Your CCTV's need a "Hardware Root of trust"

In 2024, South Korea's military pulled more than 1,300 surveillance cameras off its own bases. The cameras had been bought through a South Korean supplier and were installed at training grounds and perimeter fences. During a routine inspection, intelligence agencies found they were Chinese-made and designed to be able to send recorded footage to a specific server in China. Officials were quick to say no data had leaked. But that misses the point. A military had been running cameras on its own bases that could send footage to a foreign server, and nobody knew. The failure wasn't a leak. It was that the capability was there, unseen, the whole time.

India has its own version of that story, at a far larger scale. In 2021, the government acknowledged in Parliament that roughly one million CCTV cameras installed in government institutions came from Chinese manufacturers and carried similar data-transmission risks.

Let's pause for a moment and consider what that means. These weren't cameras planted by an adversary. They were bought in good faith, by the state, to protect its own premises. Yet in both countries, the cameras answered to whoever made the chip inside them, not to the people who owned them. And the owners had no way to check.

This Is Not One Incident. It’s a Pattern.

Once you start looking, the cases line up, and not only in cameras the state bought. In April 2026, Delhi Police Special Cell arrests exposed an ISI-linked network that had set up off-the-shelf, solar-powered Chinese 4G cameras near defence installations in the states of Punjab, Haryana, Rajasthan and Jammu and Kashmir. For nearly three months, footage of troop movements and convoys flowed to data servers in China and was relayed to handlers in Pakistan. The cameras needed no hacking. Sending footage to a server abroad was simply how they were built to work.

In the US, a Department of Homeland Security bulletin reported by ABC News warned that Chinese-made cameras on critical infrastructure networks typically lack encryption and talk to their manufacturer by default. In March 2024, cameras at a US oil and gas firm were found communicating with China-based servers, one of them possibly associated with a state-sponsored cyber actor.

And at the level of the chip firmware itself, researchers in 2020 disclosed a deliberately built backdoor in the firmware shipped on recorders and cameras built around HiSilicon chips. A secret sequence of commands unlocked full control of the device with passwords built into the software. Nearly a hundred brands were affected, most of whom had no idea it was there, and there was no patch.

The same logic now extends beyond cameras. In May 2025, Reuters reported that US experts stripping down Chinese solar inverters had found communication devices, including cellular radios, that weren't listed anywhere in the product documentation.

Why Banning a Brand Doesn’t Solve It

India has responded firmly. Since 1 April 2026, no network camera can be sold in India unless a government lab has tested it against the IT ministry's security requirements, and manufacturers must declare the country of origin of the camera's main chip. Chinese brands have largely left the market, and Indian brands now hold more than 80% of it.

But notice what every case above has in common. The problem was never the logo on the box. In South Korea, the supplier was a domestic company. With HiSilicon, the backdoor sat in firmware that nearly a hundred brands shipped without knowing. What decides where your footage goes is the silicon and the code running on it, and today almost none of that silicon in Indian cameras is designed domestically, or can be inspected.

Declaring a chip's origin is not the same as verifying what it does. Even a chip from a friendly country is a black box: you can integrate it, but you can't see inside it. And the obvious fix, a commercial secure element, is usually foreign-designed too, often with its keys injected at an overseas facility. You end up asserting trust in a vendor, not proving it.

Can a Firmware Update Fix This?

No. Firmware runs on the chip, and whoever controls the chip sits underneath everything you write. A tampered or opaque part can lie to every layer above it, including the code meant to detect tampering. Hardware security cannot be added by a firmware update. A camera without it needs a new board and a fresh round of government certification.

And the stakes are about to rise. On 13 May 2027, India's new data protection law makes every operator of your CCTV cameras answerable for securing footage of identifiable people, with penalties of up to about $30 million. The camera models designed this year are the ones customers will be running when that rule takes effect.

If It Can Send Footage Out, It Can Change It Too

A camera that takes orders from someone else doesn't just leak. Whoever controls it can also stop a recording, delete an hour or reset the clock, and the owner has no way to tell. The footage still looks normal. It just isn't the whole truth anymore.

That matters because CCTV footage increasingly decides what happened. India's Supreme Court is currently asking why police station cameras keep going dark when people die in custody. Today, nothing in the camera can show whether a missing hour was a fault, a deletion or a switch someone flipped.

A camera you can't trust with your data is also a camera you can't trust as a witness.

Open, Inspectable Secure Silicon as the Solution

HoloDi S1 is a secure System-on-Chip (SoC) built on an open RISC-V architecture with secure-element class features built to close both gaps. It's an open security chip that sits inside the camera, guards its secret keys, signs its video, and controls how it starts up.

It starts by controlling what the camera runs. HoloDi holds the camera's main processor off at power-up, checks the firmware is exactly the version the factory approved, and only then lets it start. Hidden code can't be quietly swapped in, and old vulnerable firmware can't be rolled back. Any camera can be asked what firmware it's actually running, and it answers with a signed measurement, so an audit becomes a query instead of a site visit.

It decides who the camera takes orders from. Today, anyone who gets in, with a guessed password, a stolen app login or a hidden backdoor account, can tell a camera to stop recording, delete footage or install new software. With HoloDi, those orders only go through if they're approved with a digital key that belongs to the camera's owner. Getting in is no longer the same as taking over.

It gives every camera its own identity. On the production line, HoloDi creates the camera's signing key inside the chip itself, using its own on-chip random number generator. That key never leaves the silicon: not to the factory, not to a supplier, not even to the camera's own software. There is no master key shared across cameras to steal, and nothing in ordinary memory to copy out. If someone opens the chip to probe it, it wipes the key.

And it proves where every frame came from. Today, a video feed carries nothing that proves which camera captured it. With HoloDi, every second or two of video is fingerprinted, chained to the one before, and signed with that camera's unique key. The signature travels with the video using the industry's open standard, so anyone, the owner, the police or a court, can check two things: that the feed really came from that specific camera, and that nothing has been cut, added or changed since. A fake feed, or a clip from a different camera, fails the check.

Sovereign Silicon Means Proving What’s Inside

None of that would matter if HoloDi were just another black box. So it isn't one. The chip's design is public, so anyone can audit exactly how it works instead of trusting a datasheet. The firmware and bootloader are reproducible, rebuilt bit-for-bit from public sources, so there are no hidden blobs in the root of trust. And a finished chip can be scanned with infra-red imaging and checked against the published design, so even a die fabricated abroad can be proven to match.

That flips the trust model. You no longer have to trust a foreign vendor or a foreign fab. You trust a design you can read and a verification you can run yourself. It also fits the camera you already built. HoloDi sits on the main board beside the camera's existing processor. The sensor, image quality and video encoding are untouched.