Encl. 2 - NDAA Compliant VSS Whitelist 8-12-2020.pdf

NDAA Compliant Video Surveillance Whitelist Published on Aug 10, 2020

Generated for Michael Ryan on Aug 12, 2020 for Your Use Only - No Sharing - No Promotions

This report aggregates video surveillance products that manufacturers have told IPVM are compliant with NDAA Section 889 that bars products produced or using essential components from Dahua, Hikvision, and Huawei.

Determining Blacklist / Whitelist

The key difficulty for buyers is determining which products are deceptively-labeled by Western companies (like Hikvision as Honeywell) but actually are made by or use essential components from the banned China companies.

https://ipvm.com/reports/gsa-webinar

Any product OEM / relabelled from Dahua or Hikvision is banned. See: Dahua OEM Directory and Hikvision OEM Directory listing the companies doing so even while most do not readily admit that.

Also, any product containing Huawei Hisilicon SoC is banned as an essential component of devices using it. Related: How To See If Your Camera Uses Huawei Hisilicon Chips, the video below shows how to check yourself:

View this Video on IPVM.com

Of course, this is time-consuming and requires having a device physically on hand, the goal of this whitelist is to simplify the discovery process for which devices are not banned.

Current Products Vs Past Products Warning

Because of the NDAA ban, many manufacturers have recently discontinued products that are covered by the ban, or just discontinued them in the US but still sell them globally. As such, you should be careful to verify that you do not have existing products that are covered, or are buying products internationally that are banned.

100% NDAA-Compliant

The following companies have told IPVM that they are 100% compliant with the

NDAA:

https://ipvm.com/reports/dahua-oem https://ipvm.com/reports/hik-oems-dir https://ipvm.com/reports/hisilicon-check https://ipvm.com/reports/ndaa-compliant-list

Avigilon Axis Communications BCD International Clinton

FLIR

iryx Pelco Rhombus Systems Seek Thermal

100% NDAA-Compliant for US-Listed Products

These companies said that US-listed products are compliant but that some products not intended for US sale are not compliant:

Bosch Panasonic

Mostly Compliant

Digital Watchdog Hanwha Lilin March Networks MOBOTIX (claims full compliance by August 13th) JCI / Tyco Security (claims full compliance by August 13th) Verkada Vivotek

Minority Compliant

Costar Honeywell IC Realtime Speco Sunell Uniview

100% NDAA-Compliant Responses

Avigilon

Avigilon told IPVM they are fully-compliant, saying:

I can confirm that 100% of Avigilon's portfolio is NDAA compliant with no manufacturing or components from Huawei/HiSIlicon, HikVision, Dahua.

Axis Communications

Axis referred IPVM to a statement confirming their "entire product portfolio" is NDAA-compliant. Axis added that past non-compliant products could still be available from resellers, saying:

Previously we used HiSilicon chipsets in a very small number of products (Companion hardware products). It’s possible that some of these products still can be purchased by some of our resellers, but today Axis only offers NDAA-compliant products.

BCD International

BCD told IPVM that they are fully compliant, saying:

BCD International appliance, switches and storage arrays are not manufactured by or contain any parts obtained from or manufactured by the following companies, their affiliates or subsidiaries: Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, Dahua Technology Company.

Clinton

Clinton told IPVM that all their products are compliant, saying:

We do not offer any products that are manufactured by or contain components from Huawei/Hisilicon, Hikvision, or Dahua. Nor have we ever used them in the past.

FLIR

https://www.axis.com/en-us/national-defense-authorization-act-compliance

FLIR said all their products are compliant:

I can confirm that all of our products are compliant as we don’t source materials or components from those companies nor do they manufacture products for us.

iryx iryx told IPVM all their products are compliant:

All iryx products are NDAA compliant. We do not use any Huawei/HiSilicon chips. All software IP stems from our development team in the USA. None of our products are manufactured by any of the banned companies. All products are made in the USA.

Pelco

Pelco told IPVM:

Pelco product lines do not use or incorporate any essential components or critical technology including SoCs produced by NDAA banned component vendors, nor does Pelco OEM any product lines produced by NDAA banned manufacturers.

