CCTV platform pitch· Thai AI study · Draft for discussion

One system for Thailand's state cameras

Storage at DC1, a platform that manages every camera, and a test of what the cameras send

Prepared by B4L (buildfor.life) as consultant. October 30, 2026.
For the investor's operating company, working name DC1 Cloud, which would build, own and run it.

8.2 to 24.9M

THB to build the platform (USD 0.25 to 0.75 million), 91 to 154 person-months (our model)

140M

THB a year from Bangkok's 65,015 cameras at the volume price of 180 THB per camera a month (our model)

4.5 to 16.5M

THB before grants to learn whether the cameras call home, with a test lab at the national electronics center NECTEC (our model)

What DC1 Cloud would sell, per camera a month

390 THB

The platform, list price

A register of every camera, health checks, an agent per camera, logging, service levels measured per camera, footage requests and a portal.

180 THB

The platform at volume

For fleets of 50,000 cameras or more, such as Bangkok's.

170 THB

Storage at DC1, 30 days

On a shared Ceph cluster in the investor's data center at Sikhio, with tape for longer retention.

690 THB

Video analytics

A light detector stream per analyzed camera, on DC1's GPUs.

Sources: camera platform (In short; the numbers); model/camera_platform_results.md (sections 1, 3 and 5); CCTV note (In short). Money in THB, with USD at 33 THB per USD, the study's planning rate.

What Thailand has decided and what it has not

No law requires state footage to stay in Thailand; a 2020 guideline and the budget rules bind agencies, and the telecom industry's label is voluntary

Rule or plan	Who	Binding?	Date
A self-declared label for CCTV and IoT data stored on clouds in Thailand	Telecommunications Association of Thailand (TCT), an industry body, with AIS, True and National Telecom (NT) in its pilot	no, voluntary	launch planned for December 2026
A central copy of 20% of state cameras, kept at least 60 days in Thailand; 30 days at agency recorders	the national CCTV guideline; 75,476 cameras were selected in 2022	through budget approval only; status unconfirmed	2020
Cloud spending goes first to the Government Data Center and Cloud service (GDCC), which NT runs	Digital Government Development Committee	policy through the budget	pilot in FY2027, full from FY2028
Thailand CCTV Security Guidelines (TCSG), graded B, E and H	National Cyber Security Agency (NCSA)	no, guidelines	September 29, 2026
A draft data-center licensing bill: state data kept in Thailand, licenses for Thai companies only	a private member's bill	no; the bill is not enacted	comments closed October 15, 2026
PDPA, the personal data law: no ban on storing data abroad	the Personal Data Protection Committee (PDPC)	yes	2019

What this means for a private operator

A private Thai operator may store state footage today when an agency buys the service through an allowed route, because no rule reserves it for NT or GDCC (our reading).

If the bill passes as written, storing agency data would need a license held by a Thai company.

What we could not confirm

Whether the guideline's central store was ever built, who runs it, and whether the guideline still applies. The copy we read is a provincial upload of 2024.

Sources: CCTV note (In short; What Thailand has decided and what is only proposed; What this means for who may store state footage); camera platform (Qualifications).

Bangkok today

The Bangkok Metropolitan Administration (BMA) runs 65,015 cameras, records them on boxes spread across the city and cannot always find the footage

Cameras: 65,015 at 16,623 locations. About 33,000 are analog units more than 18 years old and about 19,000 are digital cameras more than 8 years old; the system dates from about 2010 and runs on H.264.
Recording: Digital and network video recorders (DVRs and NVRs) across the city. The FY2027 tenders ask for 30 days; a councilor said the cameras keep 7. Recording servers still run Windows Server 2008 and 2012.
Viewing: Operators switch between more than three programs, among them Mirasys, Nice Vision and Gfin. The new Command Center had more than 36,000 cameras connected in February 2026, with 60,000 planned.
Gaps: Auditors found no footage for 2,614 of 8,977 camera points requested in 2017 and 2018; at 2,367 of them the recorders were broken. BMA plans to record in the cameras and keep server storage only at AI sites.

Camera items of the traffic department, FY2026, million THB

Disk use in BMA's own data centers 1 to 3, August 2026

A fourth center opened in May 2026 with 640 TB. BMA spends about 800 million THB a year running its cameras, about 1,025 THB per camera a month.

