One system for Thailand's state cameras: platform, agents, and the trust question

Research note, October 30, 2026, Alexander Grabowski (B4L). Sources retrieved October 30, 2026; figures cited, our estimates marked.

This note covers a camera operations platform that the investor's operating company (working name DC1 Cloud) could run for Thai state agencies: one system that registers every camera, bundles the streams of cameras, recorders, and video management systems (VMS), gives each camera a software agent that checks its health, measures the maintenance contractors, and logs every view and export. It also budgets research on whether the installed cameras call home and answers how far the investor could get toward becoming Thailand's service provider for state CCTV. B4L (buildfor.life) prepared it as consultant; the investor would build, own, and run the platform and its data center (DC1, at Sikhio in Nakhon Ratchasima) and sell the services. The arithmetic is in model/camera_platform.py, with results in model/camera_platform_results.md. Money is in THB, with USD in parentheses at 33 THB per USD, the B4L planning rate. Footage storage, the rules on where state footage may be kept, and video recognition are in the CCTV note.

In short

• Thailand has no single contract for its state cameras, so the investor cannot become the national provider in one step. Agencies must buy by open e-bidding unless an exception applies, and the specific (direct) method is open only below 500,000 THB per purchase, for a single qualified operator, or for items declared state-promoted, a list that does not name NT.[1434][1435][1436] The role would be built one agency at a time, through a platform behind NT's camera rentals, a listing on the Thai Innovation List, depa's smart-city channel, and open tenders (our judgment).
• Bangkok shows what such a platform would fix. Auditors found no footage for 2,614 of 8,977 camera points requested in 2017 and 2018, and operators still switch between more than three viewing programs.[1371][1376]
• The platform would cost 8.2 to 24.9 million THB (USD 0.25 to 0.75 million) to build and 45 to 114 THB per camera a month to run at Bangkok's scale (our model). Each camera gets an agent that checks its stream and image every hour on DC1's GPUs.
• At a volume price of 180 THB per camera a month, BMA's 65,015 cameras would bring about 140 million THB (USD 4.3 million) a year, 20% of BMA's FY2026 camera budget lines and 49% of its maintenance line (our model).[1378] At the list price of 390 THB the platform covers its team and build from about 2,300 to 5,500 cameras, and one municipality of 1,000 cameras on its own loses money.
• Nobody has published a capture of professional cameras sending footage abroad, but backdoor-class flaws and cloud links that phone home by default are documented. Hikvision's CVE-2017-7921 scored the maximum CVSS 10.0, and every Xiongmai device shipped with a peer-to-peer cloud link switched on by default.[1437][1438] Nobody in Thailand measures whether its cameras call home (our reading).
• Two steps would answer the question for 4.5 to 16.5 million THB (USD 0.14 to 0.50 million) before grants: contain and watch the camera networks of one district, then run a test lab with NECTEC (our model). Open firmware (2.2 to 8.4 million THB) and an own camera made in Thailand (7.7 to 22.7 million THB) make sense only if the lab finds cause and a buyer commits (our judgment).
• The investor can become a large, neutral operator of state cameras, but only through a Thai-majority operating company, partners such as NT and depa, and a pilot that proves the service before DC1 opens (our judgment). Forth and Samart hold the large contracts today and NT rents cameras to towns, while DC1 opens between the second half of 2028 and the first half of 2029 (first data center).[1380][1439][1440]

What is broken today

Bangkok

In July 2025 the deputy governor said about 33,000 of BMA's cameras are analog units more than 18 years old and about 19,000 are digital cameras more than 8 years old.[1376] A councilor's motion says the system dates from about 2010 and runs on H.264, and the deputy governor said operators watch through more than three programs, among them Mirasys, Nice Vision, and Gfin.[1376] A district councilor told the city council that the recording servers still run Windows Server 2008 and 2012, which he called a security gap.[1366]

Footage is often missing when it is needed. For 8,977 camera points requested between January 2017 and September 2018, BMA had footage for 6,363 and none for 2,614; at 2,367 of those points the recorders were broken.[1371] Of 59 standalone cameras in the same audit, 24 recorded fully, and the auditors blamed weak control of the maintenance contractors.[1371] Enforcement from the cameras is thin as well: of 8,828 offenders photographed by AI cameras for riding on pavements, 517 cases had been completed.[1286]

The money goes to upkeep and circuits. BMA's open-contracting data give about 703 million THB of camera items for the traffic department in fiscal 2026: 287 million for maintenance, 165 million for circuit rental, and 251 million for cameras and other items.[1378] One directly contracted line rents circuits for 126 million THB a year so that the status of standalone cameras can be monitored from the control center.[1378] Bangkok thus already pays for crude health monitoring and for contractors, and the audit shows that neither proves that footage exists.

