Cross-border trade in surveillance technology and export controls

On 15 October, Advox, a project of the international citizen media network Global Voices, published a commentary mapping the trade in surveillance technology among Russia, China, Iran, Venezuela and Belarus. The author, a postdoctoral researcher at the University of Bremen in Germany, argues that the greatest danger of AI under authoritarian regimes is that it lets governments suppress protests before they take shape. The author obtained no documents and made no measurements, and most of the commentary's claims link to reports by other media and research institutions. These are deals between states, so ordinary users have no settings to change, and the useful comparison is how different places control exports of surveillance technology.

According to a March report by the investigative journalism organisation Forbidden Stories, the Russian facial recognition company NtechLab licensed an Iranian company as a systems integration partner in 2019, and the software was later sublicensed through Iranian integrators to other buyers. A 2021 contract worth nearly 9 billion rials (about €180,000 at the time) covered real-time facial identification from surveillance cameras, and internal documents cited in the investigation state that both the Revolutionary Guards and the Ministry of Intelligence used the software. None of the companies and agencies Forbidden Stories contacted before publication responded. In December 2024 the US Department of Commerce added NtechLab to its Entity List (exporting controlled US items to a listed company requires a licence first), on the grounds that NtechLab helped the Russian government track peaceful protesters.

A February report by the freedom of expression organisation Article 19 states that ZTE, Huawei, Tiandy and Hikvision continue to operate in Iran despite international sanctions, often through front companies, supplying surveillance technology. The Guardian's coverage of the report carried responses from two of the companies: in February 2026 Hikvision stated that it had left the Iranian market eight years earlier and does not sell there, and ZTE stated that it ceased operations in Iran in 2016. The Guardian article did not carry responses from Huawei or Tiandy, and we did not find any.

The commentary says Protei, a company founded in Russia and headquartered in Jordan, reportedly helped Iran build communications interception and deep packet inspection (DPI, technology that parses the content of each connection in order to filter or monitor it). In 2023 the University of Toronto's Citizen Lab reported, based on leaked documents, that an Iranian mobile virtual network operator had selected Protei to supply core network components including DPI, while noting it had no evidence that final agreements were signed. In November 2025, responding to a report on a hack of the company, the general manager of Protei's Jordan company told TechCrunch that the company has no affiliation with Russia.

The Venezuela and Belarus sections draw on a March report co-authored by the Atlantic Council's Digital Forensic Research Lab (DFRLab) and the local group VE sin Filtro. According to the report, Dahua has kept access to the Venezuelan market despite being added to the US Entity List in 2019 over its involvement in surveillance and repression in Xinjiang. At the time of the listing, Dahua issued a strong protest calling the decision baseless (as carried by Ventas de Seguridad), and we found no response from Dahua to the Venezuela report.

The same report states that Venezuela's interior ministry held talks with the Belarusian company Synesis on facial recognition software between 2021 and 2023, and that it is unknown whether the planned demonstration took place or the software was bought. The US sanctioned Synesis in 2022 for providing software that helped Belarusian authorities identify and arrest protesters. According to a 2021 Biometric Update report, Synesis executives responding to EU sanctions said the company's Kipod system only searches for faces submitted by Belarus's interior ministry and does not identify faces in a crowd.

When we spot-checked the sources the commentary cites, several claims were worded more broadly than their sources. The commentary says up to 80 percent of cameras used in Russia in 2024 were made in China, but the sentence it links to is about the video surveillance market, and the figure is one Russian company's estimate. The commentary cites T-Invariant as saying joint Chinese-Russian development focuses on drones and mass surveillance, but the T-Invariant article it links to does not mention drones or surveillance.

Perspective

Real-time facial recognition matches camera footage against a database of faces, while DPI parses every connection inside a telecom operator's network and decides whether to let it through or block it. Where to draw the line is hard to settle when controlling exports of such technology. According to a law firm's summary of the EU guidelines, commercial items such as billing, marketing and network security are generally excluded, while facial recognition "may" fall under the controls. The guidelines also do not provide an exhaustive product list.

The Digital Silk Road is a digital cooperation framework first proposed by China's National Development and Reform Commission in 2015, which became a foreign policy mechanism in 2017. According to the State Council's summary of a 2023 white paper, China had signed memoranda of understanding on the Digital Silk Road with 17 countries by the end of 2022, and the summary makes no mention of security surveillance. A DFRLab report from February lists exports of AI cameras, facial recognition and predictive policing as part of the "Safe City" model China has promoted heavily, and notes criticism that such technology lacks transparency and effective oversight.

