中國如何監控外國人（2/2）

Recently The New York Times reported the following:

How China Keeps Tabs on Foreigners (2/2)

An unsecured police dashboard was a rare window into how the authorities track foreigners by collecting and aggregating vast amounts of private data.

The NYT - By Lily Kuo and Pei-Lin Wu (Lily Kuo is a China correspondent for The Times, based in Taipei. Pei-Lin Wu is a reporter and researcher covering Taiwan and China for The Times.)

Aug. 2, 2026, 12:03 a.m. ET

(continue)

Under Xi Jinping, the ruling Chinese Communist Party has overseen a drive to use big data in the name of public safety to stamp out dissent and prevent potential terrorist attacks.

Other countries employ similar kinds of surveillance systems, but in China, there is little protection against police overreach, according to Maya Wang, the deputy Asia director at Human Rights Watch.

“That kind of integration of data is really quite unprecedented and illustrates China’s lack of safeguards,” Ms. Wang said.

An Unsecured Platform

When Mr. Hofer first came across the platform’s login page, a username and password had already been filled in. The fact that a system with sensitive personal information on hundreds of people was accessible to anyone who could find it on the internet suggested a major lack of privacy protections.

Greg Walton, a cybersecurity researcher who has studied similar Chinese systems, said the exposure of this one was not an anomaly. It was a consequence of China’s “surveillance sprawl,” which is fueled by an expanding ecosystem of vendors, contractors and public security agencies, he said.

Mr. Walton, a senior investigator at the SecDev Group, a Canadian research firm, said that each new platform “increases the number of places where sensitive personal data can be misconfigured, copied or left externally discoverable.”

The Times verified that data in the entries for six people besides Mr. Hofer was accurate. A Times reporter who used to be based in Beijing was in it, listed in an entry that included the name of her child. Her name was misspelled, but her passport and other information were correct.

Work on the Zhangjiakou system appeared to have started in 2021, and changes were made to it as recently as April, according to Mr. Hofer, who has documented his findings in a Substack newsletter. Several fields in the database were empty or filled with dummy text, suggesting it was still under construction.

Residents were tracked on cameras in public locations, but the platform also pulled from sources not directly connected to the police. It had a list of foreigners and Chinese citizens who had visited the city’s Thaiwoo Ski Resort, including photos of them taken there, their full names and passport numbers.

Sorting by Country and Religion

The platform labeled people from Australia, Canada, New Zealand, the United Kingdom or the United States as being in the “Five Eyes Alliance.” That is a reference to the intelligence-sharing agreement between the five countries that Beijing frequently criticizes as promoting Cold War-style divisions.

It also highlighted residents from what it called “key countries” — a list that included Egypt, Iran, Israel, Morocco, Pakistan and Sudan.

Visitors from Hong Kong, home to widespread anti-Beijing protests in 2019, and Taiwan, a self-governing democracy that China claims as its own, had their own categories. The database also tracked international students, foreign spouses and “key persons,” a euphemism often used by the Chinese authorities to refer to activists or fugitives, or others deemed to be threats to social stability.

Many of the foreign students listed appeared to be from Pakistan and India and were studying at Hebei North University in Zhangjiakou. Profiles of the students included their religion, marital status, focus of study and times they had been captured on cameras at the school’s entrances.

The platform also claimed to be able to map a person’s relationship network. An illustration of the function showed the names of three Pakistani men in their 20s, linking them to one another after they were captured on camera together.

One set of entries that Mr. Hofer downloaded included names of residents who had been penalized under Chinese law. It showed one woman who had been fined 1,000 Chinese yuan (about $150) in 2021, for example, for not registering a change of address. Other examples included foreigners who had been cited for teaching without required licenses.

The information appeared to have been entered by an official at the Zhangjiakou police station named Zhang Jinglong, according to files downloaded by Mr. Hofer that listed him as a contributor.

An official by that name was profiled by the Zhangjiakou police in 2020. He was praised for monitoring discussions online and actively participating in them to “guide citizens to establish correct” views.

Last year, an artificial intelligence lab in the police bureau was named for him.