The new Command Center had more than 36,000 cameras connected in February 2026, with 60,000 planned, but a shared screen does not show which camera records or which contractor is late (our reading).[1441]

Other cities and agencies

The pattern repeats outside Bangkok. In 2021 only 43.8% of Pattaya's 2,418 camera points worked, and an earlier maintenance contract that required cameras to work more than 95% of the time was canceled in 2017 after objections.[1442] In July 2020, more than half of Pattaya's cameras were unusable because their fiber links kept burning.[1317] Phang Nga's provincial police list 764 state cameras, 135 of them broken.[1318] Udon Thani's city has 1,625 cameras, of which 633 are online to the control center and 972 are offline cameras in communities and parks.[1316]

A government article of February 2026 says each agency's CCTV results are still stored in separate silos that do not support joint processing.[1443] Singapore, with more than 100,000 police cameras, says its government does not even track the enforcement cameras of all agencies.[1444]

What NCSA's guideline asks for

NCSA's Thailand CCTV Security Guidelines (TCSG) of September 29, 2026, are not binding, but they describe what an operator of state cameras should be able to show, graded by level: B (baseline), E (enhanced), and H (high assurance).[1306]

Source: TCSG.[1306]

Few agencies can produce this evidence from recorders spread across a city (our reading).

Security exposure

In 2020 Thailand's Department of Special Investigation found 10 published clips from hacked Thai cameras, some of them at government agencies; it blamed unchanged default passwords and advised agencies to keep recorder access logs for at least 90 days.[1445] In August 2026 ThaiCERT relayed the CameraSwarm campaign, which took over more than 14,500 Dahua cameras in 35 days, mostly in Ukraine and Russia, and planted a backdoor account on 1,923 of them that survived password changes and, on most firmware, a factory reset.[1446] CISA's catalog of exploited vulnerabilities holds 12 entries for camera and recorder makers (our count by vendor), and it added Hikvision's 2017 flaw only in March 2026.[1447] Shodan counted 51,899 Thai results for "hikvision" and 6,097 Thai hosts on the Dahua service port on October 30, 2026; these are unverified banner matches.[1448][1449] No Thai agency has published a count of exposed cameras.

What the platform does

The platform is a layer above the cameras and recorders that agencies already own. It leaves their VMS and maintenance contractors in place and gives the agency one view of every camera and the evidence to hold contractors to their contracts.

Registry

TCSG asks for a register of models and versions, a survey of legacy systems, and an updated register when a device is retired.[1306] NetBox, an Apache-2.0 inventory tool already planned for DC1's own equipment, would hold the cameras, circuits, contracts, and the contractor responsible for each site, so that every fault has an owner.[1450]

Stream gateway and VMS federation

Bundling cannot rely on one vendor's federation, because Milestone's Federated Architecture links only XProtect systems and Genetec's federation joins Genetec systems (our reading).[1452][1453] The gateway therefore speaks ONVIF and RTSP to cameras and each vendor's SDK to each VMS, through adapters for the programs Bangkok runs. It pulls short samples and snapshots for checks and relays live video only when an operator asks; recording stays where it is unless the agency buys storage at DC1.

Health monitoring per camera

Online status alone does not show that footage exists, so the platform also measures recording integrity, which HikCentral defines as actual recording time divided by scheduled recording time.[1459] ONVIF defines tamper events for blur, darkness, glare, a moved scene, and signal loss, but support is optional, and Hikvision does not support its own image diagnosis in night mode because it gives frequent false alarms.[1454][1460] A mixed fleet therefore needs the platform's own checks: a probe of each camera's stream and clock every minute, the recorder's view of what it recorded, a monthly test that the oldest footage can be played back, and an hourly image check by the camera's agent (our design).

