Transparency data

Letter from BSCC in response to a Freedom of Information request from Vice President of Global Affairs, Hikvision, 26 September 2022 (accessible)

Updated 15 November 2023

Professor Fraser Sampson
Biometrics and Surveillance Camera Commissioner
2 Marsham Street
London SW1P 4DF
Date: 26 September 2022

Reference: BSCC-FOI-1122-OC

Letter by email

To: [redacted]

Dear [redacted]

Freedom of Information Request

I write in response to your letter dated 25 August 2022 and received by my Office on 30 August. You ask for information referenced in a letter I sent to the Rt Hon Sir Iain Duncan Smith MP entitled “Risks to UK from Chinese State-Controlled Surveillance”. Your request is for any minutes, reports, notes, emails, research or any other documentation (including, but not limited to, any information received by me from third parties) that I may hold relating to, and underlying, my statements that the Company has played a role in “perpetuating the appalling treatment of Uyghur Muslims” and “cannot be trusted” Your request has been handled as a request for information under the Freedom of Information Act 2000.

In my role as Commissioner I have drawn my conclusions on Hikvision’s actions mainly from information within the public domain, much of which is not disclosed here as it is exempt under the section 21 exemption (information already accessible), which is an absolute exemption requiring no public interest test. However, in the interest of greater transparency, this includes information from the BBC and IPVM. Additionally, most of what I have said is also publicly available on my own website.

On pages 3 to 12 of this letter you will find all relevant emails that I and my Office are holding that relate to the issues outlined in my letter to Sir Iain, including the extent to which I believe Hikvision can be trusted as public surveillance space partners by relevant authorities. Certain information, such as names and email addresses, have been redacted under section 40(2) of the Data Protection Act (DPA) where the individual would have a reasonable expectation of privacy. I also hold information which is exempt from disclosure under s23, which is information supplied by, or relating to, bodies dealing with security matters. This is an absolute exemption and no public test is required.

Attached to my letter by email in response to you is also a letter from the Cabinet Office that relates to the nature of your request, and a report from Big Brother Watch titled “Who’s Watching You? The dominance of Chinese-state owned CCTV in the UK”.

If you are dissatisfied with this response you may request an independent internal review of our handling of your request by submitting a complaint within two months to the address below, quoting reference BSCC-FOI-1122-OC. If you ask for an internal review, it would be helpful if you could say why you are dissatisfied with the response.

[redacted]

As part of any internal review, our handling of your information request will be reassessed by staff who were not involved in providing you with this response. If you remain dissatisfied after this internal review, you would have a right of complaint to the Information Commissioner as established by section 50 of the Freedom of Information Act.

Yours sincerely

Fraser Sampson Biometrics and Surveillance Camera Commissioner Email: scc@sccommissioner.gov.uk

Correspondence set 1

Enquiries

To: [redacted]@hikvision.com

Cc: Fraser Sampson

Tuesday 15 March 2022, 9:34am

Attached

Letter from Biometrics and Surveillance Camera Commissioner to Justin Hollis Hikvision 15032022.pdf (191 KB)

Dear Justin,

Please find attached a letter from Professor Fraser Sampson, Biometrics and Surveillance Camera Commissioner. Please confirm receipt as soon as possible.

It is our standard practice to publish all letters on our website in interest of transparency.

Kind Regards

Office of the Biometrics and Surveillance Camera Commissioner

Correspondence set 2

Fraser Sampson

To: [redacted]@hikvision.com

Cc: [redacted]; Enquiries

Thursday 17 March 2022, 1:45pm

Justin

Thank you for your letter the content of which is noted.

Had I been aware of your presence at yesterday’s event you can be sure that I would have found the time to speak with you.

As you know, it is my policy in the interests of transparency to publish letters at the time they are sent.

Regards

Fraser

[redacted]@hikvision.com

To: Fraser Sampson

Cc: [redacted]; Enquiries

Thursday 17 March 2022, 12:24am

Attached

Letter Surveillance Commissioner 16 March 2022.pdf

Dear Professor Sampson,

I have just returned from the IPSA event we both attended in Birmingham.