Subsequently, Pelco was acquired by Motorola and Motorola has declared its intention to also make Pelco products in the USA.

However, previously, Pelco did have some products that used Huawei Hisilicon, e.g., the 2019 GFC series cameras.

Rhombus

Rhombus Systems told IPVM:

Rhombus is, and has always been, NDAA compliant. Rhombus uses Ambarella chipsets, Sony imagers, and US-based memory. All cameras are assembled in Taiwan. For the sensors, they are assembled in the USA.

Rhombus also referred us to a statement discussing their position on the NDAA https://ipvm.com/reports/motorola-pelco https://ipvm.com/reports/pelco-4k https://www.rhombussystems.com/blog/security/why-it-is-important-for-rhombus-security-cameras-to-be-ndaa-compliant/ rules.

Seek Thermal

Seek Thermal said all their products are compliant:

Yes, Seek Scan is NDAA compliant. No, Seek Scan does not include any Huawei components.

Panasonic

Panasonic told IPVM:

All Panasonic-branded cameras sold in the U.S. are engineered, manufactured and quality assured solely by Panasonic. As such, they are not impacted by the NDAA legislation (federal ban).

Note that Panasonic products purchased outside the US may not be NDAA-compliant.

Bosch

Bosch is in the process of dropping Dahua and, in the US, is discontinuing all models made by Dahua. Outside the US, those products will continue to be sold, for now.

Mostly Compliant

These manufacturers told IPVM that some but not all of their products are NDAA-compliant. We have segmented this group into "Mostly Compliant" and "Some Compliant" based on IPVM's evaluation.

Digital Watchdog (DW)

Digital Watchdog (DW) has a statement listing compliant products. It is a long list but they did not clarify which products were not so this requires carefully reviewing the list to see if the specific model is or is not included.

Hanwha

Hanwha provided a list of compliant products.

https://ipvm.com/reports/bosch-dahua https://support.digital-watchdog.com/kb/article/281-digital-watchdog-national-defense-authorization-act-compliance-statement/ https://hanwhatechwin.egnyte.com/dl/HVMiZQX1gK/

Hanwha is dropping Huawei Hisilicon from its cameras, with most of its cameras already not using Hisilicon, instead using its own Wisenet chips and Ambarella.

Lilin

Lilin provided a list, saying that the following product categories are compliant:

They are all made in Taiwan in Lilin manufacture plant, NDAA, TAA compliant. No Huawei/Hisilicon, Hikvision or Dahua.

P2/ Z2 H.265 IP cameras P3/Z3 H.265 IP cameras P5/Z5 H.265 IP cameras Temperature Screening IP camera Mask Detection AI server NAVIGATOR VMS servers AIDA AI Servers Legacy (3MP) NVRs

Lilin did not provide a list of what products were not NDAA compliant.

March Networks

March Networks directed IPVM to a statement on their site, and said their recently-launched the X-Series recorders are compliant. They report that the 8000 and 9000 series recorders are not compliant:

The SoC used in the 8000 and 9000 Series recorders are HiSilicon.

March Networks is a wholly-owned subsidiary of Infinova, of which a PRC government entity owns a controlling stake. Related: PRC Government Entity Now Controlling Shareholder of Infinova / March Networks. Infinova is not banned.

JCI/Tyco Security

Johnson Controls told us that all their product categories are NDAA-compliant, with the exception of the Exacq Tyco Encoder, which is still being phased out.

Compliant JCI product categories include American Dynamics, Illustrate, Kantech, and Software House.

https://ipvm.com/reports/hanwha-huawei https://d1tzzns6d79su2.cloudfront.net/uploads/b443/b013/NDAA-Compliant.xlsx https://www.marchnetworks.com/products-services/ndaa/ https://ipvm.com/reports/infinova-prc

However, JCI/Tyco Security for years OEMed from Dahua so be careful of historic products that are banned.