Maintenance and SLA measured by the platform

TCSG asks maintenance contracts to define response, restore, and fix times by impact, and it defines availability as the share of time a camera can serve and record, with MTTR counted from detection.[1306] The Thai contracts we read do not measure per camera. Maharashtra's model contract shows what a measured service looks like: 97% uptime per camera as the baseline, below 92% a breach, a video-quality target for 97% of feeds, penalties capped at 15% of the contract value, and an integrator that must supply the tools that measure all of it.[1456] The platform would be that tool, run by a party that is not the maintenance contractor (our judgment).

Logging, footage requests, and evidence

Every view, export, search, and configuration change goes into an append-only log in which each entry carries the hash of the one before, so a deleted or altered entry breaks the chain (our design), as TCSG asks at levels E and H.[1306] The Computer Crime Act notification of 2021 makes cloud providers keep traffic data, including authentication logs, for at least 90 days and up to 2 years on order, and a hosted camera platform would likely fall under it (our inference).[1457] Moscow's system records every request.[1461]

BMA already asks for a police report with every request, and its palace-area tender gives the contractor 24 hours to copy and 48 hours to deliver footage from networked cameras.[1369][1379] The platform would run that workflow with approvals and clocks, export clips in the ONVIF export format with signatures, and keep an evidence copy under S3 Object Lock, as the CCTV note describes.[1361][1354]

Storage, analytics, and open interfaces

Storage (30 days at 170 THB per camera a month) and a light detector stream (690 THB) are separate products switched on per camera (our model). An open API would feed depa's City Data Platform, which more than 46 local bodies use free.[1458] In Sikhio, DC1's own district, depa's 8 million THB smart-city contract included 2.5 million THB for a CCTV processing system that feeds the city data platform, and the project upgraded all 52 of the district's cameras with AI attribute search.[1462][1463]

Agents per camera

Each camera gets a software agent: a small program with a fixed list of checks, a fixed list of actions, and a log of everything it did (our design). Its inputs are health signals and image-quality checks; it never identifies, counts, or follows people and has no access to recorded footage.

The agent watches whether the camera answers, whether its stream arrives at the expected frame rate, whether the recorder holds the hours it should, whether its clock agrees with the Thai time source, and whether the picture is usable. Once an hour it takes one frame and asks a vision-language model a set of yes-or-no questions: is the image blurred, dirty, dark, blocked, or pointing somewhere other than its reference view?

On its own, the agent may open a ticket, retest after a fault or a repair, attach before-and-after images to a ticket, and annotate the registry. A person must approve any dispatch of a contractor, any change to a camera's configuration or firmware, and any access to footage. A repair counts as done only when the agent's checks pass again: the stream returns, the recorder shows continuous recording, and the new frame matches the reference view (our design).

The checks are cheap. NVIDIA's real-time VLM handles 33 alert streams on an RTX PRO 6000 Server Edition and 51 on an H100, each stream checked in 10-second chunks of 80 frames.[1464] On the RTX PRO 6000 that is 11,880 checks an hour, so one GPU covers about 6,700 cameras checked hourly with headroom and retests, and Bangkok's 65,015 cameras need about 10 GPUs (our model). The model would be an open one such as Qwen3-VL-8B, whose weights are Apache-2.0, running in DC1's GPU pool beside the Thai language models that write the ticket text (Thai models).[1414]

Vendors already sell parts of this: Genetec's KiwiVision, Ai-RGUS, and Telent's Arbitex flag covered, blurred, tilted, or misaligned views, as vendor or partner claims without published accuracy.[1465][1466][1467] We found no published example of a vision-language model doing camera-health triage, so the agent's error rates have to be measured in the pilot.

Architecture

The platform has three tiers (our design). At the edge, a site box runs only where cameras cannot be reached from a command center: it probes the local cameras and recorder, keeps a short buffer of check results, and reports over the agency's circuit. KIRZ's 8-channel edge gateways at 8,700 and 19,375 THB set our price range for such a box.[1290] In each city, the agency's command center remains the aggregation point. At the core, DC1 runs the registry, the logs, the agents, and any storage and analytics, with CMU ITSC in Chiang Mai as the second site about 460 to 520 km away (the open stack).