It was good to hear you speak today, but unfortunate you had to leave early. Maybe next time we might have a chance to meet.

Attached is my response to your letter from yesterday.

On a personal note, I have received some enquiries from third parties regarding your correspondence, so please could you allow me some reasonable time to respond before you publicise or broadcast your correspondence in the future.

Thank you,

Justin

Correspondence set 3

[redacted]

Sent: 16 March 2022, 4:22pm

To: Fraser Sampson [redacted]

Cc: [redacted]

Subject: Hikvision

Dear Fraser,

We have spoken on the telephone in the meantime however, I thought to send my email below to you anyway.

As discussed, I will advise Hikvision that their membership of the CCTV User Group will be terminated immediately and that their attendance at our conference event will be cancelled and any monies paid will be returned to them.

I trust that this now means that you will now be able to attend our event as planned.

[redacted]

Dear Fraser, [redacted] and I have deliberated Hikvision’s membership of the CCTV User Group a number of times during the ongoing discussions around their unethical approach to doing business in China.  We agreed that Hikvision’s membership would be terminated as soon as HMG came to a decision advising LA’s (and other government departments) that they should not purchase their products due to their questionable human rights record.

To my knowledge, this advice has not been forthcoming and therefore, despite our own views on this, Hikvision remain in business operating normally in the UK and are permitted to supply anyone who wishes to purchase their products, including the British government (NHS, Network Rail, TfL and pseudo state entities such as schools, councils and Highways England to name but a few).

Therefore, at the moment, Hikvision remain a member and exhibitor (for the purposes of clarity, they are not a sponsor) and their attendance is sales related not policy or strategy.

In my view, your taking part and presenting at our event is a wholly worthwhile endeavour in advising our members (some of whom are SCC accredited and others required to be so) in the ethical procurement & operation of surveillance systems; setting the standards for them to follow. This should be sufficient to make anyone not following these ethical guidelines most uncomfortable.  In my view, having Hikvision at the conference provides an opportunity for many to address these difficult questions.

Additionally, Hikvision remain a member of the BSCC ‘Secured by Default’ group and show their compliance in this regard by displaying the Secured by Default logo and the Cyber essentials + award.

Hikvision are now corporate sponsors of the Security Institute, a membership organisation with over 4,000 of the UK’s security professionals as members, many in very senior positions.

[redacted] chairs an [redacted] and works for [redacted] who are one of the largest Hikvision product distributors.

Extrapolating this further, should we also refuse entry to our event to any CCTV User Group member that has supported Hikvision by installing their systems in their town centres?

Our members would be disappointed not to see your presentation, as [redacted] and I did, in Bristol, last week.  It is powerful and makes the point incredibly well and it would be, in my view, far more beneficial that our delegates were able to see it for themselves than it would be to allow Hikvision to effectively silence this debate by ignoring your letter and attending our event anyway.

I would like to have the opportunity to discuss this with you to see how we can agree a way forward.

Regards

[redacted]

From: Fraser Sampson; [redacted]

Date: Monday 14 March 2022, 6:26pm

To: [redacted] – The CCTV User Group; [redacted]

Cc: [redacted]

Subject: CCTV User Group Conference

Hello both

I trust you had a useful couple of days in Bristol and made it home safely.

We touched very briefly on the elephantine presence in the room during my talk: that of those Chinese tech companies who have been involved in the design, construction and operation of detention camps in Xinjiang Province.  I have still had no response to the questions that I raised with Justin Hollis at Hikvision last July and I am about to write to him once again pointing out that, as a sponsor benefitting commercially from the CCTV User Group Conference, the very least Hikvision need to do is provide answers to those questions if they expect me to take part!

I sincerely hope that they see sense and provide answers to the questions which they invited – in the same way as they have unequivocally addressed the reported issues of the security of their equipment -  and allow debate at the conference around these issues which have now become even more compelling since the Uyghur Tribunal’s judgment last December as I pointed out in Bristol.  However, having seen their strategy so far I think there is a real risk that they continue to avoid the evidence and hope this will simply go away, in which case I realise it will present you with a practical problem for which I apologise in advance and for which I thought I should give you as much notice as possible.

