*A Surveillance Net Blankets China’s Cities, Giving Police Vast Powers
By Paul Mozur and Aaron Krolik
China is ramping up its ability to spy on its nearly 1.4 billion people to new and disturbing levels, giving the world a blueprint for how to build a digital totalitarian state.
Chinese authorities are knitting together old and state-of-the-art technologies — phone scanners, facial-recognition cameras, face and fingerprint databases and many others — into sweeping tools for authoritarian control, according to police and private databases examined by The New York Times.
Once combined and fully operational, the tools can help police grab the identities of people as they walk down the street, find out who they are meeting with and identify who does and doesn’t belong to the Communist Party.
The United States and other countries use some of the same techniques to track terrorists or drug lords. Chinese cities want to use them to track everybody.
The rollout has come at the expense of personal privacy. The Times found that the authorities parked the personal data of millions of people on servers unprotected by even basic security measures. It also found that private contractors and middlemen have wide access to personal data collected by the Chinese government.
This build-out has only just begun, but it is sweeping through Chinese cities. The surveillance networks are controlled by local police, as if county sheriffs in the United States ran their own personal versions of the National Security Agency.
By themselves, none of China’s new techniques are beyond the capabilities of the United States or other countries. But together, they could propel China’s spying to a new level, helping its cameras and software become smarter and more sophisticated. This surveillance push is empowering China’s police, who have taken a greater role in China under Xi Jinping, its top leader. It gives them a potent way to track criminals as well as online malcontents, sympathizers of the protest movement in Hong Kong, critics of police themselves and other undesirables. It often targets vulnerable groups like migrant workers — those who stream in from the countryside to fill China’s factories — and ethnic minority groups like the largely Muslim Uighurs on China’s western frontier.
“Each person’s data forms a trail,” said Agnes Ouyang, a technology worker in the southern city of Shenzhen whose attempts to raise awareness about privacy drew scrutiny from the authorities. “It can be used by the government and it can be used by bosses at the big companies to track us. Our lives are worth about as much as dirt.
People Pass and Leave a Shadow’
The police arrived one day in April to a dingy apartment complex in Zhengzhou, an industrial city in central China. Over three days they installed four cameras and two small white boxes at the gates of the complex, which hosts cheap hotels and fly-by-night businesses.
Once activated, the system began to sniff for personal data. The boxes — phone scanners called IMSI catchers and widely used in the West — collected identification codes from mobile phones. The cameras recorded faces.
On the back end, the system attempted to tie the data together, an examination of its underlying database showed. If a face and a phone appeared at the same place and time, the system grew more confident they belonged to the same person.
Over four days in April, the boxes identified more than 67,000 phones. The cameras captured more than 23,000 images, from which about 8,700 unique faces were derived. Combining the disparate data sets, the system matched about 3,000 phones with faces, with varying degrees of confidence.
This single system is part of a citywide surveillance network encompassing license plates, phone numbers, faces and social media information, according to a Zhengzhou Public Security Bureau database. Other Chinese cities are copying Zhengzhou. Since 2017, government procurement documents and official reports show that police in the Chinese provinces of Guizhou, Zhejiang and Henan have bought similar systems. Police in Zigong, a midsize city in Sichuan Province, bought 156 sets of the technology, the documents show. In Wuhan, police said in a procurement document that they wanted systems that could “comprehensively collect the identity of all internet users in public spaces, their internet behavior, their location, their movement, and identifying information about their phones.”
“People pass and leave a shadow,” reads one brochure promoting a similar surveillance system to Chinese police departments. “The phone passes and leaves a number. The system connects the two.”
Even for China’s police, who enjoy broad powers to question and detain people, this level of control is unprecedented. Tracking people so closely once required cooperation from uncooperative institutions in Beijing. The state-run phone companies, for example, are often reluctant to share sensitive or lucrative data with local authorities, said people with knowledge of the system.
Now local police are buying their own trackers. Improved technology helps them share it up the chain of command, to the central Ministry of Public Security in Beijing, the people said.
