Chinazism

China Sharpens Hacking to Hound Its Minorities, Far and Wide
By Nicole Perlroth, Kate Conger and Paul Mozur

Uighur teenagers on their phones in Kashgar in China’s East Turkestan colony. Chinese hackers have secretly monitored the cellphones of Uighurs and Tibetans around the globe.

SAN FRANCISCO — China’s state-sponsored hackers have drastically changed how they operate over the last three years, substituting selectivity for what had been a scattershot approach to their targets and showing a new determination by Beijing to push its surveillance state beyond its borders.
The government has poured considerable resources into the change, which is part of a reorganization of the national People’s Liberation Army that Xi Jinping initiated in 2016, security researchers and intelligence officials said.
China’s hackers have since built up a new arsenal of techniques, such as elaborate hacks of iPhone and Android software, pushing them beyond email attacks and the other, more basic tactics that they had previously employed.
The primary targets for these more sophisticated attacks: China’s ethnic minorities and their diaspora in other countries, the researchers said. 

In several instances, hackers targeted the cellphones of a minority known as Uighurs, whose home region, East Turkestan, has been the site of a vast build-out of surveillance tech in recent years.
“The Chinese use their best tools against their own people first because that is who they’re most afraid of,” said James A. Lewis, a former United States government official who writes on cybersecurity and espionage for the Center for Strategic Studies in Washington. 

“Then they turn those tools on foreign targets.”
China’s willingness to extend the reach of its surveillance and censorship was on display after an executive for the National Basketball Association’s Houston Rockets tweeted support for protesters in Hong Kong this month. 

The response from China was swift, threatening a range of business relationships the N.B.A. had forged in the country.
In August, Facebook and Twitter said they had taken down a large network of Chinese bots that was spreading disinformation around the protests. 

And in recent weeks, a security firm traced a monthslong attack on Hong Kong media companies to Chinese hackers. 

Security experts say Chinese hackers are very likely targeting protesters’ phones, but they have yet to publish any evidence.

A security checkpoint with facial recognition technology in Hotan in East Turkestan.

Security researchers said the improved abilities of the Chinese hackers had put them on a par with elite Russian cyberunits. 

And the attacks on cellphones of Uighurs offered a rare glimpse of how some of China’s most advanced hacking tools are now being used to silence or punish critics.
Google researchers who tracked the attacks against iPhones said details about the software flaws that the hackers had preyed on would have been worth tens of millions of dollars on black market sites where information about software vulnerabilities is sold.
On the streets in East Turkestan, huge numbers of high-end surveillance cameras run facial recognition software to identify and track people. 

Specially designed apps have been used to screen Uighurs’ phones, monitor their communications and register their whereabouts.
Gaining access to the phones of Uighurs who have fled China — a diaspora that has grown as many have been locked away at home — would be a logical extension of those total surveillance efforts. Such communities in other countries have long been a concern to Beijing, and many in East Turkestan have been sent to camps because relatives traveled or live abroad.
The Chinese police have also made less sophisticated efforts to control Uighurs who have fled, using the chat app WeChat to entice them to return home or to threaten their families.
China’s Ministry of Foreign Affairs did not respond to a request for comment. 

Security researchers recently discovered that the Chinese used National Security Agency hacking tools after apparently discovering an N.S.A. cyberattack on their own systems. 

And several weeks ago, a Chinese security firm, Qianxin, published an analysis tying the Central Intelligence Agency to a hack of China’s aviation industry.

Xi Jinping visiting President Barack Obama in 2015. Their agreement to halt certain cyberoperations gave China time to hone its abilities.

Breaking into iPhones has long been considered the Holy Grail of cyberespionage. 

“If you can get inside an iPhone, you have yourself a spy phone,” said John Hultquist, director of intelligence analysis at FireEye, a cybersecurity firm.
The F.B.I. couldn’t do it without help during a showdown with Apple in 2016. 

