A cybersecurity researcher searching for evidence of China’s surveillance systems found something unexpected earlier this year when he discovered his own photograph, passport number and old Chinese mobile number in a database used to monitor foreign nationals.
Marc Hofer, the researcher who previously worked as a foreign correspondent in the country, discovered the information while examining how Chinese authorities track people. The website he accessed the ‘Dynamic Control Platform for Overseas Personnel’, a system that contained personal records of hundreds of foreigners living in Zhangjiakou, a city in northern China known for skiing and as a host city for the 2022 Winter Olympics.
The discovery showed the scale of information collected on foreigners living in China, including details about travel, medical visits, utility payments and movements captured through surveillance networks.
Hofer told The New York Times that the system reminded him of the science-fiction film ‘Minority Report’, where technology predicts and monitors people’s actions. He said the information in the database appeared to come from official sources rather than being random data collected online.
The platform contained records of more than 700 foreigners living in Zhangjiakou, with a total of nearly 12,000 entries. The database included details of wanted individuals, people from Hong Kong and Taiwan and more than 300 foreign journalists, including some who had never visited the city.
A database tracking everyday activities
The information stored in the system went far beyond basic identity records. It included details about where people travelled, medical appointments, gas payments, flights and train journeys, including seat numbers.
The platform also collected information from outside sources. One section contained details of visitors to the nearby Thaiwoo Ski Resort, including photographs, names and passport information of both foreign and Chinese visitors.
The database also classified people into different categories. Citizens from Australia, Canada, New Zealand, Britain and the United States were grouped under the label “Five Eyes Alliance”, referring to the intelligence-sharing partnership between those countries.
Another category listed people from countries including Egypt, Iran, Israel, Morocco, Pakistan and Sudan as belonging to “key countries”.
The system created separate folders for people from Hong Kong and Taiwan. It also listed foreign students, foreign spouses and a category called “key persons”, a term Chinese authorities use for individuals considered a potential security concern.
Many foreign students in the database were from Pakistan and India and were studying at Hebei North University in Zhangjiakou. Their files contained personal details such as religion, marital status, field of study and records of when surveillance cameras captured them entering the campus.
Links to Chinese surveillance company
The website disappeared by May after Hofer downloaded data from the platform in January. He said the system was not a simple experiment or a student project, pointing to the access records showing logins from several police stations in Zhangjiakou and nearby areas.
A review by The New York Times found connections between the platform and Beijing-based company Origin Dynamic through publicly available government tender documents. The company supplies robotics and surveillance equipment to police departments.
In 2023, the Origin Dynamic filed a patent for a similar system described in documents as an “information interface” for non-Chinese citizens. Part of the company is owned by local government officials in Yancheng, a city in Jiangsu Province.
It is not clear how the Chinese police used the database or whether all the information collected was actively monitored. However, the discovery shows how surveillance systems built around cameras, facial recognition, identity records and digital data collection can extend beyond Chinese citizens to foreigners living, studying or travelling in the country.
The platform also exposed security weaknesses. Anyone reaching the login page could find a username and password already filled in, allowing access to a database containing sensitive personal information. Some sections appeared unfinished, with empty fields and placeholder text suggesting that the system was still being developed.