Sources: camera platform (What is broken today: Bangkok); CCTV note (Bangkok as the first case); model/camera_platform_results.md (inputs bma_lines, bma_status and bma_opex, from BMA's open-contracting data).

A security problem now

ThaiCERT relayed CameraSwarm in August 2026, a campaign that took over more than 14,500 Dahua cameras in 35 days

1,923 cameras

received a backdoor account in CameraSwarm that survived password changes and, on most firmware, a factory reset. Most victims were in Ukraine and Russia.

CVSS 10.0

for Hikvision's CVE-2017-7921, the maximum score. The US cyber agency CISA added the 2017 flaw to its catalog of exploited vulnerabilities only in March 2026; the catalog holds 12 entries for camera and recorder makers (our count).

51,899

Thai results for "hikvision" and 6,097 Thai hosts on the Dahua service port on Shodan, October 30, 2026. These are unverified banner matches.

10 clips

from hacked Thai cameras, some at government agencies, were found by the Department of Special Investigation in 2020, which blamed unchanged default passwords.

What NCSA's guideline asks of a camera operator

TCSG clause	What it asks	Level
3.4.1, 3.4.4	No management interfaces on the internet without need; default passwords changed; no shared passwords.	should at all levels
3.5.1	A register of models and versions; firmware source and integrity checked before install.	firmware check at all levels
3.5.2	Listed events logged and sent to a central system, protected from change or deletion.	should at E and H
3.5.3	Periodic checks: online, recording, no gaps, focus, angle, light, and the oldest footage actually retrievable.	checklist
3.5.5	Maintenance contracts with response, restore and fix times; availability, completeness and repair time per camera.	indicators without target values
3.8	Retired devices removed, with their accounts, certificates and keys revoked.	should at all levels

No Thai agency has published a count of exposed cameras, and few can produce this evidence from recorders spread across a city (our reading).

Sources: camera platform (Security exposure; What NCSA's guideline asks for); the ThaiCERT, CISA and Department of Special Investigation notices cited there. Shodan counts were read on October 30, 2026.

Do the cameras call home?

Flaws and cloud links that call home by default are documented, but no published capture shows a professional camera sending footage abroad

What is documented

CISA rated Hikvision's CVE-2017-7921 at CVSS 10.0 and warned that gray-market cameras run firmware Hikvision did not make.
IPVM verified that a 2017 Dahua flaw let anyone download user names and password hashes.
Every Xiongmai device, sold under many brands, shipped with the XMEye cloud switched on; at least 9 million were online in 2018.
Hik-Connect's privacy policy says some staff in mainland China have limited remote access to user information.

What other countries did

The United States bars new authorizations for Hikvision and Dahua equipment used for public safety and critical infrastructure.
The United Kingdom told departments to stop deploying such cameras on sensitive sites.
Australia found more than 900 units in Commonwealth buildings and said they would be assessed and removed.
India tests for unauthorized remote access and checks the origin of each camera's chip; 507 models were certified by March 2026.

What nobody has shown

No published lab study shows a professional Hikvision or Dahua camera sending video to China.
The traffic studies cover consumer devices: in 2019, 72 of 81 contacted a party other than the maker.
Thailand has no camera-specific test scheme, and TCT's mark is defined by where data is stored.
Nobody in Thailand measures whether its state cameras call home (our reading).

The testCapture each model's traffic through setup, use, idle and update, and compare it with what ETSI EN 303 645 asks makers to declare. Slide 11 prices it.

Sources: camera platform (Do the cameras call home?), with the CISA advisory, IPVM, SEC Consult, Hik-Connect, FCC, UK Parliament, Australian, Indian and ETSI documents cited there.

The product

The platform sits above the cameras, recorders and video management systems (VMS) that agencies own, and adds eight modules

390 THB

per camera a month at list price (USD 11.8), below Verkada's 544 and Rhombus's 410 to 547 for cloud licenses alone.

180 THB

for fleets of 50,000 cameras or more (USD 5.5). Storage, analytics, field repairs and circuits are extra.

The pitch to an agency

Measured service: availability and repair times per camera, logs that hold up, and a neutral party between the agency and its maintenance contractors. No current Thai tender we found sets a service-level agreement (SLA) on uptime per camera.

Sources: camera platform (What the platform does; Price); model/camera_platform_results.md (section 3). The building blocks and their licenses are as the note lists them; the module split is our design.