The bureau paid more than $1 million to an anonymous third party to hack an iPhone used by a gunman involved in the killing of 14 people in San Bernardino, Calif.
Google researchers said they had discovered that iPhone vulnerabilities were being exploited to infect visitors to a set of websites. 

Although Google did not release the names of the targets, Apple said they had been found on about a dozen websites focused on Uighurs.
“You can hit a high school student from Japan who is visiting the site to write a research report, but you are also going to hit Uighurs who have family members back in China and are supporting the cause,” said Steven Adair, the president and founder of the security firm Volexity in Virginia.
The technology news site TechCrunch first reported the Uighur connection. 

A software update from Apple fixed the flaw.
In recent weeks, security researchers at Volexity uncovered Chinese hacking campaigns that exploited vulnerabilities in Google’s Android software as well. 

Volexity found that several websites that focused on Uighur issues had been infected with Android malware. 

It traced the attacks to two Chinese hacking groups.
Because the hacks targeted Android and iPhone users — even though Uighurs in East Turkestan don’t commonly use iPhones — Mr. Adair said he believed that they had been aimed in part at Uighurs living abroad.

An analyst at FireEye. “If you can get inside an iPhone, you have yourself a spy phone,” said John Hultquist, the company’s director of intelligence analysis.

“China is expanding their digital surveillance outside their borders,” he said. 

“It seems like it really is going after the diaspora.”
Another group of researchers, at the Citizen Lab at the Munk School of Global Affairs at the University of Toronto, recently uncovered an overlapping effort, using some of the same code discovered by Google and Volexity. 

It attacked the iPhones and Android phones of Tibetans until as recently as May.
Using WhatsApp messages, Chinese hackers posing as New York Times reporters and representatives of Amnesty International and other organizations targeted the private office of the Dalai Lama, members of the Tibetan Parliament and Tibetan nongovernmental organizations, among others.
Lobsang Gyatso, the secretary of TibCERT, an organization that works with Tibetan organizations on cybersecurity threats, said in an interview that the recent attacks were a notable escalation from previous Chinese surveillance attempts.
For a decade, Chinese hackers blasted Tibetans with emails containing malicious attachments, Mr. Lobsang said. 

If they hacked one person’s computer, they hit everyone in the victim’s address books, casting as wide a net as possible. 

But in the last three years, Mr. Lobsang said, there has been a big shift.
“The recent targeting was something we haven’t seen in the community before,” he said. 

“It was a huge shift in resources. They were targeting mobile phones, and there was a lot more reconnaissance involved. They had private phone numbers of individuals, even those that were not online. They knew who they were, where their offices were located, what they did.”
Adam Meyers, the vice president of intelligence at CrowdStrike, said these operations were notably more sophisticated than five years ago, when security firms discovered that Chinese hackers were targeting the phones of Hong Kong protesters in the so-called Umbrella Revolution.

The attacks on iPhones, which Uighurs in East Turkestan don’t typically use, suggested that Uighurs abroad were among the targets, said Steven Adair, president of Volexity.

At the time, Chinese hackers could break only into phones that had been “jailbroken,” or altered in some way to allow the installation of apps not vetted by Apple’s official store. 

The recent attacks against the Uighurs broke into up-to-date iPhones without tipping off the owner.
“In terms of how the Chinese rank threats, the highest threats are domestic,” Mr. Lewis said. 

“The No. 1 threat, as the Chinese see it, is the loss of information control on their own population. But the United States is firmly No. 2.”
Chinese hackers have also used their improved skills to attack the computer networks of foreign governments and companies. 

They have targeted internet and telecommunications companies and have broken into the computer networks of foreign tech, chemical, manufacturing and mining companies. 

