and informative purposes only. We do not guarantee the accuracy, completeness or suitability of the information. We do not provide financial or investment advice. Readers should always seek professional advice before making any financial or investment decisions based on the information provided in our content. We will not be held responsible for any losses, damages or consequences that may arise from relying on the information provided in our content.