Bundling every stream

A gateway bundles cameras, recorders and existing VMS, each city's command center aggregates them, and DC1 runs the core

Milestone's federation links only XProtect systems and Genetec's only Genetec systems, so the gateway speaks the Open Network Video Interface Forum's standard (ONVIF) and the streaming protocol RTSP to cameras and each vendor's software kit to each VMS.

The gateway pulls snapshots and short samples for checks and relays live video only when an operator asks. Recording stays where it is unless the agency buys storage at DC1.

Camera interfaces stay off the internet. The agency holds the keys to its footage, and the investor's staff administer the platform only from Thailand, at TCSG level E or H (our judgment).

Sources: camera platform (Stream gateway and VMS federation; Architecture); CCTV note (Ingest and transport). The three tiers are our design; site-box prices are KIRZ's 8-channel edge gateways.

An agent for every camera

Each camera gets a software agent that checks its stream and picture every hour, and the agent never identifies, counts or follows people

What it checks

The camera answers, and its stream arrives at the expected frame rate.
The recorder holds the hours it should, and the camera's clock agrees with the Thai time source.
Once an hour it sends one frame to a vision-language model with yes-or-no questions: is the image blurred, dirty, dark, blocked, or turned from its reference view?

What it may do alone

Open a ticket, and retest after a fault or a repair.
Attach before-and-after images to the ticket and annotate the registry.

A repair counts as done only when the checks pass again: the stream returns, the recorder shows continuous recording and the new frame matches the reference view.

What needs a person

Sending a contractor to the site.
Any change to a camera's configuration or firmware.
Any access to footage. The agent itself has no access to recorded footage.

33 streams

per RTX PRO 6000 in NVIDIA's real-time benchmark, or 11,880 checks an hour

6,700

cameras per GPU, checked hourly with headroom and retests (our model)

10 GPUs

for Bangkok's 65,015 cameras, in DC1's shared pool (our model)

3.3 to 4.6

THB per camera a month for the checks and the agent's ticket text (our model)

We found no published example of a vision-language model checking camera health, so the agent's error rates have to be measured in the pilot.

Sources: camera platform (Agents per camera; Health monitoring per camera); model/camera_platform_results.md (section 2, image checks). The open model would be one such as Qwen3-VL-8B (Apache-2.0 weights). What the agent may do is our design.

Logging and evidence

Every view, export and change enters a hash-chained log, and footage leaves only through an approved request and a signed export

The log: each entry carries the hash of the entry before it

A footage request, as BMA's palace-area tender sets the clocks

Exports use the ONVIF export format, adopted as IEC 62676-2-32 and signed; the evidence copy goes into a compliance-mode Object Lock bucket and onto write-once (WORM) tape in two copies (our design).

How long records are kept

Record	Rule	Basis
Traffic data, including sign-in logs	at least 90 days, up to 2 years on order	Computer Crime Act notification of 2021; likely applies to a hosted platform (our inference)
Recorder access logs	at least 90 days	advice of the Department of Special Investigation, 2020
Footage at agency recorders	at least 30 days	the 2020 guideline; BMA's FY2027 tenders
Online footage requests at BMA	within 24 hours	at most 6 cameras and 3 hours in total, with a police report
Evidence on WORM tape, two copies	5 to 10 years	3.4 to 23.3 THB per camera a month for BMA (our model)

Sources: camera platform (Logging, footage requests, and evidence); CCTV note (Evidence that holds up; Bangkok as the first case); model/cctv_results.md (section 4, evidence archive). The hash chain is our design; TCSG asks for tamper protection at levels E and H.

Storage and video AI at DC1

At DC1, 30 days of footage would cost 88 to 107 THB per camera a month, and the offer would sell them for 170 THB

30 days of 2MP footage, THB per camera a month

14 racks

for all 65,015 Bangkok cameras at 30 days: 43.1 PB, 23% of hall B, 232 to 254 million THB of equipment (our model). BMA plans no such copy.

36 to 46 days

of retention, beyond which 14 days on disk plus tape costs less than disk alone. A year costs 155 to 251 THB per camera a month on disk and tape against 880 to 1,030 on disk (our model).

932 to 1,299

THB per stream a month for a heavy detector on DC1's GPUs, against about 5,783 on AWS in Bangkok (our model).

The investor would train models only inside an agency's tenancy and for that agency, and would never pool state footage into its own models (our judgment).

