The mysterious database that provides clues to China’s foreign surveillance

Beijing: It goes with the territory that foreign journalists in China routinely question how closely the government monitors their activities.

Reporters swap stories of having travelled to regional or “sensitive” areas only to be met by police on arrival, sometimes even before checking into their hotel – something I experienced first hand when on assignment near the China-Russia border last year.

The Chinese security state hoovers up vast amounts of data, including via some 700 million CCTV cameras installed across the country, checkpoints at train stations, prolific use of facial recognition software, and requirements that hotels register foreigners with police.

Less clear is how sophisticated Chinese authorities are at pulling this data together to comprehensively track movements and surveil targets.

But a German cybersecurity journalist’s recent discovery of a prototype policing dashboard has helped piece together a picture of how it could work – and may already be working in some form in parts of China.

“Overall, I think this is the first time we have really seen the access and seen how it could work as a coherent system, even if this is just a demo of a test system,” Marc Hofer says in an interview after publishing his findings on his NetAskari substack blog last month.

Hofer unearthed the platform, which had been left unsecured on the open web, while poking around in the back end of sites affiliated with China’s Ministry of Public Security.

The dashboard was still in test mode but appeared to have been developed as a foreigner-tracking tool for the Public Security Bureau in Zhangjiakou, a city in Hebei province that hosted parts of the 2022 Winter Olympics.

It had a blue log-in page featuring the insignia of the Gong’an (Chinese police) and was titled “Dynamic Control Platform for Overseas Personnel”.

Hofer says he was able to connect to the dashboard and download some of the data. The dashboard gave an overview of the number of foreigners registered in the Zhangjiakou prefecture and their nationalities, and broadly pinned their locations at a district level on a map of the area.

But, more significantly, it had been pre-filled with several datasets with what appeared to be profiles of hundreds of real people.

This included profiles on the approximately 350 journalists based in Beijing in 2021, seemingly so they could be tracked if they crossed into Zhangjiakou for work or even visited as tourists.

Each profile contained a headshot of the reporter, and listed their news agency, their passport details, mobile phone numbers and dates of bi