Many thanks

Fraser

Correspondence set 4

Fraser Sampson

To: [redacted]

Cc: Surveillance Camera Commissioner

Monday 20 September 2021, 9:23am

[redacted]

Many thanks for this. I’m just back from leave and am keen to assist with your query if I can.

By way of immediate response to your questions, this matter is attracting a lot of interest and enquiry both from within the sector and also across public service providers. I am aware that some companies are reviewing this ethical aspect of their partnership arrangements, particularly where they are working with public bodies and I have provided some views to local authorities in that regard. I am meeting with the minister later in the month to follow up on my recent correspondence before the summer break; I am also in contact with the LGA who are being asked for advice by their local authority members. The government’s public consultation on the revision of the Surveillance Camera Code of Practice has also just closed and my response addresses some of these areas. It is available on our website.

For the avoidance of doubt, my involvement is not an ‘investigation’ (I have no investigatory functions/powers in this area); rather it is an attempt to obtain specific information following Hikvision’s letter to its ‘valued partners’ which invited further query and made some fairly bold statements about the report of the Commons Foreign Affairs Committee. You will have seen from the published correspondence that I have not managed to progress very far.

The process is itself problematic, not just because I am unable to report on any progress about the specific issues that I have raised, but more generally because the way in which an organisation responds to expressions of concern/complaint is an important indicator of its accountability and governance generally. When it comes to the use of surveillance camera systems there is a need for greater transparency and responsiveness and I believe the public have a legitimate expectation that questions about surveillance cameras and the way in which they are used will be answered fully and promptly.

I would welcome a discussion as you propose and have copied this to my team to identify a mutually convenient date for the diary.

Best wishes

Fraser

From: [redacted]

Sent: 17 September 2021, 3:05pm

To: Fraser Sampson

Subject: HIK

Hi Fraser, I’ve been given your contact details by [redacted]. You may know that I’m [redacted]. I know [redacted] and think a similar relationship with you would be useful.

I recently saw your comments on IPVM regarding HIKVision and this started an internal discussion regarding the ethics of [redacted] doing business with HIK. We have agreed to a series of Roadshows with HIK and they are a connectivity partner of [redacted]. So the question are:

• are other companies reviewing their relationships?

• what is your advice on stepping back our alliance with HIK?

• if challenged by HIK about our reluctance, can we cite your investigation?

Look forward to hearing from you.

Regards,

[redacted]

Correspondence set 5

Fraser Sampson

To: [redacted]

Cc: Enquiries

Wednesday 20 April 2022, 2:01pm

[redacted]

I’m trying to confirm DHSC’s position with them before I write to others.  While I don’t believe that a ‘banned list’ approach is the right way to address the relevant issues and prefer the principles-based approach, taking a clear position in relation to specific companies based on an assessment of their practices against principles is a start.  Once one accepts that the proven conduct of a company precludes it from public surveillance partnerships because it breaches those principles then the same rationale must apply to any others whose conduct is so proven?

I’ll revert when I have learned more.

Kind regards

Fraser

On 20 April 2022 at 11:15am,

[redacted]

Hello Commissioner, thanks a lot for this update! If you find out anything else definitely let me know, we will likely cover this (and your letter to Dahua) soon (this week or the next). We know the DT reported that DHSC has banned further Hikvision procurement, but we are wondering if DHSC will ever make it an official / public policy. For now it seems the ban has been quietly confirmed to DT but nothing public.

Regarding the DHSC ban, do you view this as a positive development? As I thought you were against banning specific companies?

Thanks again,

[redacted]

On Tuesday April 19 2022 at 3:40pm Fraser Sampson [redacted] wrote:

Hello [redacted]

Following a press query to our office last Thursday about DHSC’s use of Hikvision cameras, I shared my reply with DHSC as a courtesy. On Saturday the DT reported that DHSC have now banned further Hikvision procurement. I’m trying to find out more today (meanwhile my letter to Dahua is now on the website).