Verkada

Verkada referred us to a statement including a list of compliant products, shown below.

https://d1tzzns6d79su2.cloudfront.net/uploads/341e/27a5/verkada_NDAA_certificate_2020.pdf

Verkada's first product lines used Huawei Hisilicon.

Vivotek

Vivotek referred us to a statement, available at this link. passed along this statement listing their compliant products.

https://www.vivotek.com/ndaa

Minority Compliant

Costar Technologies

Costar did not say if they are fully compliant, but provided a list of compliant products, available for download here.

Honeywell

Honeywell referred us to a page discussing NDAA compliance, where a list of compliant products is available for download.

https://d1tzzns6d79su2.cloudfront.net/uploads/97a5/1283/Costar Technologies for IPVM.xlsx https://www.security.honeywell.com/ndaa

Honeywell makes it hard for buyers because they do not make clear which Honeywell video surveillance products are not compliant. For example, the 'Performance' and 'equIP' series are made by Dahua and therefore are banned but not disclosed by Honeywell on their product pages.

Also, Honeywell thermal cameras for body temp detection are OEM Hikvision products.

Speco

Speco provided a list of compliant products, available for download here, and said:

Speco is actively moving to exclude components from these banned companies.

Sunell

Sunell is releasing a new series of products that are NDAA complaint but existing products are generally not NDAA compliant given Huawei Hisilicon usage.

Uniview

Uniview overwhelmingly uses Huawei Hisilicon chips, though recently they have started to offer a small number of products that are NDAA conformant.

Not Compliant

Dahua Hikvision Huawei IC Realtime https://www.security.honeywell.com/All-Categories/video-systems/performance-series-ip-cameras https://www.security.honeywell.com/All-Categories/video-systems/equip-cameras https://www.security.honeywell.com/All-Categories/video-systems/thermal-cameras-for-body-temp-detection https://d1tzzns6d79su2.cloudfront.net/uploads/5cf7/c12f/N889B.XLSX https://ipvm.com/reports/sunell-ndaa-compliance

Comments (45)

Undisclosed Integrator #1

I have a statement from EnGenius, a wireless technology firm, stating that they are fully NDAA compliant. I would post it, but I feel it is not my place to speak for them. I know that many others on this site use their products, so I thought I would mention it. Feel free to reach out to them on your own to confirm.

Undisclosed #3 In reply to Undisclosed Integrator #1

Nice, that's right hook to Ubiquiti's face!

Eric Taylor Pelco Inc. |

Pelco is also 100% NDAA compliant!

Dahua, Hikvision, and Huawei are, by definition, not NDAA compliant.

IC Realtime says its products are not NDAA compliant, due to Huawei Hisilicon usage, currently but the expect to be later this year, see: IC Realtime Moving Away From China Manufacturing

Other Companies

Most brands not listed here (and there are dozens of various brands OEMing or relabelling) use a significant amount of Huawei Hisilicon are should be assumed to be banned unless they represent that they are not using Huawei Hisilicon and are not OEMing from Dahua or Hikvision.

Updates

If you have feedback or products to add to this list, comment below or reach out to us at info@ipvm.com https://ipvm.com/reports/ic-real-change mailto:info@ipvm.com

John Honovich IPVM |

In reply to Eric Taylor

Eric, thanks, Pelco did respond, we had initially forgot to add but now it's included.

Patrick Kelly

Digital Watchdog (DW) -

The link in the DW section is for a Lilin excel file.

The DW statement can be found HERE

Conor Healy IPVMU Certified

In reply to Patrick Kelly

The link has been updated. Thank you for letting us know.

Undisclosed Manufacturer #2

Are CVI and TVI technically Hikua technology? Would analog HD cameras the use them, as opposed to AHD or HDSDI, be covered under NDAA?

Undisclosed #4

Thank you for releasing this.

Undisclosed #4

Is Geovision compliant?

Undisclosed #4 https://support.digital-watchdog.com/kb/article/281-digital-watchdog-national-defense-authorization-act-compliance-statement/

Panasonic

Panasonic told IPVM:

All Panasonic-branded cameras sold in the U.S. are engineered, manufactured and quality assured solely by Panasonic. As such, they are not impacted by the NDAA legislation (federal ban).

