Most days, Marc Hofer, a cybersecurity researcher and journalist based in Amsterdam, trawls the internet for clues about how China surveils its citizens, a subject that has fascinated him since he worked there as a foreign correspondent.

大多数日子里，常驻阿姆斯特丹的网络安全研究员兼记者马克·霍弗都会在互联网上搜寻有关中国如何监控本国公民的线索，这是他之前担任驻华记者时便产生浓厚兴趣的课题。

Mr. Hofer, 46, was doing his usual scan earlier this year when he came across something called “Dynamic Control Platform for Overseas Personnel.” It was a futuristic dashboard — like something from the movie “Minority Report” — that appeared to track foreigners in the northern Chinese city of Zhangjiakou, a popular skiing spot that co-hosted the 2022 Winter Olympics.

今年早些时候，当他像往常一样进行搜索时，46岁的霍弗发现了一个名为“境外人员动态管控平台”的系统。那是一个充满未来感的控制面板——看起来就像电影《少数派报告》里的东西，似乎用于追踪中国北方城市张家口的外国人。张家口是著名的滑雪胜地，也是2022年冬奥会的联合举办城市。

The system’s dashboard said it tracked more than 700 foreign residents living in the city. In total, it had entries for nearly 12,000 people, which included fugitives, people from Hong Kong and Taiwan, as well as more than 300 foreign journalists. Some of them had not been to Zhangjiakou.

系统的控制面板显示，该平台追踪着逾700名在张家口定居的外籍人士，数据库中共收录了近1.2万条记录，包括在逃人员、港台人士，以及300余名外国记者。其中一些人从未去过张家口。

Suddenly, Mr. Hofer saw his own face — in a photograph taken by Chinese immigration officials for their records. Next to it was his passport number and the cellphone number he had used in China.

突然，霍弗看到了自己的脸——那是一张中国出入境管理人员为留档而拍摄的照片。照片旁边还有他的护照号码，以及他在中国时使用过的手机号。

外国记者的信息条目

He was floored. “Whoever put that stuff in there had access to real data,” he recalled. He also noticed a list of users who had recently logged into the site — it included the names of police stations in Zhangjiakou and other cities.

他目瞪口呆。“把这些东西放进去的人是能够接触到真实数据的，”他回忆道。他还注意到一份最近登录该网站的用户名单，其中包括张家口及其他城市的派出所。

China monitors its 1.4 billion people on an unparalleled scale, with the help of cameras, cellphone signals and national IDs. The database Mr. Hofer found offered a rare window into how extensively the Chinese authorities also surveil foreigners, displaying entries about people categorized by nationality, with their birth date, sex, marital status, address and occupation, and sometimes their religion.

借助摄像头、手机信号和居民身份证，中国对14亿人口实施着规模空前的监控。霍弗发现的这个数据库为外界提供了一个难得的窗口，得以一窥中国当局对外籍人员的监控范围之广——数据库按国籍对人员进行分类，内容包含出生日期、性别、婚姻状况、住址和职业，有时还记录宗教信仰。

It also included instances when they were captured on camera at traffic intersections, markets, shopping malls or other locations, including a mosque.

系统还记录了他们在交通路口、市场、购物中心或其他场所（包括一座清真寺）被摄像头拍到的影像。

Chinese companies hoping to sell their surveillance platforms to the police often create demo web pages that use photos and information about people taken from social media. This was different, Mr. Hofer said: “This is more than some guys playing around, or a student, or a low-level project.”

那些希望把监控平台卖给警方的中国企业经常会创建演示网页，并配以从社交媒体上抓取的人物照片和信息。但这个系统不一样，霍弗说：“这不是什么人在随便玩玩，也不像是学生或小项目能做出来的东西。”

That day, in January, he began downloading as much data as possible from the site. By May, it had been taken offline.

从1月发现之日起，他便开始从该网站下载尽可能多的数据。到5月，该网站下线。

Designed for the Police

为警方打造

The New York Times found links between the platform and Origin Dynamic, a Beijing company that provides robotics, surveillance services and equipment to the police, according to public tender documents.

《纽约时报》根据公开招标文件发现，该平台与北京的长源动力科技有限公司存在关联。这家公司向警方提供机器人技术、监控服务和设备。

Origin Dynamic had filed a patent application in 2023 for a similar system, which it described as an “information interface for non-Chinese citizens” and was nearly identical to the Zhangjiakou platform in its design and functions. The company is owned in part by the city government of Yancheng in Jiangsu Province.

