The Indian Police exposed a spy ring, allegedly operating under Pakistan’s ISI and Babbar Khalsa International, sending live feed to Pakistan using Chinese Solar CCTV cameras. The police in Delhi and Ghaziabad arrested 32 people while the larger problem of the cameras continuing to be sold persists.
The spy ring initially came to the attention of the Ghaziabad Police on 14 March when a beat officer at Kaushambi Police Station received intel about a group of men from Bhovapur involved in suspicious activity.
“These individuals were reportedly recording videos of railway stations and locations associated with security forces, transmitting them to specific individuals, and luring other youngsters into participating in these activities by offering financial incentives,” said an officer.
There has been concerns over security gaps in Chinese-based solar cameras as the SIM-based feed is accessible globally through apps and leave no installation footprint. There are vulnerabilities that arise from unauthorised remote access and transmission of data to Chinese servers. Delhi and other state goverments are taking measures to remove the cameras from the market.
As per police sources in Delhi, “ISI-connected handlers involved in running modules from across the border have instructed the use of these specific Chinese cameras because these are readily available in markets, cheap, need no electricity connection, are equipped with SIM cards and solar panels, and no identification is possible. It allowed them to have real-time surveillance, using mobile applications that can be downloaded via Google Play Store.”
Another officer mentioned that the handlers had access to Google Maps, allowing them to instruct their module members on where to set up the camera.
Following the incident, Cyber Security Association of India President Prof NK Goyal insisted on putting a system in place where cameras installed in public places are enrolled with some agency with the name of the owner, details, and purposes. He also called for measures from the government to find unidentified CCTVs countrywide for removal, an immediate CCTV audit at sensitive locations, and to ensure the deployed CCTVs are certified and tested by STQC or Bureau of Indian Standards or the Ministry of Electronics and Information Technology.
The Police said the data servers for the solar cameras were based in China, with the feed being accessible there as well. Pakistan-based handlers accessed footage of sensitive locations using a mobile application and shared the information on WhatsApp.