The stack is open source where it can be (our design):

• NixOS and Incus for the servers, as in the rest of DC1 (the open stack).
• go2rtc and MediaMTX for streams, both MIT-licensed.[1346][1345]
• NetBox for the registry, Prometheus and VictoriaMetrics for metrics, and Loki or OpenSearch for logs.[644][650] Loki is AGPLv3, which matters only if the investor modifies it and offers it to customers.[523]
• PostgreSQL for tickets and the audit chain.
• Kanidm or Keycloak for sign-in and OpenBao for secrets.[459][458][460]

State cameras would be handled at TCSG level E, and level H for police and security agencies (our judgment). TCSG warns that storage in Thailand is not sovereignty if administration, keys, or support can be reached from abroad.[1306] The agency should hold the keys to its footage and its exports in its own vault, the investor's staff should administer the platform only from Thailand, and every staff action should be logged like any other (our judgment). Camera management interfaces stay off the internet; the probes reach cameras only through the agency's network or the site box.

Do the cameras call home?

What is known is that hidden or default remote access has been real. CISA rated Hikvision's CVE-2017-7921 at CVSS 10.0 and noted that Hikvision had not fixed a separate password-in-configuration-file flaw; it also warned that gray-market cameras run firmware Hikvision did not make.[1437] In 2017 a researcher reported what he called a backdoor in Dahua devices, and IPVM verified that they let anyone download user names and password hashes; Dahua treated it as a vulnerability.[1468][1469] Hikvision's Hik-Connect privacy policy discloses that some of its staff in mainland China have limited remote access to user information for support.[1330]

Cloud links that open outbound connections by default are the more common risk (our reading). SEC Consult found that all Xiongmai devices, which many brands sell under their own names, shipped with the XMEye peer-to-peer cloud switched on, reachable even behind firewalls, and counted at least 9 million online in 2018.[1438] IPVM found in 2016 that many low-end Hikvision devices phoned home to Hik-Connect without the user's choice and warned that such a tunnel could serve as a reverse shell, though it observed no misuse.[1470] Hikvision's 2018 security guide says its platform access is now off by default (vendor claim).[1471] In October 2026 CERT-UA reported attacks on Dahua cameras through the Easy4IP cloud feature.[1472] A Thai brand's app uses a variant of the XMEye app's package name, which suggests, without proving, that its recorders use the XMEye cloud.[1473]

The traffic studies we found cover only consumer devices: a 2019 study of 81 consumer IoT devices found that 72 contacted a party other than the maker, and a 2025 study of 77 Chinese consumer devices, 29 of them cameras, found 23 of 40 validating TLS certificates improperly.[1474][1475] No published lab study shows a professional Hikvision or Dahua camera sending video to China.

Governments have acted on the risk without publishing technical findings. The United States bars new authorizations for Hikvision and Dahua surveillance equipment used for public safety and critical infrastructure.[1162][1476] The United Kingdom told departments to stop deploying such cameras on sensitive sites and to keep them off core networks.[1477] In Australia an audit found more than 900 units in Commonwealth buildings, and the defense minister said they would be assessed and removed while cautioning against overreacting.[1478][1479] India went furthest: its certification documents the origin of each camera's chip, tests for unauthorized remote access at accredited labs, and checks that chip and firmware do not come from countries bordering India; 507 models were certified by March 2026.[1480][1481]

What is not known is whether any camera in Thai state service sends anything abroad. Thailand has no camera-specific test scheme, and TCT's new mark is defined by where data is stored; its launch report describes no test of what a device sends.[1299] The measurement is feasible: capture each model's traffic through setup, use, idle, and update, and compare it with what ETSI EN 303 645 asks makers to declare.[1482]

A research program and budget

The four options answer different questions at very different cost (our model).

Source: model/camera_platform_results.md. None of the grants is promised.

Contain and watch

The first step needs no lab. On the camera networks of one district or municipality, the investor would block outbound traffic by default, answer cameras' DNS lookups from a sinkhole, and keep flow logs at the aggregation points, so that every attempt to reach the internet shows up (our design). An installer's list of the outbound ports Hik-Connect uses gives a first signature to look for.[1483] The result is a measured count of cameras that try to call out, for 1.0 to 2.4 million THB (our model).

