China In Eurasia

SOFIA -- During his regular afternoon commute in early January, something new caught Konstantin Delchev's attention while he was riding in a streetcar in the Bulgarian capital.

Mounted to the ceiling was the spherical lens of a CCTV camera and on the base of the platform was the brand name for a Chinese manufacturer that Delchev had increasingly heard about on the news, where it is often mired in controversy -- Hikvision.

"The first questions that came to mind are whether we need things like this and whether it's worth the cost for taxpayers like me," Delchev told RFE/RL. "The next question was, who chose to use this company and why not others?"

A mathematician by training with a PhD in informatics, Delchev is no stranger to Hikvision and the world of cybersecurity. Aware of a growing list of vulnerabilities raised by experts and some Western governments over Hikvision equipment -- as well as the often unregulated nature of surveillance around the world -- he raised his concerns on Facebook along with a photo of a Hikvision camera that quickly helped ignite a wider conversation in the Bulgarian parliament over the use of the cameras and why they were installed.

"[The cameras] come from a country that others don't trust enough to allow into their critical infrastructure," Delchev said. "So how come cameras have appeared without a clear understanding of the risks or without transparency over which security measures have been taken, [given this is] a company that has a reputation of not valuing the security of its customers?"

Hikvision is the world's largest manufacturer of video-surveillance equipment and has been the tip of the spear for a bundle of Chinese technology companies that have come to dominate the global market in recent decades. The company, however, has also become the target of U.S. sanctions over its links to the Chinese military and role in developing special technology to surveil and track Uyghurs and other minorities in Xinjiang.

Hikvision cameras have also faced scrutiny over lax data protection and glitches found by researchers that showed how hackers could remotely gain access to the system and control of the cameras.

U.S. regulators have banned the use of Hikvision cameras, along with a handful of other Chinese equipment and companies, over national security concerns, while the United Kingdom and Australia have all recently banned Chinese-made security cameras from government buildings. There are no restrictions against Hikvision in the European Union, but the European Parliament has removed equipment manufactured by the company from its locations.

It's for these reasons that Bozhidar Bojanov, a lawmaker from the opposition Democratic Bulgaria parliamentary bloc, says that after seeing Delchev's post he decided to push the State Agency for National Security for a review on what measures were taken in order to avoid breaches of the new surveillance cameras in Sofia's public-transit network.

"I'm not saying that the Russians [or] the Chinese will follow us," he wrote in a January blog post on the issue. "I am saying that through Chinese and Russian technology, which are potentially compromised, strategic activity -- public transport in the capital -- can be negatively affected [and put at risk]."

A Rollout In Sofia

The use of CCTV cameras on public transit is commonplace across much of the world, but the controversy in Bulgaria centers on the documented vulnerabilities surrounding the use of Hikvision cameras and concerns over a lack of oversight in their procurement.

The video-surveillance system installed on Sofia's public-transit network dates to 2017, when a modernization project for the city's urban transport was issued. At the end of 2018, a contract was concluded with a consortium of companies to purchase the equipment and affiliated technology for $45 million, with the aim of installing a total of 4,300 cameras on buses, streetcars, and trolleybuses in the capital.

The video-surveillance system in Sofia's public-transport system began operating in late 2020 and a rollout of the cameras has continued. The website of Sofia's Urban Mobility Center, the city's transportation department, says that installing the cameras was done to provide "better security" for drivers and passengers and make it easier for the city to count the number of people traveling on public transit.

But questions remain over the vulnerabilities of Hikvision cameras as well as wider concerns by some Western governments about Chinese suppliers.

The Urban Mobility Center said in response to RFE/RL questions that it did not have "the right to set restrictions or requirements around the country of origin or specific brands for equipment manufacturers" for the contract. Similarly, the consortium formed to execute the public order for purchasing the cameras said that its choice of equipment was guided by "needs, reliability, and security" and not by country of origin or trademark.

Part of the appeal of Chinese companies in the surveillance industry like Hikvision to buyers around the world is that they offer a competitive price paired with a quality that has often allowed them to undercut their peers and win public contracts where the cost to taxpayers is often a leading factor in the selection process.