长源动力在2023年为一个类似系统申请了专利，将其描述为“外籍人员信息界面”，其设计和功能与张家口平台几乎完全相同。该公司部分股权由江苏省盐城市政府持有。

Origin Dynamic and the Zhangjiakou Public Security Bureau did not respond to requests for comment sent by email and fax.

长源动力和张家口市公安局均未回应通过电子邮件和传真发送的置评请求。

Mr. Hofer, who shared the data he saved with The Times, believed that the dashboard had been designed for the Zhangjiakou Public Security Bureau, the city’s police department. It included information that only the Chinese authorities would have had access to, and the user log that Mr. Hofer saw listed eight police stations in Zhangjiakou and three from other cities.

霍弗将他保存的数据分享给了《纽约时报》。他认为该平台是为张家口市公安局设计的。其中包含只有中国的有关部门才能获取的信息，而他看到的用户日志中列出了张家口的八个派出所及其他城市的三个派出所。

It was not clear how, or if, the police have used the database in their work. But its existence illustrates how the Chinese authorities aggregate vast amounts of data from surveillance cameras, medical records, bills, facial-recognition tools and other sources to monitor and analyze the behavior of foreign residents. It had fields for places they frequented, hospital visits and gas payments, as well as flights and trains taken, including seat numbers.

目前尚不清楚警方是否或如何在工作中使用该数据库。但它的存在表明，中国的有关部门将来自监控摄像头、医疗记录、账单、人脸识别工具及其他渠道的海量数据整合起来，用以监控和分析外国居民的行为。数据库中包含常去地点、就医记录和加油付款记录等，还有乘坐过的航班和火车，包括座位号等信息。

For example, it logged the movements of a woman from Mongolia as she went from a residential compound in Zhangjiakou to shopping malls, restaurants and supermarkets. In some instances, the database indicated, she had been tracked using facial recognition.

例如，数据库记录了一名蒙古国女性的活动轨迹：她从张家口的一处住宅小区前往购物中心、餐馆和超市。数据库显示，她的部分行踪是通过人脸识别技术追踪到的。

Under Xi Jinping, the ruling Chinese Communist Party has overseen a drive to use big data in the name of public safety to stamp out dissent and prevent potential terrorist attacks.

习近平执政以来，中共以公共安全为名，大力推动利用大数据开展监控，以压制异议、防范潜在的恐怖袭击。

Other countries employ similar kinds of surveillance systems, but in China, there is little protection against police overreach, according to Maya Wang, the deputy Asia director at Human Rights Watch.

其他国家也在使用类似的监控系统，但人权观察亚洲事务副主任王亚秋表示，在中国，几乎没有能防止警察滥用权力的机制。

“That kind of integration of data is really quite unprecedented and illustrates China’s lack of safeguards,” Ms. Wang said.

“这种数据整合程度确实前所未有，也凸显了中国在防护机制方面的缺失，”王亚秋表示。

An Unsecured Platform

一个没有安全防护的平台

When Mr. Hofer first came across the platform’s login page, a username and password had already been filled in. The fact that a system with sensitive personal information on hundreds of people was accessible to anyone who could find it on the internet suggested a major lack of privacy protections.

霍弗第一次看到这个平台的登录页面时，用户名和密码已经自动填好。一个包含数百人敏感个人信息的系统竟然可以被任何能在网上找到它的人访问，这表明该系统在隐私保护方面存在严重缺陷。

Greg Walton, a cybersecurity researcher who has studied similar Chinese systems, said the exposure of this one was not an anomaly. It was a consequence of China’s “surveillance sprawl,” which is fueled by an expanding ecosystem of vendors, contractors and public security agencies, he said.

曾研究过类似中国系统的网络安全研究员格雷格·沃尔顿表示，此次曝光事件并非孤例。他认为，这是中国“监控泛滥”的后果，而供应商、承包商和公安部门不断扩张的生态系统正在推波助澜。

Mr. Walton, a senior investigator at the SecDev Group, a Canadian research firm, said that each new platform “increases the number of places where sensitive personal data can be misconfigured, copied or left externally discoverable.”

沃尔顿是加拿大研究公司SecDev Group的高级调查员。他指出，每新增一个平台，“就意味着又多了一个敏感个人数据可能被错误配置、被复制或暴露给外部的地方。”

The Times verified that data in the entries for six people besides Mr. Hofer was accurate. A Times reporter who used to be based in Beijing was in it, listed in an entry that included the name of her child. Her name was misspelled, but her passport and other information were correct.

