Surveillance cameras proliferate, most imported from China

The Internet Protocol Camera, or IP camera, market mainly consists of foreign products, and domestic brands have a "modest" presence, it said.

IP cameras are capable of sending and receiving data over the Internet, operate independently and transmit live images to devices like phones, computers and storage servers.

The ministry said in the last five years more than 16 million surveillance cameras have been imported, 96.3% from China, whose popular brands include HikVision, Ezviz, Dahua, iMou, KBVision, and Xiaomi.

"It is estimated that by 2025, Vietnam will have over 20 million surveillance cameras in use, equivalent to one-fifth of the country's population."

This is the first time such data has been disclosed.

Surveillance cameras are among the devices targeted by hackers in cyberattacks, posing a significant threat of intrusion and hijack.

On social media there are more and more offers to sell leaked images and videos from surveillance cameras for VND200,000 (US$8) to VND1 million.

According to 2021 statistics from the ministry, some one million Vietnamese IP addresses were found in IP botnet networks every month, 5% directly related to malware from surveillance cameras.

A botnet, a portmanteau of "robot network," is a network of computers infected by malware and under the control of a single attacking entity.

"Safety and security issues related to camera devices are becoming a significant concern in society," the ministry noted.

This is also a reason to develop and issue a set of national technical regulations on basic information security for IP cameras, it said.

A draft National Technical Regulation on Basic Information Security Requirements for IP Cameras it issued earlier this week requires cameras distributed, researched and developed in Vietnam must meet technical requirements such as a unique default password, managing security vulnerabilities, updating software, managing communication channels, protecting and deleting user data.

The default password must be unique to each device and meet complexity standards such as a minimum of 8 characters including uppercase and lowercase alphabets, numbers and special characters, and manufacturers need to publish updates within three days for security vulnerabilities and within five days for system software errors.

These are based on standards created by the European Telecommunications Standards Institute for consumer IoT devices and adopted by many countries.

The ministry has admitted these regulations would increase costs, reduce production efficiency and reduce flexibility of use, but pointed out users would have greater peace of mind, better protection of privacy and personal data and reduced risk of losing important and sensitive information.

The draft will be available for public inputs until Oct. 23.