Major concerns about the vulnerability of Hikvision came in 2021, when an anonymous security researcher found a glitch in the Chinese company's products that "permits an attacker to gain full control of the device." In a post that spread widely among industry leaders, the researcher said the cameras had "the highest level of critical vulnerability."

Hikvision quickly acknowledged the vulnerability and instructed users to install new software on their devices which it said would patch the glitch.

According to IPVM, an industry research publication focused on video-surveillance products, the vulnerability impacted more than 100 million cameras globally.

In August 2022, the cybersecurity company CYFIRMA published a study in which it estimated that more than 80,000 Hikvision cameras were exposed after operators failed to install a firmware update released in 2021 or left default passwords in place when first setting up the devices.

The Urban Mobility Center, the consortium behind the Sofia contract, and Maxtel, the subtractor that installed the cameras, did not acknowledge any vulnerabilities and whether they had been patched.

The Urban Mobility Center did not respond to RFE/RL's inquiry about the glitch and Maxtel said that it had no information about it. The center did say it had referred the question to Hikvision, but that the company had not yet confirmed any details.

However, both entities told RFE/RL that such concerns were paramount to them and that the video-surveillance system was secure, as it remains on a closed computer network and that all software updates are regularly monitored and applied.

"All measures have been taken to protect the system and make it impossible for the information from it to be used for anything other than its intended purposes," the Urban Mobility Center said in a statement. "It's constantly being reviewed, especially in terms of cybersecurity."

Remaining Questions

Bojanov, the opposition lawmaker, says he will continue to press for answers about the remaining vulnerabilities in the Sofia network and for added information for security standards.

Before entering politics, Bojanov worked in IT and says he has a strong practical background to understand the risks involved, especially from both what he described as private and state-backed hackers. Just one vulnerability, he adds, could be a breach that leads to access of the entire network of cameras.

Monitoring for compliance on the network falls within the domain of the State Agency for National Security. RFE/RL asked it what was being done to monitor and fix vulnerabilities, but the agency said that information regarding how its duties are carried out is classified.

According to Yasen Tanev, a cybersecurity expert and chairman of the Bulgarian Association for Business Software Development, the biggest risk for networks arises from noncompliance with industry standards and that modern cameras, which are connected through a vast digital network, are a leading target "for attacks by hackers."

Tanev told RFE/RL that questions around trust in the manufacturing company are key for such camera networks and that the restrictions imposed on Hikvision abroad due to national security concerns should be a "red flag" for the State Agency for National Security.

"Are the users aware of the risks, are they managing them, and how do they ensure that the vulnerabilities cannot be used by someone to gain access to these devices or the entire network?" he said.

Written by Reid Standish in Prague based on reporting by Elitsa Simeonova of RFE/RL's Bulgarian Service in Sofia

PRAGUE -- In accepting a 15-minute phone call with his Taiwanese counterpart, Czech President-elect Petr Pavel broke decades of diplomatic protocol and set the stage for a new era of relations between Europe and China -- with his country potentially at the forefront.

The January 30 call with Taiwanese President Tsai Ing-Wen came shortly after Pavel was elected as the Czech Republic's next president and drew backlash from Beijing, which condemned the call and accused Prague of trampling its "red line."

The conversation marked a departure from previous norms for dealing with high-ranking politicians from the self-governing island. Official exchanges are often limited to civil servants and the lower levels of ministries. But Pavel became the first elected European head of state to speak directly with a Taiwanese leader.

The move from the incoming Czech president comes as the European Union rethinks its relationship with Beijing -- a process that has been accelerated by China's handling of the COVID-19 pandemic, its increasingly aggressive diplomatic rhetoric, and Beijing's continued support for Russia despite its unprovoked invasion of Ukraine.

"We shouldn't let China do to Taiwan what Russia is doing to Ukraine," Petr Kolar, a former Czech diplomat who advises Pavel on foreign policy issues, told RFE/RL in an interview. "I believe what's happening in Ukraine is because of [Europe's] lack of a clear message to Russia over the years. This was a wake-up call, and it shows how important it is to show from the very beginning that fellow democracies like Taiwan won't be abandoned."