A test lab with NECTEC

The lab tests every model in service, 20 to 40 in a large fleet (our estimate), with free tools: binwalk, EMBA, and Fraunhofer's FACT.[1484][1485][1486] NECTEC's Center for Cyber-Physical Systems offers IoT penetration tests that extract firmware through hardware ports, and its SQUAT lab tests IoT devices under ISO/IEC 17025 accreditation; neither publishes a price.[1487][1488] NECTEC and the Electrical and Electronics Institute have already tested 25 camera models for depa's dSURE label.[1489] Outside tests of the 5 to 10 critical models are priced at the published starting prices of USD 5,200 to 25,000 per device, which makes them the largest and least certain line.[1490]

Open firmware

OpenIPC (MIT) runs on chips from HiSilicon, Ingenic, SigmaStar, Novatek, and others, and thingino covers Ingenic cameras.[1491][1492][1493] The limits are serious. OpenIPC's core streamer, Majestic, carries no open-source license, so a fully readable build needs a replacement streamer.[1494] Makers swap chips within a model line without notice, so every batch needs a board check.[1495] A 2026 community report found a newer Hikvision model's bootloader locked behind Hikvision's signing key, and Axis cameras boot only Axis-signed firmware.[1496][1497] Open firmware therefore suits the cheaper Chinese-chip models that the lab flags, and it does not suit a whole mixed fleet (our judgment). For signed-firmware vendors, trust rests on the vendor's software bill of materials, which Axis has published since January 2023, and the lab's tests.[1498]

An own camera made in Thailand

A Thai camera is feasible on the ODM route with non-Chinese chips. NXP's i.MX 8M Plus has a 2.3 TOPS neural unit and 1080p60 H.265 encoding, Ambarella's CV25 is built for professional surveillance, and Sony's IMX678 is a 4K security sensor.[1499][1500][1501] Hana Microelectronics offers camera-module assembly and SVI builds finished products in Thailand, and Hanwha's camera plant in Vietnam shows a non-Chinese brand manufacturing in the region.[1502][1503][1504] A design house quotes USD 70,000 to a working prototype and USD 190,000 to mass production for a comparable Wi-Fi camera device, and an ODM guide puts certification at USD 2,000 to 25,000.[1505][1506] A wired PoE camera needs no NBTC radio approval, while a 4G model needs NBTC certification as Class B equipment (our reading).[1507] The price is the obstacle: a 2018 teardown put a consumer camera's manufacturing cost at USD 30.03 against a USD 29.99 retail price, which no small Thai batch can match.[1508]

Grants

NIA matches up to 75% of a thematic project (at most 5 million THB), half of testing costs (at most 1.5 million THB), and all of a trial with government customers (at most 2 million THB); NSTDA's ITAP pays half of an SME's project up to 400,000 THB.[1509][1510] None is guaranteed, and the R&D deduction of 3 times certified spending is left out because it is worth nothing until the company pays tax.[1511]

The sequence we recommend

Contain and watch comes first, because it costs the least and gives a fleet-wide answer within six months (our judgment). The lab follows, testing every model in service and sending the critical ones for outside tests. Open firmware comes third and only for models the lab flags whose chips OpenIPC or thingino support. An own camera comes last, only if the lab finds cause and an agency commits to buy.

Can the investor be Thailand's provider?

Procurement routes

The default buying route is open e-bidding.[1434] The specific method is open for purchases of no more than 500,000 THB.[1435] Samet municipality uses it to rent 186 cameras with equipment from NT in monthly orders of 312,579.10 THB, about 1,680 THB per camera (our arithmetic).[1440] The specific method also applies when only one operator is qualified, and to items declared state-promoted; the 2017 list names the War Veterans Organization's guard services and the power and water utilities, and NT is not on it.[1434][1436]

