Amazon's business relationships with two Chinese surveillance giants, Hikvision and Dahua, may violate a law prohibiting federal contractors from doing business with certain Chinese firms, a joint investigation by National Review and IPVM, a surveillance and security research group, reveals. While lawmakers are calling out these practices, Amazon has defended them and maintains that it is in full compliance with the law.

Specifically, the Seattle-based tech giant might be running afoul of a provision in the 2019 National Defense Authorization Act barring contracts with firms that use certain Chinese surveillance hardware or software. One potentially significant issue is that Amazon Web Services simultaneously provides cloud Internet services to the U.S. National Security Agency and Hikvision, which the U.S. government designated as a Chinese military-industrial complex company last year.

"Facing a clear threat to federal networks, Congress drew a line in the sand for its contractors: if you do business with Hikvision or Dahua, you can't do business with the federal government," said Conor Healy, IPVM's director of government research. "Amazon seems determined to do the opposite. It is actively facilitating and incubating the very threat Congress sought to mitigate."

Even absent the NDAA ban, enforcement of which is spotty, the record of the two Chinese surveillance firms — neither of which responded to NR's requests for comment — should be cause for concern. In 2019, Hikvision and Dahua were both blacklisted by the Commerce Department for their extensive work with the authorities in Xinjiang, as the Chinese Communist Party built out a sophisticated police state to systematically target ethnic minorities in the region.

Dahua sells cameras that can identify Uyghur faces, with an alarm that goes off when they are in view. The company characterizes this as a smart-policing feature to detect "real-time Uyghur warnings" and "hidden terrorist inclinations." Hikvision, in addition to providing cameras used in Xinjiang prison camps, sells "tiger chair" torture and interrogation systems, among other things. Hikvision also has a well-documented relationship with the Chinese military, providing the People's Liberation Army air force with drone jammers, and pitching its technology as key to improving missile and tank systems.

None of that has stopped Amazon from providing services to the two surveillance firms. Both of the Chinese firms offer streaming services that allow their customers to view video feeds from their cameras remotely, all of which are hosted on Amazon Web Services — the cloud Internet platform that last year secured the renewal of a $10 billion contract with the NSA.

According to a Hikvision-commissioned cybersecurity audit conducted by FTI Consulting and submitted to the Federal Communications Commission last November, "Hikvision uses numerous Internet Service Providers within the United States for all Hik-Connect traffic," including Amazon Web Services, other Amazon service providers, and servers provided by Chinese tech giants Alibaba and Tencent. A brochure for another Hikvision service offering confirms that it is "hosted by Amazon Web Service (AWS) with full redundancy, network boundary protection and operation system protection." Dahua also offers its own cloud-access software, called COS, that is hosted on AWS.

In addition, Amazon hosts several online stores operated by wholly owned subsidiaries of Hikvision and Dahua. IPVM describes them as well developed, based on the number of products that each store offers, the sophisticated nature of the marketing surrounding them, and hundreds of "verified purchaser" reviews.

For its part, Amazon said that it is complying with the law. A company spokesperson told NR in a statement: "Amazon complies with applicable law in the jurisdictions where we do business, including Section 889 of the 2019 NDAA, and has policies and procedures designed to support such compliance. We expect all products in the Amazon Stores to be manufactured and produced in accordance with our Supply Chain Standards." Amazon also points out that its AWS cloud services and supply chain are vetted and accepted for top-secret workloads.

But the fact that Amazon has billions of dollars in U.S. government contracts as it also works with Hikvision and Dahua raises thorny legal questions for the company. While the NDAA ban mainly prohibits federal contractors, such as Amazon, from purchasing devices from the companies, it may also prohibit contractors from maintaining certain business relationships with them. Specifically, under the ban federal agencies may not enter "into a contract (or extend or renew a contract) with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system."

"This means Amazon's $10 billion NSA contract may be illegal, but first federal authorities must clarify the scope of the NDAA ban and investigate Amazon's actions," Healy said. "As things stand, due to the law's imprecise language, the legality of Amazon's actions may come down to something as trivial as whether or not they have plugged one of these devices in."

Asked about Amazon's work with Chinese surveillance firms, a spokesperson for the NSA told NR that its "business practices comport with the 2019 NDAA and its implementing requirements."

The potential conflict of interest is starting to attract attention on Capitol Hill, as some lawmakers identify the situation as a possible threat to national security. Senator Marco Rubio, who has previously clashed with Amazon, said that its continued relationship with Chinese surveillance firms fits into a broader pattern. Rubio criticized Amazon after the company bought the Dahua cameras that can identify Uyghur faces. (Amazon says that it procured Dahua thermal cameras in 2020 to conduct temperature checks as a response to the pandemic and that it has not bought any Dahua cameras for its facilities since the middle of that year.)

"No one should be surprised," the Florida Republican told NR in a statement. "This type of behavior is par for the course for a company that prioritizes short-term profit above all else, including the health and well-being of its employees. Amazon loves to preach woke values, but it appears to have no problem seemingly breaking U.S. law — and putting federal, state, and local agencies in the position of doing the same — while doing business with a genocidal, oppressive regime.

"The General Services Administration and Department of Defense need to investigate this immediately and put a stop to this massive national-security threat," he added, citing two government agencies with responsibility for federal procurements.

For now, it appears that such an investigation is not in the offing. When the GSA was approached by NR, a spokesperson said the agency is unable to comment on an individual company's practices but that a federal regulation does not prohibit Hikvision and Dahua from purchasing the services of a federal contractor. "GSA takes supply chain security very seriously, and compliance with Section 889 is a key priority for the Agency," this person said. When NR contacted the Pentagon, a spokesperson issued a perfunctory statement that "executive agencies are required to comply with" the NDAA ban.

If Republicans take the House of Representatives in the midterm elections, there may be a renewed focus on the issue from congressional committees. Representative Michael McCaul, the top Republican on the House Foreign Affairs Committee who would take the gavel under a GOP majority, called it "unacceptable that American businesses continue to turn a blind eye to CCP-controlled companies that are fueling its Orwellian surveillance state and its horrific human rights abuses." And, more generally, there is a growing bipartisan interest in passing legislation to prohibit federal contractors from doing business with entities linked to the Chinese government.