GRC

FCC’s first chip-level ban hits Huawei HiSilicon camera kit

The FCC has banned a dashcam and video transmitter over Huawei HiSilicon chips. What component-level rules mean for UK camera buyers.

Scales motif with headline about the FCC banning cameras over Huawei HiSilicon chips

The US Federal Communications Commission has used its new chip-level rules for the first time, blocking a dashcam and a wireless video transmitter because they contain Huawei subsidiary HiSilicon’s surveillance silicon. For UK buyers of cameras and connected kit, the ruling asks what is inside the box, not just whose logo is on it.

What happened

On Thursday 22 October 2026 the FCC said its Office of Engineering and Technology had blocked US marketing and sale of two products: a wireless video transmitter and a vehicle dashcam. Its reasoning was that both products contain a chip made by HiSilicon, a Huawei subsidiary that sits on the FCC’s Covered List of companies judged to threaten US national security.

This is the first enforcement action under rules that came into force on 13 October. Those rules stop the FCC authorising devices that contain logic-bearing “smart” components from Covered List entities. Previously, as The Record reported from the FCC’s own release, the agency’s rules did not prevent “otherwise lawful devices” from including parts made by listed firms. The Covered List dates from a 2019 regulation.

FCC Chairman Brendan Carr called the products potential spyware that pose “an obvious and unacceptable risk to the nation and our people”. Huawei had not commented when the story was first reported.

The detail

The shift is from brand-level to component-level control. Earlier US bans targeted named companies, which left room for rebadged hardware carrying the same silicon under an unfamiliar brand. Judging devices by their internal chips closes that gap.

According to Tom’s Hardware, the part in question is HiSilicon’s Hi3516CV610 Smart Vision system on a chip, designed for dashcams and wireless CCTV. It pairs an Arm Cortex-A7 processor with video encoding, networking and a neural processing unit for on-device AI. HiSilicon’s own marketing, cited by the FCC, pitches the chip at surveillance products and advertises built-in face detection. The datasheet goes further and describes tracking of faces, human figures, pets and parcels across video frames.

Tom’s Hardware says the neural processing unit is the FCC’s concern. On-device analytics mean faces can be detected and catalogued before footage reaches a recorder or cloud service. The FCC’s announcement cited no evidence that these particular devices sent data abroad. Its action rests on who made the component and what it was built to do.

Timeline of UK and US controls on Chinese surveillance and network technology from 2022 to 2027

Why it matters for UK organisations

The FCC’s rule has no legal force in the UK, but it lands on familiar ground. Britain has already acted against Chinese surveillance and network technology through three separate routes, and none of them works at chip level.

The first is telecoms. In October 2022 the government issued its final Designated Vendor Direction to 35 network operators and formally designated Huawei a high-risk vendor. Huawei equipment had to leave the 5G core by December 2023 and must be removed from UK 5G public networks entirely by the end of 2027. The NCSC’s rationale was that, once US sanctions cut Huawei off from US semiconductor technology, the security of its products could no longer be managed. That regime covers public network operators, not the businesses buying cameras for their car parks.

The second is the government estate. In November 2022 Oliver Dowden, then a Cabinet Office minister, informed MPs that a Government Security Group review had concluded “additional controls are required” for visual surveillance systems. Departments were told to stop deploying cameras made by companies subject to China’s National Intelligence Law at sensitive sites, to disconnect such devices from core networks, and to consider removing them without waiting for planned upgrades. The direction applied to central government sensitive sites only. Alicia Kearns, then chair of the Foreign Affairs Committee, called for it to cover all central and local government buildings, and Big Brother Watch had reported that most British public bodies used Hikvision or Dahua cameras.

The third is product security. Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 came into force on 29 April 2024. It bans universal and easily guessed default passwords, requires manufacturers to publish a way to report vulnerabilities, and makes them state how long a device will receive security updates. Those are sensible baseline duties, but they say nothing about where a device’s chips come from.

Put together, that leaves a gap. A UK organisation outside central government can buy a camera that passes PSTI, carries no high-risk vendor’s name and still runs on Covered List silicon. The FCC has now decided that, for the US market, the component is what counts.

Expert view

In my experience, CCTV and other video kit is among the least managed equipment on a corporate network. When we test internal networks, cameras and recorders often turn up on flat segments next to user devices, running old firmware, with management interfaces that nobody has looked at since installation.

That is why I think the provenance argument, real as it is, should not crowd out the basics. A camera with a worrying chip that is properly segmented, cannot reach the internet and is patched carries far less risk than a “clean” camera sitting on the main network with a default password. The useful thing about the FCC move is that it pushes procurement teams to ask a question they rarely ask: what is actually inside this device, and who could influence its firmware?

It is a hard question to answer. Bills of materials for cheap cameras are seldom published and the same chip can appear under dozens of brand names, so organisations will need to ask suppliers in writing.

What to do now

  1. Find your cameras. Inventory CCTV, recorders, video transmitters, intercoms and fleet dashcams, including kit installed by facilities contractors.
  2. Segment them. Put video devices on their own network segment with firewall rules that block outbound internet access unless there is a documented need. This maps to the Cyber Essentials firewalls control and matches the government’s own instruction to disconnect such cameras from core networks.
  3. Remove default credentials. Change vendor and installer passwords on every device, in line with the Cyber Essentials secure configuration control. Older kit may predate PSTI.
  4. Check support periods and patch. Confirm each manufacturer’s update period, apply firmware fixes under the Cyber Essentials security update management control and plan to replace unsupported devices.
  5. Ask about components. Add a procurement question on chipset and firmware origin for new video and IoT purchases, and ask suppliers to confirm in writing whether products include parts from Huawei, HiSilicon or other firms the US has listed.
  6. Treat sensitive sites differently. Where cameras cover secure areas, boardrooms or critical operations, follow the logic of the 2022 government direction: avoid high-risk suppliers and consider early replacement rather than waiting for the next refresh.

Bottom line

The FCC has moved from banning brands to banning components, and its first target is the kind of camera hardware found in offices, fleets and car parks across the UK. UK rules on telecoms vendors, government cameras and product security each cover part of the problem, but none looks at the chip. Until that changes, organisations must ask suppliers themselves and keep cameras isolated, patched and off default passwords.

Sources

Related Posts