《纽约时报》核实了除霍弗外六人的条目信息，确认数据均属实。时报一位曾驻北京记者的信息也在其中，条目中还包含她孩子的姓名。她的名字拼写有误，但护照及其他信息均正确。

Work on the Zhangjiakou system appeared to have started in 2021, and changes were made to it as recently as April, according to Mr. Hofer, who has documented his findings in a Substack newsletter. Several fields in the database were empty or filled with dummy text, suggesting it was still under construction.

霍弗表示，张家口系统的开发工作似乎始于2021年，最近一次修改是在今年4月。数据库中的一些字段为空，或者填入了占位符，这表明该系统当时可能仍在建设之中。他在Substack平台上的新闻通讯中记录了自己的调查发现。

Residents were tracked on cameras in public locations, but the platform also pulled from sources not directly connected to the police. It had a list of foreigners and Chinese citizens who had visited the city’s Thaiwoo Ski Resort, including photos of them taken there, their full names and passport numbers.

居民的行踪在公共场所被摄像头追踪，但该平台的数据来源并不仅限于警方。数据库中有一份外籍人士和中国公民曾到访张家口太舞滑雪小镇的名单，包括他们在那里被拍摄下来的照片、全名和护照号码。

Sorting by Country and Religion

按国籍和宗教分类

The platform labeled people from Australia, Canada, New Zealand, the United Kingdom or the United States as being in the “Five Eyes Alliance.” That is a reference to the intelligence-sharing agreement between the five countries that Beijing frequently criticizes as promoting Cold War-style divisions.

该平台将来自澳大利亚、加拿大、新西兰、英国或美国的人标记为“五眼联盟”成员。五眼联盟是这五国间的情报共享协议，北京经常批评这一联盟助长类似冷战时期的阵营对立。

It also highlighted residents from what it called “key countries” — a list that included Egypt, Iran, Israel, Morocco, Pakistan and Sudan.

平台还标注了来自所谓“重点国家”的居民——名单包括埃及、伊朗、以色列、摩洛哥、巴基斯坦和苏丹。

Visitors from Hong Kong, home to widespread anti-Beijing protests in 2019, and Taiwan, a self-governing democracy that China claims as its own, had their own categories. The database also tracked international students, foreign spouses and “key persons,” a euphemism often used by the Chinese authorities to refer to activists or fugitives, or others deemed to be threats to social stability.

来自香港（2019年曾爆发大规模反北京抗议活动）和台湾（中国声称拥有主权的自治民主政体）的访客被单列出来。数据库还追踪留学生、外籍配偶以及“重点人员”——后者是中国的有关部门常用的委婉说法，用于指代活动人士、在逃人员或其他被视为对社会稳定构成威胁的人。

Many of the foreign students listed appeared to be from Pakistan and India and were studying at Hebei North University in Zhangjiakou. Profiles of the students included their religion, marital status, focus of study and times they had been captured on cameras at the school’s entrances.

数据库中列出的许多外国学生似乎来自巴基斯坦和印度，就读于张家口的河北北方学院。这些学生的个人档案包括宗教信仰、婚姻状况、所学专业，以及他们在学校入口处被摄像头拍到的次数。

The platform also claimed to be able to map a person’s relationship network. An illustration of the function showed the names of three Pakistani men in their 20s, linking them to one another after they were captured on camera together.

该平台还声称能够绘制个人的关系网络。一项功能示意图展示了三名20多岁的巴基斯坦男性的姓名，因被摄像头同框拍到而将他们关联到一起。

人员关系网

One set of entries that Mr. Hofer downloaded included names of residents who had been penalized under Chinese law. It showed one woman who had been fined 1,000 Chinese yuan (about $150) in 2021, for example, for not registering a change of address. Other examples included foreigners who had been cited for teaching without required licenses.

霍弗下载的一组数据中，还包括一些因违反中国法律而受到处罚的居民姓名。例如，其中一名女子在2021年因未登记住址变更而被罚款1000元人民币。其他案例还包括一些因无证从事教学活动而受到处罚的外国人。

The information appeared to have been entered by an official at the Zhangjiakou police station named Zhang Jinglong, according to files downloaded by Mr. Hofer that listed him as a contributor.

根据霍弗下载的文件，这些信息似乎由张家口公安局一个名叫张经龙的警官录入，文件将其列为信息录入者。

An official by that name was profiled by the Zhangjiakou police in 2020. He was praised for monitoring discussions online and actively participating in them to “guide citizens to establish correct” views.

2020年，张家口警方曾对一位同名警官进行过宣传报道，称赞他积极监控网络舆论并主动介入，以“引导群众树立正确”观念。

Last year, an artificial intelligence lab in the police bureau was named for him.

去年，该市公安局以他的名字命名了一个人工智能实验室。