Mr. Rajan Luthra’s ORF report on the “Inversion of Security” raises a fundamental question for India’s security industry: are the cameras deployed to protect our assets also creating an intelligence window for those who seek to compromise them?
For decades, the security industry has regarded CCTV cameras as one of the most dependable tools of physical protection. Cameras watch the perimeter, monitor access points, deter intruders, support investigations and increasingly provide real-time alerts through artificial intelligence-powered analytics. However, the architecture of video surveillance has changed dramatically.
The traditional CCTV system was, in its simplest form, a closed system. A camera transmitted images to a monitor or local recording device. Today’s camera is very different. It is an internet-connected computing device, running firmware, communicating with a Video Management System (VMS), often connecting to a vendor cloud, and potentially transmitting data across networks and jurisdictions.
That transformation has created a paradox: the technology deployed to protect an asset can potentially become a tool for observing, mapping or attacking that very asset.
This is the central thesis of “The Ubiquity of Video Surveillance and the Inversion of Security,” an August 2026 ORF Special Report authored by Mr. Rajan Luthra, Distinguished Fellow at the Observer Research Foundation. The report argues that Digital Video Surveillance Infrastructure (DVSI) has evolved from a localised security tool into a potentially globally accessible intelligence vector. It describes this phenomenon as the “Inversion of Security.”
The proposition deserves serious attention from everyone involved in the design, procurement, installation and management of video surveillance systems in India.
From CCTV to an intelligence infrastructure
He defines DVSI broadly to include internet-connected surveillance cameras, recording infrastructure and the application software used to manage multiple video streams. His concern is not simply that an individual camera can be hacked. It is that the entire surveillance ecosystem—device, platform and data channel, can become an attack surface. The distinction is important.
A compromised camera may provide access to a single image stream. But thousands of compromised cameras, connected to analytics platforms and combined with other sources of information, can potentially reveal movement patterns, identities, routines, access arrangements and operational behaviour.
The report points out that modern network cameras function as IoT endpoints, with IP addresses, embedded firmware and connections to VMS or cloud platforms. Consequently, the attack surface extends well beyond the physical camera itself. This is where the physical-security industry needs to change its thinking.
For many years, CCTV procurement has been dominated by questions such as image resolution, low-light performance, storage capacity, analytics, integration capability and price. Cybersecurity has often been treated as an IT concern, while supply-chain security has remained largely outside the security manager’s traditional field of responsibility. The ORF report essentially challenges this separation.
If the camera is connected to the network, its security is part of cybersecurity. If the camera watches a critical facility, its compromise can become a physical-security issue. If its video travels to an external cloud, the question becomes one of data sovereignty. And if AI can analyse that video at scale, the surveillance system can become an intelligence platform.
Tehran: when cameras become intelligence assets
The report uses several cases to demonstrate the transformation.
The most dramatic is Tehran in March 2026. According to the sources cited in the report, Israeli intelligence had infiltrated parts of Tehran’s traffic-camera network and used the resulting footage to build detailed information about the routines and movements of individuals associated with Iran’s leadership. The significance of the episode goes beyond the particular military operation.
A traffic camera is normally regarded as civilian infrastructure. Its purpose may be traffic management, public safety or urban monitoring. Yet once compromised, the same camera becomes an intelligence sensor.
This is precisely the “inversion” that Rajan identifies: infrastructure installed for protection or public administration becomes infrastructure that can be exploited against the organisation, city or country that owns it. The lesson for India is straightforward. A camera does not cease to be a security risk simply because it was installed for a legitimate security purpose.
The Indian warning: cameras used for espionage
More directly relevant to India are the cases involving covert cameras allegedly used by Pakistan-linked espionage networks.
The report describes the discovery of solar-powered, SIM-enabled cameras positioned to transmit live images of military-related locations, railway infrastructure and strategic routes. It notes that investigations extended across several states and that the Ministry of Home Affairs subsequently initiated a pan-India audit of CCTV networks across major cities and sensitive urban areas.
The report also discusses a separate network uncovered around the period of Operation Sindoor, involving cameras allegedly positioned near military installations and strategic locations across Punjab, Haryana, Rajasthan and Jammu & Kashmir. These devices reportedly used 4G connectivity and solar power, allowing them to operate independently of conventional power and network infrastructure.
Importantly, the report itself makes a distinction that should not be lost in the broader debate: it says there is no publicly available evidence establishing a direct link between footage from those cameras and operational decisions during Operation Sindoor.
Nevertheless, the cases demonstrate something important. An adversary does not necessarily need to penetrate a sophisticated government network if it can simply install a commercially available camera at the right location. That is a profound shift in the threat model.
The AI multiplier
The problem becomes substantially larger when artificial intelligence enters the equation.
Historically, even if an adversary gained access to thousands of cameras, analysing the resulting footage was constrained by human attention. The report cites research suggesting that human operators can effectively monitor only a limited number of concurrent camera feeds before attentional performance deteriorates. AI changes that equation.
Modern video analytics can process thousands of feeds and identify faces, vehicles, behavioural anomalies and movement patterns. Archived footage can be searched for specific characteristics, while video can potentially be correlated with other information sources.
The report argues that the barrier to exploitation is increasingly no longer the availability of sophisticated analytics. It is access to the video feed. Once access is obtained, increasingly capable AI tools can perform analysis at a scale that was previously associated primarily with well-resourced intelligence agencies. This has major implications for the security industry.
The conventional CCTV conversation is about what the camera can see. The emerging conversation must also be about who else can see what the camera sees, where that information travels, who controls the analytics, and what can be inferred from months or years of accumulated footage. It is not only about Chinese cameras.
