Cyber vulnerabilities and technical regulation of China-made CCTV IoT surveillance cameras in Australia

Internet of Things (IoT) devices used on a wide scale are currently underregulated in Australia. Installing IoT devices on private property can lead to data security issues if targeted. In key locations like government buildings, the risk of surveillance increases. This research article addresses the recent national security concerns regarding China-made IoT CCTVs in Australia that had few technical evaluations of the cameras before their removal. This two-stage interdisciplinary research article proceeds in the following steps: first, by using the Common Vulnerability Scoring System (CVSS) framework, we assess the vulnerabilities of three IoT CCTV providers—Hikvision, Dahua, and Avigilon—that have been installed on Commonwealth government buildings and, second, we evaluate those findings against Australia’s existing IoT CCTV regulation frameworks. We detect vulnerabilities in all three systems, although there are no High or Critical vulnerabilities in Avigilon devices when compared to Hikvision and Dahua. We also find that the current Australian regulations simultaneously overlap and do not sufficiently cover the existing cyber-vulnerabilities. The overlapping security frameworks, guidelines, and regulations address organizational cyber-hygiene and environmental security. Technical cybersecurity frameworks, however, are currently available only for select Commonwealth Government agencies on demand and are classified, excluding guidance for industry actors and state governments. We conclude that unified and mandatory cybersecurity guidelines would benefit the clarity of IoT CCTV systems and support the consumer benefit.