Translation

中國如何監控外國人（2/2）

一個未加密的警方數據看板罕見地揭示了當局如何透過收集和匯總大量私人數據來追蹤外國人

  （繼續）

在習近平的領導下，執政的中國共產黨以公共安全的名義，大力推動利用大數據來鎮壓異議和預防潛在的恐怖攻擊。

人權觀察組織亞洲區副主任 Maya Wang 表示，其他國家也採用類似的監控系統，但在中國，幾乎沒有任何措施可以防止警方濫用權力。

Wang 說： “這種數據整合方式確實史無前例，也暴露出中國缺乏保障。”

一個不安全的平台

當 Hofer 先生第一次造訪該平台的登入頁面時，使用者名稱和密碼已預先填寫好了。一個包含數百人敏感個人資訊的系統竟然可以被任何能從網絡上找到它的人登入，這表明該平台在隱私保護方面存在嚴重缺陷。

曾研究過類似中國系統的網路安全研究員 Greg Walton 表示，這次外洩並非個别案例。他說，這是中國「監控網路擴張」的後果，而這種擴張是由不斷擴大的供應商、承包商和公共安全機構組成的生態系統所推動的。

Walton 先生是加拿大研究公司 SecDev Group 的高級研究員，他表示，每個新平台的出現「都會增加敏感個人資料可能被錯誤配置、複製或被外部發現」。

《紐約時報》核實了 Hofer 先生以外的六人的資訊記錄，證實其準確性。一位曾在北京工作的《紐約時報》記者也在其中，她的資訊記錄中包含了她孩子的名字。她的名字拼錯了，但她的護照和其他資訊是正確的。

據 Hofer 先生稱，張家口的系統似乎始於2021年，最近一次更新是在4月。Hofer先生在Substack的通訊中記錄了他的發現。資料庫中的幾個欄位是空着或填了佔位的虛擬符號，表明該系統仍在建設中。

居民的行踪是透過公共場所的攝影機進行追踪，但該平台也從一些與警方沒有直接聯繫的來源獲取資訊。它有一份曾經到訪張家口 Thaiwoo 滑雪場的外國人和中國公民的名單，包括在那裡拍攝到他們的照片、全名和護照號碼。

按國家和宗教分類

該平台將來自澳洲、加拿大、紐西蘭、英國或美國的人標記為「五眼聯盟」成員。這指的是五國之間的情報共享協議，北京經常批評該協議助長了冷戰式的分裂。

該資料庫還重點標註了來自所謂「重點國家」的居民，其中包括埃及、伊朗、以色列、摩洛哥、巴基斯坦和蘇丹。

來自香港（2019年爆發大規模反北京抗議活動的地區）和台灣（中國聲稱擁有主權的自治民主地區）的訪客則被單獨歸類。該資料庫還追蹤了國際學生、外籍配偶和「關鍵人物」。 「關鍵人物」是中國當局常用的委婉說法，通常用來指稱活動人士、逃犯或其他被認為對社會穩定構成威脅的人員。

許多被列入資料庫的外國學生似乎來自巴基斯坦和印度，就讀於張家口河北北方學院。學生的個人資料包括他們的宗教信仰、婚姻狀況、專業方向以及他們在學校入口處被監視器拍到的次數。

該平台還聲稱能夠繪製個人關係網絡圖。該功能的一個例子顯示了三名20多歲的巴基斯坦男子的名字，並將他們聯繫起來，因為他們曾被監視器拍到在一起。

Hofer 先生下載的一組記錄中包含了一些因違反中國法律而受到處罰的居民姓名。例如，其中顯示一名女性因未登記地址變更，於2021年被罰款1000元人民幣（約150美元）。其他例子還包括一些因無證授課而被處罰的外國人。

根據 Hofer 先生下載的文件顯示，這些資訊似乎是由張家口派出所一名名叫 Zhang Jinglong 的官員輸入的，文件將他列為資訊提供者之一。

2020年，張家口警方曾對一名同名官員進行專題通報。他因監控網絡討論並積極參與其中，以「引導公民樹立正確」觀點而受到表揚。

去年，公安局的一個人工智能實驗室以他的名字命名。

              So, Marc Hofer has come across something called “Dynamic Control Platform for Overseas Personnel” on the internet in China. It tracked foreigners in the northern Chinese city of Zhangjiakou. The system’s dashboard said it had the record of more than 700 foreign residents living in the city. In total, it had entries for nearly 12,000 people, which included fugitives, people from Hong Kong and Taiwan, as well as more than 300 foreign journalists. Apparently, China is monitoring the movement of foreigners in China.

Note:

1.  Substack is a website/platform where individual writers, journalists, researchers, and other people can publish articles regularly and send them to subscribers by email. (ChatGPT)