Sources: CCTV note (In short; What it costs and what it could sell for; Video AI); model/cctv_results.md (sections 2, 4 and 5). Third-party prices are list prices; THAI DATA CLOUD and AWS per camera are our arithmetic. DC1 opens between H2 2028 and H1 2029.

The camera trust program and its budget

Containing one district's cameras and a test lab with NECTEC would answer the question for 4.5 to 16.5 million THB before grants

Gross cost and net cost if the grants come, million THB, low to high

The sequence we recommend

Contain and watch. Block outbound traffic by default on one district's camera networks, answer their DNS lookups from a sinkhole and keep flow logs, which gives a measured count within six months.
A test lab with the National Electronics and Computer Technology Center (NECTEC). It tests the 20 to 40 models in service with free tools and sends 5 to 10 critical models to outside tests at USD 5,200 to 25,000 each.
Open firmware such as OpenIPC or thingino, only for flagged models with supported chips. OpenIPC's Majestic streamer carries no open license.
An own camera on an NXP or Ambarella chip, built by a Thai maker such as Hana or SVI, only if the lab finds cause and an agency commits to buy.

Grants from the National Innovation Agency (NIA) and the ITAP program of the National Science and Technology Development Agency are possible; none is promised.

Sources: camera platform (A research program and budget; Grants; The sequence we recommend); model/camera_platform_results.md (section 5). The order is our judgment; grants apply to different cost lines and are not counted twice.

Can the investor be the provider?

Thailand has no national camera contract, so the investor would become a provider one agency at a time, through four routes

Route	How it works	Evidence	What it needs
Behind NT's rentals	The specific method allows direct purchases of no more than 500,000 THB.	Samet municipality rents 186 cameras with equipment from NT for 312,579.10 THB a month, about 1,681 THB per camera.	An agreement with NT, which is also a competitor.
Thai Innovation List	Listed products may be bought directly from one seller; a listing lasts up to 8 years.	AI red-light software that runs on existing CCTV is already listed.	51% Thai shareholding and real R&D in Thailand; criteria tightened in October 2026.
Open e-bidding	The default route for agencies.	SMEs win within 10% of the lowest price, and Thai bidders beat foreign ones within 3%.	A track record with agencies, which the investor lacks.
Smart cities with depa	The Digital Economy Promotion Agency certified 37 smart cities by August 2025 and targets 105 by 2027.	In Sikhio, DC1's own district, an 8 million THB contract held 2.5 million for CCTV processing and upgraded all 52 cameras.	A pilot that depa funds or lists in its Digital Catalog.

Renting is normalPattaya rents with 940 replacement cameras for 200 million THB over 36 months, Nakhon Si Thammarat's provincial administration priced 3 years of renting at 131.6 million THB against 154.0 million to buy and run, and Samart rents the Map Ta Phut estate network for 294 million THB over 60 months. These contracts bundle cameras, network and repair; none we found prices a management platform on its own.

Incumbents

Forth's Genius Traffic System won at least 29 BMA camera projects worth 1,273.31 million THB in fiscal 2015 to 2022.
Samart's companies hold the largest rentals, such as 609.9 million THB over 60 months for the southern border.
NT rents cameras to towns and runs GDCC; Pineapple Vision Systems and Gorilla Technology sell to the police.

Ownership tests

The Digital Government Development Agency's (DGA) draft cloud standard asks for a Thai company at tier 1, and the draft licensing bill for Thai companies with half their supervision staff Thai.

Sources: camera platform (Can the investor be Thailand's provider?: procurement routes, rental precedents, qualifications, partners, incumbents, our verdict).

The numbers by case

One municipality of 1,000 cameras loses money on its own, while Bangkok's 65,015 cameras would pay about 140 million THB a year

Each fleet as the only customer, million THB a month, cautious to favorable

The fee alone covers the team, the servers and the build from about 2,300 to 5,500 cameras at the list price of 390 THB, and from 5,500 to 18,200 at the volume price of 180 THB (our model).

Bangkok's spending, M THB a year

Sources: camera platform (Four cases; Bangkok against its current spending); model/camera_platform_results.md (section 4). Storage assumes 30 days for every camera at DC1, an upper bound that BMA does not plan.