According to the Carnegie Endowment for International Peace's 2019 index, France, Germany, Japan and the United States are also major suppliers of AI surveillance, and 51 percent of advanced democracies deploy AI surveillance systems. These are 2019 figures, and we did not check later changes. The commentary's conclusion also notes that democracies have used surveillance technology to spy on their own citizens.

The Wassenaar Arrangement coordinates export controls on arms and dual-use goods among its members, and as of 29 October it has 42 participating states, including Russia and India but not China. According to the same law firm's summary, the Wassenaar and EU control lists already cover telecommunications interception systems and internet surveillance systems. Decisions are taken by consensus, and each state implements the controls under its own national policies.

The EU's 2021 Dual-Use Regulation brought cyber-surveillance technology that could be used for repression under export controls. The European Commission must report on its evaluation of the regulation between September 2026 and September 2028, and the public consultation closed on 15 October. The UK and France launched the Pall Mall Process in 2024 and in April 2025 published a voluntary, non-binding code of practice for states that covers only commercial cyber intrusion tools such as spyware and intrusion services. Facial recognition and smart cities fall outside its scope, and the 27 supporting states listed on the UK government page include Japan and South Korea.

Taiwan is not a Wassenaar participant, and we could not find out whether its export licensing covers surveillance items. On the use side, Article 11 of the Cyber Security Management Act, as amended in 2025, bars government agencies from using products harmful to national cyber security, meaning systems, services or products that the competent authority has determined pose such a risk. The Regulations for the Review of Products Harmful to National Cyber Security, issued by the Ministry of Digital Affairs as competent authority in December 2025, add that when a reported product is of a Mainland China brand, the ministry may proceed directly to cyber security information sharing.

The regulations name no vendors, and we could not find on official pages whether Hikvision or Dahua fall within their scope. Article 11 applies only to government agencies and does not cover businesses or members of the public using cameras from these brands.

Across Asia, participation in the Wassenaar Arrangement and the Pall Mall code varies. Japan, South Korea and India are among the 42 Wassenaar participants, while mainland China and Taiwan are not. On commercial intrusion tools, Japan and South Korea are among the 27 supporting states of the Pall Mall code, and India, Taiwan and mainland China are not on the list.

Rules on how police use facial recognition differ as well. South Korea's Framework Act on the Development of Artificial Intelligence and the Establishment of Trust, in force since 22 January 2026, classes as high-impact AI those AI systems that may significantly affect life, bodily safety or fundamental rights and are used in listed areas, one of which is analysing biometric data such as faces for criminal investigations or arrests. AI business operators, which the act defines to include state agencies, owe risk management, explanation, user protection, human oversight and record-keeping duties when they provide high-impact AI. We did not check whether police using such a system count as an AI business operator under the act.

We, a community based in Taiwan, found no law in Taiwan that expressly regulates police use of facial recognition matching, though we searched only the Police Power Exercise Act and the Personal Data Protection Act. In Japan, police photograph arrested suspects and the photos are kept by the National Police Agency under the National Public Safety Commission's Rules on the Management and Use of Suspect Photographs, which make no mention of facial recognition or matching. Police officials told the Diet in 2021 that, in individual cases, police match suspects' facial images from security cameras against suspect photos the police hold, and we found no law or National Public Safety Commission rule that expressly regulates this matching. In mainland China, the Measures for the Security Management of Facial Recognition Technology Applications, in force since 1 June 2025, require facial recognition devices in public places to be necessary for maintaining public security and clearly signposted, though the text does not say whether they apply in practice to systems run by public security authorities.

The use-side rules in South Korea and Taiwan attach to different things. South Korea's statute attaches duties to providers of AI used in criminal investigations, while the Taiwanese rule we found attaches to which products government agencies may use. In neither place did we establish whether police use of facial recognition itself is covered.

For the state of internet freedom and surveillance in a given country, Freedom House publishes Freedom on the Net country reports every year (the 2025 edition covers 72 countries).

To compare approaches across places, readers can ask whether exporting surveillance technology requires a licence, whether licensing reviews assess human rights, and whether buyer countries have laws regulating facial recognition and public surveillance cameras. Whether the controls achieve what they set out to do matters too. The Article 19 report describes vendors operating through front companies under sanctions, and the DFRLab report describes Dahua keeping its Venezuelan market after being listed. As of 29 October, we had found no systematic study evaluating how effective these controls are.