China's surveillance platform exposing monitoring of foreign nationals in Zhangjiakou
An unencrypted Chinese surveillance platform monitoring foreign nationals in Zhangjiakou was discovered in early 2025 by a Dutch cybersecurity researcher who found his own personal data in the system. The platform tracked approximately 12,000 foreign individuals using integrated surveillance cameras, facial recognition, medical records, and transportation data, with minimal security protections and access available to multiple police stations.
What happened
In early 2025, Marc Hofer, a 46-year-old Dutch-based cybersecurity researcher, discovered his photograph, passport number, and phone number on China's "Dynamic Control Platform for Overseas Personnel" while searching online for information about Chinese surveillance of citizens. The platform was maintained by the Zhangjiakou Public Security Bureau and contained nearly 12,000 records of foreign nationals, including residents, journalists, students, and people who had never visited Zhangjiakou.
The platform tracked over 700 foreign residents in Zhangjiakou, a winter tourism destination and co-host of the 2022 Winter Olympics, and categorized individuals by nationality, including separate classifications for Taiwan and Hong Kong visitors. The system integrated surveillance camera footage, facial recognition technology, medical records, utility payment data, transportation records including aircraft and train seat numbers, and other sources to monitor foreign individuals.
Upon discovering the platform, Hofer found the login page with username and password pre-filled, indicating inadequate security measures. He began downloading data from January 2025 onwards; the website was taken offline by May 2025.
Reported impact
Hofer found his personal data and movement tracked, including records of him visiting shopping centers, restaurants, and other locations captured through facial recognition. The New York Times verified that seven individuals' records in the database were accurate, including a former Times correspondent stationed in Beijing whose children's names also appeared in the records.
Foreign nationals, including journalists and international students, had their personal information such as birth dates, sex, marital status, addresses, occupations, and sometimes religious beliefs recorded and used for tracking. The platform's categorization of individuals by nationality and designation of "key persons" (a Chinese government euphemism typically applied to activists, fugitives, and others deemed threats to social stability) facilitated discrimination based on citizenship.
Index analysis
According to public procurement documents, the platform was associated with Beijing-based company Origin Dynamic, which provides robots, surveillance services, and equipment to police. Origin Dynamic, which has partial ownership from Jiangsu Province's Yancheng municipal government, had applied for a patent in 2023 for a system described as "non-Chinese citizen information interface" with design and functionality nearly identical to Zhangjiakou's platform.
The platform's architecture demonstrated China's integration of previously separate data sources—surveillance cameras, healthcare records, payment data, facial recognition systems, and transportation records—to create comprehensive monitoring of foreign residents. Cybersecurity researcher Greg Walton noted that such data exposure is not exceptional but results from unrestricted expansion of surveillance systems driven by police demand and contractor proliferation.
Governance controls
The platform exhibited severe privacy protection deficiencies, with login credentials automatically pre-filled and access appearing available to personnel from at least 11 police stations across Zhangjiakou and other cities. The system contained data that only Chinese government agencies could access, yet had no effective mechanisms to prevent police abuse of authority.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.