Prague's Path Ahead

Pavel's shift on China and Taiwan marks a clear break with his predecessor, incumbent Czech President Milos Zeman, who will remain in office until March.

During Zeman's 10-year tenure -- divided over two five-year terms -- he courted stronger ties with China and toed a pro-Beijing line on many human rights issues in hopes of attracting greater Chinese investment. In a move that drew international attention and criticism at home, Zeman appointed Ye Jianming, a former chairman of China Energy Company, as his honorary economic adviser. The billionaire was detained in 2018 by Chinese authorities and his whereabouts are still unknown.

Kolar -- a political consultant who previously served as Prague's ambassador to Russia -- says Pavel is looking to align his foreign policy views with the Czech Republic's postcommunist tradition of backing democracy and human rights globally.

He says the support for Taiwan should be seen as part of a broader paradigm shift in Europe shaped by Russia's invasion of Ukraine.

On the campaign trail, Pavel backed strong European support for Ukraine and said his first foreign trip as president will be to Kyiv alongside Slovak President Zuzana Caputova. The invasion of Ukraine is "a reminder that European democracies need to be focused on China's aggression towards Taiwan," he said. "We need to show support now so that [Beijing] won't be tempted to use force later like Russia has."

Under the Czech Constitution, the presidency holds mostly ceremonial powers, but presidents can wield significant informal influence over key decisions, especially in foreign policy. The office remains separate from the government led by the prime minister, which holds formal power to govern and craft policy.

But unlike Zeman, Pavel's views on Taiwan, Russia, and other foreign policy issues align with Czech Prime Minister Petr Fiala's coalition government, potentially ushering in a rare era of unity.

Taiwan, which is critical to global supply chains, has become a larger investor than China in the Czech Republic and Taiwanese companies continue to expand their links to Europe.

Taiwan produces over 90 percent of the world's semiconductors, which are crucial for manufacturing a variety of everyday and high-tech products that are vital to economies around the world.

"Taiwan understands that there is an opportunity now as Europe is in the process of rethinking its relationship with China," Zsuzsa Anna Ferenczy, a fellow at National Dong Hwa University in Taiwan and a former adviser to the European Parliament, told RFE/RL. "Individual member states in the EU are more willing to speak out and offer new forms of support for Taiwan. Taipei is hoping to harness that."

A New Reality In Central And Eastern Europe

In response to Pavel's phone call with Tsai, Beijing accused the Czech Republic of violating the "One China Principle," under which Beijing considers itself as the only legitimate government of China and views Taiwan as a breakaway province.

Only 13 countries and the Vatican have official diplomatic relations with Taiwan and recognize the island of 24 million people as an independent state. Many Western governments do not openly contest China's claim to Taiwan, but they do not support it either.

"It is in the interest of [the Czech Republic] to strengthen relations with Taiwan and other democratic partners in the Indo-Pacific region," Czech Foreign Minister Jan Lipavsky told Politico in a recent interview. "We have our own 'one China' policy. Nothing has changed."

Offering formal recognition to Taiwan is not in the cards for Prague or other EU countries. But analysts and officials acknowledge that countries in the bloc could take a bolder line toward Beijing and Taipei.

This shift has been brewing in the Czech Republic and across Central and Eastern Europe -- with the exception of Hungary -- for several years. Czech Senate Chairman Milos Vystrcil led a delegation to Taiwan in 2020 and the Czech and Slovak parliaments welcomed Taiwanese Foreign Minister Joseph Wu for unprecedented visits in 2021.

Beijing's so-called "17+1" initiative -- China and 17 Central and Eastern Europe states -- has unraveled in recent years. Lithuania withdrew in 2021, and Estonia and Latvia followed suit after Russia's invasion of Ukraine and China's support for Moscow. Other members, such as the Czech Republic and Slovakia, have not formally left, but havedialed down their engagement with the format.

"Our relationship with China is under revision," Lipavsky told The New York Times in a February interview. "A new geopolitical reality has arisen."