Towards Technology-Based Regulation of China-Made IoT Surveillance IP Cameras: The Case Study of Australia

Internet of Things (IoT) devices are currently under-regulated in Australia and in most countries/regions globally. Installing IoT devices on private property can cause security issues if an individual, business or institution becomes a target. When IoT devices are put in critical locations, such as federal or state government buildings, the likelihood of that location being a surveillance target rises. This article examines a recent case study on national security concerns related to China-made IoT Internet Protocol (IP) cameras in Australia, which were removed without any publicly disclosed technical tests. Our two-stage interdisciplinary research paper took the following steps: first, we used the Common Vulnerability Scoring System (CVSS) framework to assess the vulnerabilities of three IoT IP camera providers—Hikvision, Dahua, and Avigilon—that have been installed on federal government buildings. We found vulnerabilities in all three systems; however, Avigilon devices did not have any high or critical vulnerabilities, unlike Hikvision and Dahua. We then compared our findings to Australia's existing IoT device regulation frameworks. The present Australian regulations overlap and do not adequately address the existing cyber vulnerabilities. Instead, the security frameworks, recommendations, and legislation focus on organizational cyber hygiene and environmental security. Technical cyber security frameworks are classified and currently provided only on demand to certain federal government departments, leaving industry actors, state governments, and consumers without guidance. The Australian experience shows that uniform and mandatory cyber security requirements could improve the benchmark of IoT security while also benefiting consumers. As the European Union implements the Cyber Resilience Act to regulate software and hardware products with digital components, the effectiveness of cyber security enhancements for IoT devices will be tested.