A journalistic investigation into the surveillance practices and equipment used by Georgian authorities by RFE/RL’s Georgian service has shed light on pressing security, privacy and transparency concerns. According to the article most state surveillance cameras used by the Georgian authorities are manufactured by two Chinese companies, Hikvision and Dahua Technology, both sanctioned by the United States. Moreover, according to the RFE/RL’s Georgian service, the country’s Interior Ministry uses a recognition system linked to the Russian intelligence.
The media outlet speaks of a surge in the number of surveillance cameras across the country, adding to concerns about the lack of proper safeguards for data storage and processing.
The number of imported cameras to Georgia began to increase dramatically in 2020, reaching 7,178 cameras. Since then, the number has increased to 9,694 in 2021, 11,806 in 2022, and 16,423 in 2023. For comparison, this number was 2,165 in 2019, 2,097 in 2018, 1,169 in 2011, and only 252 in 2010.
The articles states that there are at least 4318 so-called “smart cameras” in Georgia. The “smart camera” has a range of advanced functions including vehicle number recognition, detecting traffic rule violations, and identifying various types of movements.
Concerns about Russian and Chinese Technology
According to the RFE/RL the Expert-Forensic Main Division of the Ministry of Internal Affairs has a facial and license plate recognition system that uses POLYFACE, an automated face recognition application licensed by Papillon Systems. Papillon Systems, headquartered in Moscow, is a company linked to Russian intelligence.
The company itself boasts “close cooperation” with the Russian law enforcement. According to its official website, “company’s portfolio includes many successful projects, the largest of which is a national multi-level automated system of the Russian Ministry of the Interior with one of the world’s largest fingerprint database.” The company claims to be supplying its products to 43 different countries around the world.
The article cites an investigation by its Ukrainian branch which found that the Russian video surveillance system, used in Ukraine, is capable of sending data to the servers in Moscow. It means that Russia can see footages of Ukrainian locales through the TRASSIR video surveillance system, which is sold by a Russian company called DSSL, “a strategic partner” to the Chinese Hikvision and a supplier to Georgian clients.
Security concerns also become an issue for Georgia, given that the TRASSIR monitoring system is also being used in Georgia, specifically in the community center in the village of Mejvriskhevi, near the occupation line in Tskhinvali.
DSSL’s products are marketed in Georgia by the company Trass-J, which provides services for installing surveillance cameras having the capability to detect faces within crowds enabling future recognition.
As for the Chinese Hikvision, its local official dealer, Neotech told the RFE/RL’s Georgian Service that only in Tbilisi they installed more than 2000 cameras. Their surveillance cameras are used in Gori, Tbilisi and Rustavi.
According to Mikheil Basilaya, a cybersecurity specialist and co-founder of CyberHouse, the issue lies not only with the cameras themselves but also with the common space used to store data in some cases.
The article quotes an anonymous IT specialist with 15 years of experience in the field, who currently runs three companies that sell surveillance systems, saying that some 70-80% of state agencies in Georgia are equipped with Chinese cameras. While the quality of these cameras is “not bad,” the specialist expressed concern about their lack of security measures, which makes it difficult to determine who has access to the footage. “These cameras and systems are particularly vulnerable to hacker attacks.”
For example, Hikvision is a Chinese state-controlled company and its data is “open” to the government. According to the same information, technologies from both Hikvision and Dahua Technology have been used to oppress Uyghurs in China’s Xinjiang province.
Amid these revelations, concerns arise about the vulnerability of cameras from Chinese Hikvision to hacking, amplified by user negligence in implementing essential security measures such as changing default passwords.
RFE/RL points to the findings of the international cybersecurity company CYFIRMA, which in 2022 warned users about the sale of “keys” on Russian-language hacker forums, facilitating unauthorized access to Hikvision’s camera networks. CYFIRMA’s analysis of 185,000 internet-connected web servers used by the Chinese company revealed a vulnerability, with 80,000 of them found to be entirely susceptible to cyberattacks.
Concerns about Handling of Personal Data
The exact number of state surveillance cameras in Georgia is unknown, the article reads. The Tbilisi City Hall, the State Security Service of Georgia, the Ministry of Internal Affair as well as the Special State Protection Service refuse to disclose this information.
Officially, facial recognition cameras are exclusively deployed at airports and border checkpoints in Georgia. In these specific sites, the government employs the services of the Japanese company NEC, which has the capability to detect biometric data of individuals and check them against the databases of wanted persons. This technology was implemented in October 2023 with the financial support of the European Union.
The technology is widely used by the authoritarian states to control their population. The article highlights the case of Russia, where airports and subways in major cities have become dangerous for government dissenters because of the facial recognition systems. Additionally, the article also notes China’s extensive use of surveillance technology, with an average of one camera for every two citizens, as a means of monitoring and controlling people’s behavior.
Challenges in Georgia
The article quotes the former State Inspector Londa Toloraia, who says her office had found many violations of data storage and processing during her tenure. Toloraia was responsible for protecting personal data and investigating abuses of power by law enforcement officials. Her independent and outspoken agency State Inspector’s Service was abolished by the ruling Georgian Dream, which later replaced it with two separate agencies tasked with two functions mentioned above.
Toloraia identifies several key challenges when it comes to storing and processing personal data:
- Ambiguity within state institutions regarding who has access to footages.
- Difficulty to identify individuals responsible for manipulating footage.
- Lack of documentation regarding deletion, editing, or archiving of records, impeding accountability in case of data breaches.
- Minimal penalties for data disclosure failing to deter misconduct.
- Absence of ownership indication on street surveillance cameras, complicating investigations into official violations.
- Police attempts to obtain footage from commercial entities without following proper legal procedures.
Also Read:
- 20/09/2022 – Explainer | Reports of Massive Surveillance, Infiltration of Opposition Parties
- 06/09/2022 – Ruling Party Overrides Presidential Veto on Surveillance
This post is also available in: ქართული (Georgian) Русский (Russian)