What it costs to build and run

The platform costs 8.2 to 24.9 million THB to build, and its fee covers the team and the build from about 2,300 to 5,500 cameras

Build by work package, million THB, low to high

Run cost per camera a month by fleet, THB, against the price

A core team of five engineers and an account manager is the largest fixed cost. Engineers cost 80,000 to 150,000 THB a month, and the NOC (network operations center) is one seat around the clock plus half an engineer per 10,000 cameras (our estimates).

Sources: camera platform (The numbers: build, run cost per camera-month, price); model/camera_platform_results.md (sections 1 to 3). Build recovered over 5 years at 8%, the study's convention. All figures are our model.

Risks

The largest risks are commercial and legal: no national buyer, NT as both partner and competitor, and the Thai ownership rules

Risk	Evidence	How the plan answers it
No national buyer	Every contract is a separate sale, and Bangkok plans to record in the cameras.	Build city by city; aim for fleets above the break-even.
NT is partner and competitor	NT rents cameras, runs the government cloud and sells home CCTV.	Offer a platform behind NT's rentals that lets NT sell measured service levels.
Ownership rules	The Innovation List needs 51% Thai shareholding and is being tightened after corruption and monopoly findings.	Settle a Thai-majority operating company before any tender.
Incumbents and VMS makers	The contractors being measured may resist sharing recorder data; three VMS makers publish no terms for their software kits.	Start where the agency controls the contract; price the adapters as the least certain line.
False alarms from agents	No published accuracy for camera-health checks by a vision-language model.	Tune them in the pilot before any service level depends on them.
The platform as a target	CameraSwarm shows attackers use old flaws, and a breach of the platform would be worse than any single camera's.	TCSG level E and H, interfaces off the internet, keys with the agency, staff in Thailand.
Face recognition	In Moscow 105,000 cameras were linked to face recognition, and the European Court of Human Rights found a breach.	Agents never watch people; face recognition only for agencies with a legal basis.
Research and timing	The lab may find nothing; DC1 opens in H2 2028 to H1 2029 after the pause of 166 data-center projects.	Contain and watch first; a pilot in a rented Bangkok rack with CMU ITSC as second site.

Sources: camera platform (Risks; Our verdict; Procurement routes); CCTV note (Risks); first data center (Schedule).

A staged plan with triggers

The plan runs in four stages from November 2026, each with a trigger for the next step, and reaches DC1 in H2 2028 at the earliest

Sources: camera platform (A staged plan; A research program and budget); first data center (Schedule). Dates are our estimates, and the triggers are our judgment.

What the investor would decide now

The first decisions cost about 1 to 2.4 million THB, and the 8.2 to 24.9 million THB build waits for a signed pilot or an NT agreement

Decisions now

Settle the company structure: a Thai-majority operating company, which the Innovation List, DGA's draft tiers and the draft bill all need.
Approve six months of preparation from November 2026: talks with NT, depa, NECTEC and BMA's traffic department, and a legal review of the procurement routes and the Computer Crime Act duties.
Fund contain and watch in one district or municipality: 1.01 to 2.42 million THB over 6 months (our model).
Commit to the platform pilot when a municipality signs or NT agrees: 8.2 to 24.9 million THB for 1,000 to 5,000 cameras.
Decide on the lab with NECTEC after the first results: 3.48 to 14.13 million THB over 12 months, before grants.

Decisions that can wait

Open firmware, 2.2 to 8.4 million THB, only for models the lab flags.
An own camera, 7.7 to 22.7 million THB, only if the lab finds cause and an agency commits.
Disk for footage, bought per contract, because drives bought early would carry 2026's peak prices.

B4L can prepare the talks and inquiries for the investor, who decides at every step.

Questions to ask first

Would NT put a neutral platform behind its camera rentals, and on what terms?
Can a platform built on open source be listed on the Innovation List?
Would BMA's traffic department pilot per-camera measurement in one maintenance zone?
Do Mirasys, Nice Vision and Gfin offer software kits for status and export?
Does the Computer Crime Act's traffic-data rule apply to a hosted camera platform?

Our verdictThe investor can become a significant provider of camera operations to Thai agencies, possibly the largest neutral one, but it cannot become Thailand's single provider, because no buyer exists for a national contract (our judgment).

Sources: camera platform (What this means for the investor; A staged plan; Open questions); CCTV note (What this means for the investor). The order of the decisions is our judgment. The notes, the models and every source are on thaiai.lol.