Best wishes

Fraser

Correspondence set 6

[redacted]

To: Fraser Sampson

Tuesday 28 June 2022, 3:08pm

Hi Fraser,

That’s great news indeed, thanks for letting me know. Do you think he’ll take that responsibility on board? I wonder if [redacted] knows as he asked [redacted] about his role last Oct.

I had a look at the Hikvision cameras on the school bus, they “live stream, record, statistical reports, analytics, free wifi, and live GIS” all to protect drivers and passengers. Sort of glad my kids are past school age, I can never remember the school bus as being that dangerous really.

Best wishes,

[redacted]

On 28 June 2022 at 1:02pm, Fraser Sampson [redacted] wrote:

Hi [redacted]

Don’t know if you’ve seen it but the Scottish Parliament has written to [redacted] suggesting he take responsibility for biometrics in schools (and prisons)?

[redacted] is doing a public debate event on all this in Edinburgh in the autumn following the success of our LSE event on LFR.

Kind regards

Fraser

From: [redacted]

Sent: 27 June 2022, 10:56am

To: Fraser Sampson; [redacted]

Subject: DfE new biometric guidance for schools

Dear Fraser,

Hope all is well and I’m glad to see the government has not shifted oversight of your role onto the ICO.

Myself and [redacted] were chatting last week and we wondered if you had yet seen the Department for Education’s new guidance on biometrics in schools after the questions in the Lords on the sixth this month?

I was a little disappointed as the DfE spokesperson kept referring to schools use of ‘live’ facial recognition, which is not used in schools. I am concerned, as the DfE spokesperson said that they would update the guidance on the use of ‘live’ facial recognition which is not relevant (yet) and not the use of other facial recognition systems.

If you did get a opportunity to see the guidance before it is published, I presume by the end of this session next month so schools can use next term, would it be possible for you to check that the DfE have not just made the distinction of ‘live’ facial recognition in the guidance please?

In other news, the New York Bill banning biometrics in schools, A6787 which “Directs the commissioner of education to conduct a study on the use of biometric identifying technology; prohibits the use of biometric identifying technology in schools until July 1, 2022 or until the commissioner authorizes such purchase or utilization, whichever occurs later.” report is due this week so it will be interesting to see who has contributed and what has been summarised. I’ll send a link when the study comes out.

I am hoping to arrange another online meeting next month and wondered if you might be interested in attending and if so when times/dates are good for you?

Best wishes,

[redacted]

Correspondence set 7

[redacted]

To: Fraser Sampson

Thursday 9 June 2022, 5:18pm

Dear Fraser,

Thank you for your email - it was a pleasure to meet you and to listen to your insights on the panel. The meeting at the Embassy went really well, and I was glad to have attended the event last night beforehand.

Yes, a meeting would be great. If your team let me know your availability then I will make sure I am available.

On Thursday 9 June 2022 at 6:22am, Fraser Sampson [redacted] wrote:

From: Fraser Sampson

Sent: 9 June 2022, 6:19am

To: [redacted]

Cc: [redacted]

Subject: Parliamentary Event

Dear [redacted]

It was a privilege to meet you yesterday at what I thought was a very practical session with ideas about what can be done in addition to vocal support for the principles at issue.

As I said, I believe that these surveillance systems are “digital asbestos” and we need to be very cautious in how we treat the things installed by a previous generation but most importantly, we mustn’t keep installing new stuff, particularly in our schools. Eventually we will need to strip them out and replace them with trusted technology partners.

I also believe that we need a coordinated approach to this area with our 5 Eyes partners in light of the security risks. Perhaps your meeting today will help attract some attention to this. From a UK perspective, as [redacted] said, we simply don’t know the size of the problem here and there should be a national review of these systems to get an understanding of the size of the challenge.

It would be great if we could find more time to talk – I’ll ask my team to look at some opportunities in the diary and to make contact shortly.

Good luck today and please let me know if there’s anything else I can do.

Kindest regards

Fraser