Note that Panasonic products purchased outside the US may not be NDAA-compliant.

What about Advidia?

Undisclosed #3

How come the NDAA fiscal year 2019 did not implement a manufacturer stipulation of YES or NO compliance listing to all datasheet, white sheets, warranties. We already have Serial Numbers, Manufacture date, UL, IK ratings...what gives?

John Honovich IPVM |

In reply to Undisclosed #3 manufacturer stipulation of YES or NO compliance listing to all datasheet, white sheets, warranties

That's a good idea. It's not mentioned in the NDAA but it would help greatly and something we have been discussing on how to advocate for.

Conor Healy IPVMU Certified

BCD International confirmed to IPVM that they are 100% NDAA compliant. The list has been updated with this information.

doug newton

Hi what about Avertek cameras and Nvr we installing a new Bosch compliant system but notice my clients other sites have different cameras

John Honovich IPVM |

Updated, from Rhombus:

Rhombus is, and has always been, NDAA compliant. Rhombus uses Ambarella chipsets, Sony imagers, and US-based memory. All cameras are assembled in Taiwan. For the sensors, they are assembled in the USA.

Jicko Chetrit

Vumii and Opgal thermal products are fully NDAA compliant.

Martin Renkis Smartvue at Johnson Controls |

Tyco Cloud Gateways and Illustra Cloud Cameras as well as ioSmart Readers are all NDAA compliant. Thanks John.

Thomas Lienhard

Wasn't the cheap FLIR NVR made by Hikvision or Dahua?

John Honovich IPVM |

In reply to Thomas Lienhard

FLIR divested that to Dahua last year - Dahua Acquires Lorex And FLIR SMB Surveillance From FLIR https://ipvm.com/reports/dahua-lorex

Thomas Lienhard

Are they rebranding completely or will it retain the FLIR name?

John Honovich IPVM |

In reply to Thomas Lienhard

No more FLIR brand on those devices. The Lorex brand remains but it’s now Lorex by Dahua.

Undisclosed Integrator #5

What about:

ACTi, their website has an NDAA compliance statement.

3Svision, their website has a TAA and NDAA compliance statement. Not all of their products are compliant.

GEOVISION, provided an NDAA compliance letter.

Request IPVM contact all to verify.

Joe McCarthy In reply to Undisclosed Integrator #5

I am with ACTi. I believe 75% of our product line is currently compliant (ballpark). My understanding is we are shooting for 100% compliance by years end.

Undisclosed Manufacturer #6

Having only non Chinese sensor chips does not make you NDAA compliant.

Initially this was correct.

You need to read all the changes to date. Latest was a few months ago.

You can't have sister chips in the cameras either ,made in China". This rules out many companies claiming to be NDAA compliant selling to US government.

Changes state that even if you are a Chinese company and build in other countries, examples, US , India, Mexico, you are not compliant.

I suggest you take the time and check this out because I did.

John Honovich IPVM |

In reply to Undisclosed Manufacturer #6

You need to read all the changes to date.

What specific changes? Link(s)? We do follow this closely and you are the first person to claim such a far broader coverage of the NDAA.

Undisclosed Integrator #5 In reply to Undisclosed Manufacturer #6

Is there specific information available to dispute NDAA compliance claims provided by ACTi, 3Svision and GEOVISON?

Undisclosed Manufacturer #9 In reply to Undisclosed Integrator #5

On the ACTi web site there is an NDAA Compliant box that can be checked when using the product selector.

Undisclosed Integrator #7

This is very useful information.

Here is my big question of the day: Do Ubiquiti radios and switches contain any banned parts?

Undisclosed Integrator #5 In reply to Undisclosed Integrator #7 several months ago I contacted Ubiquity and they were not able to provide an NDAA compliance statement.

