The AMC’s move comes after reports that some domestic suppliers were offering CCTV systems with foreign MAC addresses, raising concerns over data leaks and potential security breaches
Ahmedabad: Amid growing security concerns, the Ahmedabad Municipal Corporation (AMC) has made it mandatory for public surveillance cameras to be manufactured in India and equipped with India-based identification systems. The civic body’s e-governance department issued a rate tender on January 9 for the installation of CCTV systems at various municipal buildings under this new directive.
The decision stems from increasing awareness about the potential risks posed by foreign-made surveillance systems. These systems often come with traceable media access control (MAC) addresses, a unique identifier assigned by the manufacturer. Experts warn that these identifiers, when combined with the device’s IP address, could expose sensitive information, including the location of the camera and its feed, to unauthorised external entities.
A senior AMC official, speaking on condition of anonymity, highlighted the security risks: “MAC address combined with the device’s IP address (its network location identifier) creates a digital footprint that is necessary for network communication but can also become a security concern.”
Under the new policy, bidders are required to submit an original equipment manufacturer (OEM) certificate to verify that the systems use Indian MAC addresses.
Concerns Over Foreign Systems
The AMC’s move comes after reports that some domestic suppliers were offering CCTV systems with foreign MAC addresses, raising concerns over data leaks and potential security breaches.
“Some domestic companies, bidding for CCTV supply and installation, were providing systems with foreign MAC addresses, posing a risk of data leak and potential data compromise. Therefore, we have mandated Indian MAC addresses for CCTV tenders, with certification required for verification,” the official said.
To further safeguard surveillance systems, AMC plans to implement MAC address masks to prevent any exploitation by attackers.
“Through a technique called network enumeration, attackers can scan for devices using specific manufacturer MAC addresses, which are publicly registered to CCTV manufacturing companies. Once identified, these cameras’ network locations can be mapped using their IP addresses,” the official explained.
Security Controversy In Past
This is not the first time data security concerns have surfaced in the city. In December 2020, the newly redeveloped CG Road was inaugurated with 19 smart poles featuring Wi-Fi routers, PTZ cameras, LED fixtures, USB charging sockets, electric vehicle charging stations, and weather stations. However, controversy erupted when it was revealed that the data from these foreign-manufactured poles was first routed to servers abroad before being relayed to Ahmedabad’s control room.
The AMC’s latest directive underscores its efforts to safeguard sensitive data while ensuring secure and efficient public surveillance infrastructure. By prioritising locally manufactured systems, the city aims to reduce vulnerabilities and enhance data security in its public spaces.