--- title: "Ottawa banned Hikvision 16 months ago; more than 28,700 cameras remain live on Canada's public internet" description: "Ottawa ordered every federal Hikvision device out with 120 days to spare, yet the National Research Council and a border bridge authority still run the cameras, five agencies refuse to say if they complied, and 28,700 devices remain on Canada's public internet. The same firmware is under live exploit in Ukraine, and the Shenzhen controller is raising convertible debt into the confusion." publisher: "The Inference" section: "Policy" published: 2026-10-09T19:04:27.990Z modified: 2026-10-09T19:04:27.990Z canonical: https://theinference.org/article/ottawa-banned-hikvision-16-months-ago-more-than-28-700-cameras-remain-live-on-canada-s-public-internet language: en keywords: "Hikvision, Canada, Cybersecurity, Surveillance, Policy" --- # Ottawa banned Hikvision 16 months ago; more than 28,700 cameras remain live on Canada's public internet > Ottawa ordered every federal Hikvision device out with 120 days to spare, yet the National Research Council and a border bridge authority still run the cameras, five agencies refuse to say if they complied, and 28,700 devices remain on Canada's public internet. The same firmware is under live exploit in Ukraine, and the Shenzhen controller is raising convertible debt into the confusion. *Ottawa banned [Hikvision](https://theinference.org/markets/companies/hikvision) 16 months ago, yet 28,700 devices are still live, state agencies still run the cameras, and Ukraine just logged a nine-day exploit surge against the same firmware. The enforcement gap, not the ban, is the story that moves money.* The record is now public, and it reads like a case study in enforcement lag. Hikvision incorporated in Canada in 2014 and started selling in 2015 without the mandatory national-security notification to Innovation, Science and Economic Development, so it built a market leadership position "illegally" for nearly a decade before [the department even opened a review in 2024](https://nationalpost.com/news/politics/hikvision) [1]. CSIS warned in a November 2022 alert that the cameras could serve as an intelligence-collection platform for China; a dozen federal departments still ran the gear in 2024 [1]. ## The ban that did not remove the cameras In June 2025, Industry Minister Mélanie Joly [ordered Hikvision out with 120 days to shut its Canadian operation](https://unpublished.ca/news-feed-item/2026-10-08/chinese-surveillance-cameras-are-still-around-despite-ban-in-government), and barred every federal department, agency and crown corporation from buying or using the equipment [2]. More than a year later, the National Research Council and the Windsor-Detroit Bridge Authority say the cameras are still running, WDBA's until November 2026, and five agencies including the Canadian Space Agency and ESDC refuse to say whether they complied at all [2]. Shodan counted over 28,700 Hikvision devices on public-facing internet connections in Canada after the order [1]. *Chart: **Three enforcement spans, the last one still open** Three bars, each labeled with its stated date range rather than a derived count: unnotified operation from the 2015 market entry until the 2024 ISED review, from the November 2022 CSIS warning to the 2024 review, and from the June 2025 ban order to October 2026 with cameras still live.* *Bars show the stated date ranges; month counts between them are calculated from those dates, not reported by any source. The third span is still open. Sources: 1, 2. [1][2]* ## The installed base is a live liability That liability is not theoretical. GreyNoise logged [a nine-day surge of exploitation attempts against Hikvision cameras in Ukraine](https://cybersecuritynews.com/hikvision-camera-vulnerability-2/) from September 21 to October 1, 2026, hitting CVE-2021-36260, a critical unauthenticated command-injection flaw with a CVSS score of 9.8 that CISA put on its known-exploited list back in January 2022 [4]. The traffic came from four IP addresses, three of them PureVPN exits in Lithuania, and carried only test commands, so this was probing, not confirmed compromise [3][4]. But in January 2024 Ukrainian authorities found two compromised cameras being used to watch Kyiv's air defenses, which shows what this flaw class is worth on a live battlefield [4]. Meanwhile [Cherkasy police plan to spend 89 million UAH installing cameras](https://dev.ua/en/news/khakery-masovo-atakuiut-kamery-hikvision-v-ukraini-cherez-krytychnu-vrazlyvist-1791538929) from a maker on Ukraine's own war-sponsor list [3]. ## Who wins, who pays The enforcement gap is the investment story. Bans that leave the installed base in place extend the documented security overhang while replacement demand flows to non-Chinese camera and security-software vendors. Montreal's Genetec made that call early: it cut Hikvision hardware from its platform in 2016 after repeated incidents, and its vice-president Andrew Elvish still calls the cameras dangerous time bombs, a standing waiver culture that keeps steering its customers, and their budgets, to compliant western gear [1]. On the losing side sit the buyers still running unremediated 2021-flaw firmware, and the minority holders of Hikvision's Shenzhen listing (002415.SZ). On October 9 the company reported that its controlling shareholder's acting-in-concert party [plans a private placement of exchangeable corporate bonds](https://news.futunn.com/en/post/1000778764/hikvision-002415-sz-controlling-shareholder-s-acting-in-concert-party), a single-line report of the controller preparing to raise debt convertible into the very shares those minorities own [5]. That supply lands while the company fights on in Federal Court: in September 2025 a judge refused to suspend the ban, and in a September hearing this year both sides told the court they are negotiating a settlement they hope to reach by December [1]. That December deadline is the dated event to watch. A settlement that lets Hikvision keep operating would undercut the ban's premise; an order upheld would tighten [the squeeze on a stock](https://theinference.org/article/hikvision-s-ai-margins-are-a-memory-bill-handed-to-china-s-surveillance-buyers) whose state controller is reportedly monetizing into it [5]. ## Takeaway The ban is settled, enforcement is not: federal agencies still run Hikvision gear, 28,700 devices stay live on Canada's public internet, and the December Federal Court settlement deadline decides whether the security overhang tightens or lifts. ## Sources 1. [National Post, How a Chinese surveillance camera giant operated 'illegally' in Canada for almost a decade before being banned, October 2026](https://nationalpost.com/news/politics/hikvision) 2. [National Post via Unpublished Newswire, Chinese surveillance cameras are still around, despite ban in government buildings, 8 October 2026](https://unpublished.ca/news-feed-item/2026-10-08/chinese-surveillance-cameras-are-still-around-despite-ban-in-government) 3. [dev.ua, Hackers massively attack Hikvision cameras in Ukraine due to critical vulnerability, October 2026](https://dev.ua/en/news/khakery-masovo-atakuiut-kamery-hikvision-v-ukraini-cherez-krytychnu-vrazlyvist-1791538929) 4. [Cyber Security News, Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts, 8 October 2026](https://cybersecuritynews.com/hikvision-camera-vulnerability-2/) 5. [Futu News, Hikvision (002415.SZ): Controlling shareholder's acting-in-concert party plans private placement of exchangeable corporate bonds, 9 October 2026](https://news.futunn.com/en/post/1000778764/hikvision-002415-sz-controlling-shareholder-s-acting-in-concert-party) --- Ottawa banned Hikvision 16 months ago; more than 28,700 cameras remain live on Canada's public internet — The Inference. Canonical: https://theinference.org/article/ottawa-banned-hikvision-16-months-ago-more-than-28-700-cameras-remain-live-on-canada-s-public-internet