Undisclosed #8

Viakoo must possess some kind of master list indicating which manufacturers components are NDAA compliant and which are not...

or how could they offer to do this? NDAA 889B - Viakoo, Inc

Marco Sanchez In reply to Undisclosed #8

Interesting. I would like to see if this is real or not? I do not see how they would know every model by every manufacturer.

David Nelson-Gal In reply to Marco Sanchez

See my answer below: Essentially we can create a table of your entire inventory, manufacturer, oe manufacturer, model and firmware. This can be correlated with vendor information. In the main, you can get a quick check on compliance. In the margins, you may have investigative work.

For our integrator partners, this becomes a Professional Services engagement to help people demonstrate compliance.

This article actually pulls together a lot of useful, model specific information which is leverageable in the exercise.

David Nelson-Gal In reply to Undisclosed #8

Since early 2019, we maintain a Manufacturer and OE Manufacturer attribute https://www.viakoo.com/ndaa-889b/

Since early 2019, we maintain a Manufacturer and OE Manufacturer attribute for every camera.

These fields are derived automatically from what we can discover from your configuration. VMS's often have their notion of manufacturer and model. If you give us the device credentials, we can get more refined information about the device. The OE Manufacturer is derived from the MAC Address of the device only.

If the vendor has replaced the NIC card in the device with their own, we can't tell automatically. At that point, you have to go by the vendor's information.

These two camera fields as well as model, firmware version, IP Address, MAC Address, location, recorder, et cetera can be exported into a spreadsheet if necessary and people can do their own deeper analysis and/or use it as evidence of compliance.

John Honovich IPVM |

In reply to David Nelson-Gal

The OE Manufacturer is derived from the MAC Address of the device only.

But how are you determining which devices use Huawei Hisilicon? Your company Viakoo is selling an audit ("For a fixed price we will provide an Inventory management audit.") but I don't see how anyone could confidentially and fully offer such a service when there are so many brands and not an obvious fingerprinting for Huawei Hisilicon generally.

David Nelson-Gal In reply to John Honovich

The system automatically captures Manufacturer and Model information. From that you can audit compliance. That is why it is a service not a simple report to be printed out.

John Honovich IPVM |

In reply to David Nelson-Gal

That makes sense. That also means you need to have a list of models that are known to use Huawei Hisilicon. Not a criticism, just trying to clarify that it's not some magic algorithm that detects if there is Huawei inside a device.

David Nelson-Gal In reply to John Honovich

No magic, but vendors are declaring and your article actually is pulling a lot of data together. The point is that a large percentage in our customer's inventory resolves quickly. Then there is research to do on the rest but the database is getting more fleshed out every day.

Joe McCarthy

I am with ACTi. I believe 75% of our product line is currently compliant (ballpark).

My understanding is we are shooting for 100% compliance by years end.

David Nelson-Gal In reply to Joe McCarthy

Joe, Can you get your organization to post the compliant and/or non-compliant models? Currently, they just have a general statement posted.

Undisclosed Manufacturer #9 In reply to David Nelson-Gal

That is something I can work on. In the meantime there is a NDAA Compliant box that can be selected in our Product Selector tool.

David Nelson-Gal In reply to Undisclosed Manufacturer #9

Yes, that's fine for new purchases but for people trying to audit their current inventory, it makes it cumbersome to have to select each individual model one at a time. It makes it easy if you can provide the list that people can quickly match to their inventory.

Undisclosed Manufacturer #10

John - What about the March Networks OEM cameras - there wasn't a statement on those but am guessing they are not NDAA compliant either?

Conor Healy IPVMU Certified iryx has been added to this list. They told us they are 100% NDAA-compliant.

Conor Healy IPVMU Certified

Hanwha has provided an updated list of compliant products, now available at a public link. The link in the report has also been updated.

Conor Healy IPVMU Certified

Per an update from March Networks, they have been moved to the Majority Compliant section. They also provided us with a statement.

Generated for Michael Ryan on Aug 12, 2020 for Your Use Only - No Sharing - No Promotions https://hanwhatechwin.egnyte.com/dl/HVMiZQX1gK/ https://www.marchnetworks.com/products-services/ndaa/