The Thai Innovation List is the strongest route for software. Listed goods and services may be bought directly from a single seller, and a listing lasts up to 8 years.[1436][1512] The government describes the rule as letting agencies buy listed innovations directly for at least 30% of their total need, and AI red-light software that runs on existing CCTV is already listed.[1513][1512] The applicant must be a registered company with at least 51% Thai shareholding, and the product must come from significant research and development in Thailand.[1514] In October 2026 the cabinet approved tighter criteria after a reform subcommittee found corruption and monopoly risks in the route.[1515] The investor's operating company would have to be Thai-majority to use this route; we do not know the investor's structure. In open tenders, SMEs win within 10% of the lowest price and Thai bidders beat foreign ones within 3%.[1516]

Rental precedents

Renting camera systems is normal in Thai government. An Interior Ministry guideline of 2018 lets agencies rent systems with maintenance included, as long as the rent does not exceed the purchase price plus services, and treats timed access to an internet system as software rental that needs the ministry's computer committee.[1517]

ISOC switched to renting because of staffing, maintenance, and performance problems.[1518] These contracts bundle cameras, network, and repair; none we found prices a management platform on its own (our reading).

Service levels and penalties

Thai tenders fine late or failed work at 0.10% of the contract value a day, about 45,600 THB a day on BMA's East zone, and ask for repairs within 24 to 48 hours.[1364][1523] A municipal rental tender, read from a scanned PDF, fines the lessor when a camera is not restored within 48 hours.[1524] We found no current Thai tender with a per-camera uptime clause. That gap is the investor's opening: a platform that measures availability and MTTR per camera lets an agency enforce the clauses TCSG describes, and the incumbents, who are the contractors being measured, are poorly placed to sell it (our judgment).

Qualifications

DGA's draft standard for cloud providers would let agencies use only listed providers; tier 1 asks for a Thai company with CSA STAR and ISO/IEC 20000, 27001, and 27701, and tier 2 adds ISO/IEC 27017 and 27018. It was still a draft in September 2025.[1525] The NCSC cloud security standard has applied since September 10, 2026, NCSA certifies providers through an on-site audit, and NT already claims the full set of certificates.[1526][1527] The draft data-center licensing bill, which has not been enacted, would require licensees to be Thai companies with at least half of their system-supervision staff Thai.[1303] A foreign-owned company needs no Foreign Business License to serve a government agency, so the binding ownership tests are DGA's tier 1, the Innovation List, and the bill if it passes (our reading).[1528] The BMA tenders we read name the PDPA and the Cybersecurity Act but no ISO certificate.[1364]

Partners

NT is both the obvious partner and a competitor: it rents cameras to municipalities by the specific method and runs the government cloud.[1440][1526] It also sells home CCTV with T3 Technology and runs a Huawei operations center with smart poles for Pattaya and the EEC.[1529][1530] A platform behind NT's rentals would let NT offer measured service levels without building the software (our judgment). depa certified 37 smart cities by August 2025 and targets 105 by 2027, gives its City Data Platform free to local bodies, and subsidized local governments in FY2026 to adopt SaaS listed in the Thailand Digital Catalog.[1531][1532][1533] NECTEC is the partner for the camera tests.

Incumbents

Forth's Genius Traffic System won at least 29 BMA camera projects worth 1,273.31 million THB in fiscal 2015 to 2022, and Forth's ForthMax venture signed a 930 million THB contract in May 2024 to upgrade the southern border's CCTV.[1380][1534] Samart's companies hold the largest rentals, for ISOC and the industrial estates.[1439][1519] Pineapple Vision Systems, a Thai firm on the Innovation List, built a camera-network platform for Provincial Police Region 4.[1535][1536] Gorilla Technology runs AI programs for the Tourist Police and announced an AI campus in Korat.[1389][1390]

Our verdict

The investor can become a significant provider of camera operations to Thai agencies, possibly the largest neutral one, and it cannot become Thailand's single provider (our judgment). No buyer exists for a national contract, and the 2020 guideline's central store has an unknown status (the CCTV note). The investor's strengths would be a vendor-neutral platform, measured service levels, logs that hold up, and storage and GPUs in its own building; its weaknesses are no track record with agencies, no field crews, no decade of relationships, and no data center before the second half of 2028. Moscow shows both sides of the end state: more than 164,000 of its 213,000 cameras run under service contracts, and 105,000 were connected to face recognition; the European Court of Human Rights found that using it to identify and arrest a peaceful protester breached the European Convention.[1537][1538] In Dubai the regulator requires covered premises to buy an approved health-monitoring service.[1539]

The numbers

All figures in this section are from our model (model/camera_platform_results.md).