One of the more important aspects of the ORF report is its caution against reducing the problem to country of origin alone.
The report discusses vulnerabilities associated with Chinese-manufactured equipment, including previously disclosed Hikvision vulnerabilities. However, it also cites vulnerabilities affecting products from Honeywell, KMW and Axis Communications. Its conclusion is that the “Inversion of Security” is a category-level problem affecting networked video surveillance infrastructure rather than an issue exclusive to one country or manufacturer. That distinction is critical.
Supply-chain provenance matters enormously, particularly when surveillance equipment is deployed around sensitive infrastructure. But replacing one brand with another does not automatically create a secure surveillance environment.
A camera may be manufactured in a trusted jurisdiction and still contain vulnerable software. A VMS may be secure while its administrator credentials are compromised. A device may pass certification when purchased but become vulnerable several years later. And a perfectly secure camera can still create a data-security problem if its video is routed through an inappropriate cloud environment.
The risk therefore exists across three layers: the device, the platform and the data channel. This three-layer approach is one of the report’s most useful conceptual contributions.
India’s installed base is the real challenge
India has already begun addressing the problem on the procurement side. According to the report, MeitY’s Essential Requirements for internet-connected video surveillance cameras came into effect through the STQC certification framework on 1 April 2026. The framework includes requirements relating to component origin, source-code inspection, protection against unauthorised remote access, encryption and tamper resistance. This represents an important change in how surveillance equipment is evaluated.
But there is a fundamental problem: new equipment represents only the future. India already has millions of cameras installed.
The report estimates that tens of millions of public-facing cameras were deployed across India during the 2010s and early 2020s and notes that India sold approximately 39.7 million video-surveillance units in FY2025 alone. It argues that a significant part of the legacy installed base operates on hardware and software whose security assurance and cloud-routing arrangements may not be under Indian sovereign control.
This makes the installed base potentially more important than procurement standards. A new camera can be certified. An old camera can remain operational for years. And every year that a vulnerable device remains connected potentially extends the exposure.
From procurement to lifecycle security
This is where the report’s proposed National DVSI Trust Framework becomes particularly relevant. Mr. Luthra proposes seven recommendations structured around three interlocking pillars: certification, auditing and data governance.
- Certification establishes whether equipment, components and software meet defined security requirements.
- Auditing ensures that trust does not end on the day the equipment is purchased.
- Data governance addresses how surveillance information is collected, stored, accessed and shared.
The proposed approach includes a time-bound remediation programme for legacy equipment, sovereign surveillance-data infrastructure, zero-trust principles for physical surveillance infrastructure, a central surveillance infrastructure security registry, stronger supply-chain requirements, comprehensive surveillance-data governance and international engagement on common DVSI standards.
Perhaps the most important principle is simple: certification should not be confused with permanent trust.
A device that is secure today can have a critical vulnerability tomorrow.
A vendor trusted today may change its cloud architecture tomorrow.
A firmware update can introduce a new vulnerability.
A credential can be compromised at any time.
Security therefore has to become a lifecycle function.
What this means for security managers
The report provides practical checklists for enterprises, government organisations and defence establishments. For enterprise security managers, the starting point is to maintain a complete inventory of all networked video devices across the organisation, followed by verification of certification status, assessment of critical component origins, review of cloud routing, removal of default credentials, disabling of unnecessary remote-access functions, firmware management, network segmentation and periodic penetration testing.
These should not be treated merely as cybersecurity tasks but as part of the security manager’s operational responsibility. Security managers need to know how many cameras are deployed, where they are connected, which VMS manages them, where video footage is stored or transmitted, who has administrative access, how firmware is updated and how the organisation will respond when a critical vulnerability is disclosed. For critical infrastructure, the bar must be even higher: video surveillance should be treated as an integral component of the protected system, rather than as an isolated security appliance.
A new role for the security integrator
The implications extend to system integrators as well. Traditionally, an integrator’s responsibility has largely ended with installation, configuration, commissioning and maintenance. The emerging security environment demands a much more comprehensive role. Integrators will increasingly need to understand cybersecurity architecture, firmware assurance, network segmentation, secure configuration, cloud-routing controls, vulnerability management and data governance. The industry will also need professionals who can bridge the traditionally separate domains of physical security and cybersecurity. This is perhaps one of the most important strategic messages emerging from the report. The camera is no longer simply a camera; it is a network endpoint, a sensor, a data generator and, when connected to AI, a potential intelligence engine.
The next phase of India’s surveillance journey
India is at an interesting point in its surveillance evolution. The country has rapidly deployed cameras across cities, transportation infrastructure, enterprises, campuses and critical facilities. At the same time, it is now beginning to impose more rigorous security requirements on new surveillance equipment. The opportunity is to ensure that the next phase does not repeat the weaknesses of the first.
The answer cannot be to stop using video surveillance. Cameras remain indispensable to modern security operations. Instead, the industry must change its definition of a secure surveillance system. A secure system should not simply produce high-quality images. It should have trusted hardware and software, controlled connectivity, secure data paths, authenticated access, continuous monitoring, managed firmware, defined data-retention policies and an auditable chain of responsibility. Most importantly, security must be designed into the architecture rather than added after deployment.
Mr. Rajan Luthra’s report ends with a powerful proposition: no device, vendor, platform or supply chain should receive implicit trust. Trust has to be verified, maintained through monitoring and supported by the institutional ability to respond when something goes wrong.
For India’s security industry, this represents more than a cybersecurity upgrade. It represents a change in mindset.
For twenty years, the central question surrounding CCTV was: “What can the camera see?”
