How an exposed Chinese database gave a glimpse of real-time monitoring in Xinjiang
- Dutch cybersecurity researcher says facial recognition company was clueless about network security
The Chinese database Victor Gevers found online was not just a collection of old personal details.
It was a compilation of real-time data on more than 2.5 million people in western China, updated constantly with GPS coordinates of their precise whereabouts. Alongside their names, birth dates and places of employment, there were notes on the places that they had most recently visited – mosque, hotel, restaurant.
The discovery by Gevers, a Dutch cybersecurity researcher who revealed it on Twitter last week, has given a rare glimpse into China’s extensive surveillance of Xinjiang, a remote region home to an ethnic minority population that is largely Muslim. The area has been blanketed with police checkpoints and security cameras that apparently are doing more than just recording what happens.
The database Gevers found appeared to have been recording people’s movements tracked by facial recognition technology, he said, logging more than 6.7 million coordinates in 24 hours.
It illustrates how far China has taken facial recognition – in ways that would raise alarm about privacy concerns in many other countries – and serves as a reminder of how easily technology companies can leave supposedly private records exposed to global snoopers.
Gevers found that SenseNets, a Chinese facial recognition company, had left the database unprotected for months, exposing people’s addresses, government ID numbers and more. After Gevers informed SenseNets of the leak, the database became inaccessible, he said.