China already tracks its 1.4 billion citizens through an enormous web of cameras, phone signals and national identity records. Now, the chance discovery by a cybersecurity researcher has shown how far that surveillance reaches when it comes to foreigners too.

Marc Hofer spends most of his days combing the internet for signs of how China watches its own people. It is a habit that began during his years there as a foreign correspondent. But nothing prepared him for the moment, earlier this year, when he opened an obscure website and found his own photograph staring back at him, alongside his passport number and a mobile number he had once used in the country.

China already tracks its 1.4 billion citizens through an enormous web of cameras, phone signals and national identity records. Now, the chance discovery by a cybersecurity researcher has shown how far that surveillance reaches when it comes to foreigners too, right down to their ski trips, hospital visits and gas bills.

The site called itself the Dynamic Control Platform for Overseas Personnel. Hofer told the New York Times it reminded him of the sci-fi film “Minority Report,” with screens built to follow the movements of foreigners in Zhangjiakou, a city in northern China better known for skiing and for sharing hosting duties at the 2022 Winter Olympics.

The tool had records on over 700 foreigners living in the city, and close to 12,000 entries altogether. Among the names were wanted individuals, people from Hong Kong and Taiwan, and upward of 300 foreign reporters, several of whom had never set foot in Zhangjiakou.

Hofer was stunned by what he saw. Speaking to the New York Times, he said whoever put the system together clearly had access to genuine information, not guesswork. He also noticed a record of recent logins, which listed several police stations across Zhangjiakou and beyond.

He was quick to rule out the idea that this was some kind of student project or a demo built by hobbyists. Once he understood what he had stumbled on, he spent that January day pulling down as much of the data as he could. By May, the whole site had vanished.

The New York Times found links between the platform and a Beijing firm called Origin Dynamic, which sells robotics and surveillance equipment to police departments, based on tender documents that are publicly available. In 2023, the same company had filed a patent for a system almost identical in design, calling it an “information interface” for non-Chinese citizens in the paperwork. Part of the company is owned by local government officials in Yancheng, a city in Jiangsu Province.

Whether the police actually put this database to use, and how, remains unclear. Still, its very existence shows something bigger: the lengths Chinese authorities go to when stitching together information from cameras, hospital files, utility payments and face-scanning software to keep tabs on the everyday lives of people living there who are not Chinese citizens. The system logged where people liked to go, when they visited a doctor, what they paid for gas, and even which flights or trains they had boarded, seat number included.

Anyone stumbling onto the login screen, as Hofer did, would have found a username and password already typed in for them. In other words, a database packed with private details on hundreds of people sat there for the taking, with barely any protection standing in the way. Parts of it were unfinished too, with blank fields or dummy text scattered throughout, a sign the system was still a work in progress.

Cameras were not the only source feeding the platform. It also drew on outside data, including a roster of everyone, foreign and Chinese alike, who had visited the Thaiwoo Ski Resort nearby, complete with photos, names and passport details.

The system sorted people from Australia, Canada, New Zealand, Britain and the United States into a single group it labelled the “Five Eyes Alliance,” borrowing the name of the intelligence-sharing arrangement between those nations, one that Beijing often paints as an outdated hangover from the Cold War.

Separately, it singled out residents from a group of nations it called “key countries,” a list that took in Egypt, Iran, Israel, Morocco, Pakistan and Sudan.

People from Hong Kong, where huge anti-government demonstrations broke out in 2019, and from Taiwan, which Beijing claims despite the island governing itself, each had their own separate folders. Students from abroad, foreign spouses, and a category the database called “key persons” also appeared, a phrase Chinese officials tend to use for activists, wanted individuals, or anyone else viewed as a risk to public order.

A good number of the foreign students turned out to be from Pakistan and India, enrolled at Hebei North University in Zhangjiakou. Their files went well beyond basic information, noting their religion, whether they were married, what they studied, and the exact moments cameras caught them entering the campus.