Build

Engineers cost 80,000 to 150,000 THB a month, the rate in the rescue system note. The VMS adapters are the least certain lines, because the SDK terms of Mirasys, Nice Vision, and Gfin are not public.

Run cost per camera-month

The NOC is one seat around the clock and half an engineer per 10,000 cameras, and 10% to 40% of sites need a site box shared by 3.9 cameras (our estimates).

Price

The list price, 1.5 times the high-case cost at 10,000 cameras, is 390 THB (USD 11.8) per camera a month; fleets of 50,000 or more pay 180 THB (USD 5.5), set the same way at Bangkok's size. Storage, analytics, field repairs, and circuits are extra.

The list price sits below the per-camera cloud licenses of Verkada and Rhombus, and the volume price is about half of BMA's maintenance spending per camera.

Four cases

Cautious means high costs, 10% of cameras analyzed, and the high build cost; favorable means low costs, 20% analyzed, and the low build cost. Each fleet is treated as the platform's only customer. The storage line assumes every camera keeps 30 days at DC1, which BMA does not plan; all state cameras would need about 75 racks, more than hall B holds (the CCTV note). The fee alone covers the team, servers, and build from about 2,300 to 5,500 cameras at the list price and 5,500 to 18,200 at the volume price.

Bangkok against its current spending

Sources: BMA's open-contracting data and The Nation, through the model.[1378][1288]

The fee would have to come out of the maintenance and circuit budgets, so it must save a similar amount there to be affordable (our judgment). Moscow claims its service model saved up to 40% of budget funds, without a method.[1537]

Risks

• There is no national buyer. Every contract is a separate sale, and Bangkok's plans point toward recording in the cameras.[1376]
• NT is both the natural partner and a competitor, since it rents cameras, runs the government cloud, and sells home CCTV.[1440][1526][1529]
• The Innovation List requires a Thai-majority company and is being tightened after corruption and monopoly findings.[1514][1515]
• The incumbents are also the contractors the platform would measure, and they may resist sharing data from their recorders (our judgment).
• VMS makers may refuse or price their SDKs high, and BMA's programs have no public SDK terms (our reading).
• The agents' image checks have no published accuracy, so false alarms could flood the NOC until they are tuned in the pilot.
• A platform that sees every state camera is a target. CameraSwarm shows how attackers use old flaws, and the platform's own breach would be worse than any single camera's (our judgment).[1446]
• A provider associated with face recognition, as in Moscow, risks its reputation and its other tenants (our judgment).[1538]
• The camera research may find nothing, or may find a problem in models that agencies cannot afford to replace.
• DC1 opens between the second half of 2028 and the first half of 2029, after Thailand paused 166 data-center projects in September 2026 and set new rules in October.[315][497]

A staged plan

The first six months spend about 1 to 2.4 million THB on contain and watch, and the pilot carries most of the build cost of 8.2 to 24.9 million THB (our model).

What this means for the investor

There is no national contract to win, so the realistic goal is to become the operator that many Thai agencies trust with their cameras, one contract at a time. The platform is small next to DC1: 8.2 to 24.9 million THB to build (our model).

The platform pays only with scale. A single municipality of 1,000 cameras loses money on its own, the list price covers the team and the build from about 2,300 to 5,500 cameras, and Bangkok alone would bring about 140 million THB a year at the volume price (our model). The first contracts therefore matter more for the evidence they produce than for their revenue.

The camera-trust research gives agencies a reason to work with the investor before any platform contract. Nobody in Thailand measures what state cameras send, and a contained network plus a lab with NECTEC would answer it for 4.5 to 16.5 million THB before grants (our model).

The company structure must come first. The Innovation List needs 51% Thai shareholding, DGA's draft tiers need a Thai company, and the draft licensing bill would add Thai staff rules; the investor should settle this before any tender (our judgment).

The pitch to an agency is measured service: availability and repair times per camera, logs that hold up, and a neutral party between the agency and its contractors. The pitch should never be surveillance of people, and the agents should never be given that job.

Open questions