The surveillance networks fulfill a longtime goal of ensuring social stability, dating to the 1989 Tiananmen Square uprising but given added urgency by the Arab Spring in 2011 and 2012. In recent years, Chinese police made use of fears of unrest to win more power and resources.
It is not clear how well police are using their new capabilities, or just how effective they might be. But the potential is there.
In Zhengzhou, police can use software to create lists of people. They can create virtual alarms for when a person approaches a particular location. They can get updates on people every hour or every day. They can monitor whom those people have met with, especially if both people are on a blacklist for some kind of
infraction, from committing a crime to skipping a debt payment.
These networks could help China hone technologies like facial recognition. Cameras and software often have trouble recognizing faces shot at an angle, for example. Combined with phone and identity data, matches become easier to make, and the technology behind identifying faces gets better.
Police are not hiding their surveillance push. Even the perception of overwhelming surveillance can deter criminals and dissidents alike.
At the complex in Zhengzhou, residents were unfazed when told that the cameras and boxes were part of a sophisticated surveillance system.
The building manager, Liang Jianzheng, said it meant he no longer had to help the police fight crime.
“I used to have to bust my butt helping the police,” Mr. Liang said. “Now they have their own cameras, and they don’t bother me.”
In November, after The Times asked surveillance companies about the system, a construction crew appeared and took down the cameras and boxes, Mr. Liang said. They didn’t say why.
The Wire and Plywood Revolt
Some residents of the Shijiachi residential complex weren’t pleased when building management, at the behest of the police, last year replaced their old key card locks with a state-of-the-art surveillance system. Residents would now need to scan their faces to enter their buildings.
“Old people said they were always at home, so it wasn’t necessary,” said Tang Liying, the secretary of the Chinese Communist Party for the district in eastern China. “Young people had concerns about privacy, and didn’t think it was necessary. We did some work to persuade them, and in the end most people agreed.”
Those worried about privacy had a point.Data from the Shijiachi complex was parked on an unprotected server. Details included 482 residents’ identification numbers, names, ages, marital and family status, and records of their membership in the Communist Party. For those who used the facial-recognition cameras to enter and exit, it also stored a detailed account of their comings and goingsNearby networks were similarly unprotected. They held data from 31 residences in the area, with details on 8,570 people. A car-tracking system near Shijiachi showed records for 3,456 cars and personal information about their owners. Across China, unprotected databases hold information on students and teachers in schools, on online activity in internet cafes and on hotel stays and travel records.
Online data leakage is a major problem in China. Local media reports describe how people with access to the data sell private details to fraudsters, suspicious spouses and anyone else, sometimes for just a few dollars per person. Leaks have become severe enough that police created their own company that handles data directly, skirting third-party systems.
A wide number of people and companies have access to the data underlying China’s mandatory identification card system through legitimate means. Companies with police connections use faces
from ID cards to train facial-recognition systems. The card system also tracks fingerprints, faces, ethnicity and age.
A technology contractor called Shenfenbao, for example, had access to real-time records of every person staying in some 1,200 hotels in the southern city of Xiamen. In a demonstration, Lin Jiahong, a Shenfenbao salesman, searched one common name — a Chinese equivalent of “John Smith” — and came up with three guests, their hotels, room numbers, time of check-in, registered address, ethnicity and age.
“Through data on our platform, we can dig out all records of a particular person, and make a comprehensive analysis of the route of activities of this person,” said Mr. Lin, who added that his company also offered algorithms to flag women who check into multiple hotels in one night for suspicion of prostitution.
Signs of a backlash are brewing. In Shanghai, residents pushed back against a police plan to install facial-recognition cameras in a building complex. In Zhejiang Province, a professor filed a lawsuit against a zoo after it required mandatory facial-recognition scans for its members to get access.
In the Shijiachi residential complex, where the facial recognition replaced key card locks, the rebellion has been powered by wire and plywood. On a brisk day in November, the doors of a number of buildings had been propped open with crude doorstops, making facial scans unnecessary.
Terry Jin, a two-year resident of Shijiachi, said technology should not cross some lines.
“I think that facial recognition outside each building is fine,” Mr. Jin said. “If they put it outside my door, that wouldn’t be O.K.”