Driven by security concerns, the city civic body has thrown down the gauntlet to CCTV suppliers. It now mandates that all CCTV cameras for public surveillance must be manufactured in the country and with India-based identification systems. The e-governance department of the Ahmedabad Municipal Corporation (AMC) issued a rate tender for installing CCTV systems at various civic buildings on Jan 9.
The decision comes amid growing awareness of how foreign-made surveillance cameras can pose significant security risks through their traceable media access control (MAC) addresses — a unique hardware identification number permanently assigned by the manufacturer, which could potentially expose camera locations , its feed and IP addresses to external entities.
“MAC address combined with the device’s IP address (its network location identifier), creates a digital footprint that is necessary for network communication but can also become a security concern,” said a senior AMC official on condition of anonymity. Additionally, bidders must submit an original equipment manufacturer (OEM) certificate with the Indian MAC address.
The official also stated, “Some domestic companies, bidding for CCTV supply and installation, were providing CCTV systems with foreign MAC addresses, posing a risk of data leak and potential data compromise. Therefore, we have mandated Indian MAC addresses for CCTV tenders, with certification required for verification.”
Regarding the vulnerability of such systems, he explained, “Through a technique called network enumeration, attackers can scan for devices using specific manufacturer MAC addresses, which are publicly registered to CCTV manufacturing companies. Once identified, these cameras’ network locations can be mapped using their IP addresses. We therefore plan to use MAC address masks to prevent any exploitation.”
In Dec 2020, the newly renovated CG Road was inaugurated, featuring 19 smart poles equipped with Wi-Fi routers, LED fixtures, PTZ cameras, USB charging sockets, electric car charging, weather stations and billboard displays. However, the use of foreign-manufactured smart poles had sparked controversy due to data security concerns, as CCTV data was first sent to foreign servers before reaching Ahmedabad’s control room.