Airbus recently said China had hacked it through a supplier.
In 2016, Xi Jinping consolidated several army hacking divisions under a new Strategic Support Force, similar to the United States’ Cyber Command, and moved much of the country’s foreign hacking operation from the army to the more advanced Ministry of State Security, China’s main spy agency.
The restructuring coincided with a lull in Chinese cyberattacks after a 2015 agreement between Xi and President Barack Obama to cease cyberespionage operations for commercial gain.
“The deal gave the Chinese the time and space to focus on professionalizing their cyberespionage capabilities,” Mr. Lewis said. 

“We didn’t expect that.”
Chinese officials also cracked down on moonlighting in moneymaking schemes by its state-sponsored hackers — a “corruption” issue that Xi concluded had sometimes compromised the hackers’ identities and tools, according to security researchers.
While China was revamping its operations, security experts said, it was also clamping down on security research in order to keep advanced hacking methods in house. 

The Chinese police recently said they planned to enforce national laws against unauthorized vulnerability disclosure, and Chinese researchers were recently banned from competing in Western hacking conferences.
“They are circling the wagons,” Mr. Hultquist of FireEye said. 

“They’ve recognized that they could use these resources to aid their offensive and defensive cyberoperations.”

China's Final Solution to the Muslim Question

China is secretly imprisoning over one million Muslims — but they've left 2 big pieces of evidence behind

• More than one million Muslims have been caught up in China's "re-education camps" over the last year.
• The camps, which operate outside the courts, are designed to indoctrinate ethnic minority Uighurs and force them to reject their religious beliefs.
• Bids for constructing or renovating these centers, as well as staff job ads, provide clear evidence of the purpose and scale of these re-education programs.
• Uighurs face constant surveillance in East Turkestan, which experts consider a testing ground for the a wider surveillance state.

By Tara Francis Chan
Uighur security personnel patrol near the Id Kah Mosque in Kashgar in western China's Xinjiang region.

In East Turkestan, many locals read endlessly, write often, and sing loudly.
But not by choice.
In extrajudicial indoctrination camps around Xinjiang, ethnic Uighur men and women are forced to study Chinese history, write personal reflections, and sing songs like "Without the Communist Party, there is no New China." 

Many are beaten, tortured, and are unable to go home.
China considers this process "re-education." 

It runs outside the court system with people dragged away for infringements like talking to a loved one overseas or having a beard, and there is no course for appeal.
A recent estimate put the number of people who have been, or are currently, interned since April 2017 just over one million.
Though the exact total is unknown, Adrian Zenz, a social researcher at the European School of Culture and Theology, pored over local job ads and government bids to find new evidence of the system's existence and scale.
Old town of Kashgar, in East Turkestan

Since 2016, there were government bids to construct or upgrade 73 facilities in East Turkestan that, despite various names, appeared as though they will operate, wholly or at least in part, as re-education centers.
Re-education centers are often disguised as vocational training hubs, as many were in these bids, but the details betray their hidden purpose.
Together, the facilities required guard rooms, video surveillance, security fences, police equipment, police living quarters, handheld security inspection devices, steel-reinforced concrete walls, and even iron chains.
"Many of these facilities are heavily secured, to an extent that they do not just aim to keep potential intruders out, but to keep those inside under tight surveillance." Zenz told Business Insider.
Twenty bids listed new or upgraded monitoring or video surveillance. 

One bid from January wanted 122 cameras to cover the whole facility without leaving any "dead angles."
One center required security nets, the renovation of a guard room, and "four watchtowers." 

Another, submitted on 25 April, requested an 86,000 square-foot "underground facility."
These security features, according to Zenz, confirm reports that vocation centers frequently function as internment camps, though many facilities likely sit on a continuum.
"All we know is that a substantial number of facilities, likely capable of holding at least several hundred thousand, are geared more towards the re-education side. Some are explicitly and directly marked as re-education facilities. More than likely, facilities with a stronger vocational training focus can likewise hold several hundred thousands," said Zenz.

"Some even specifically state that they are designed to perform 're-education.' 

An official government notice from April 2017 pertaining to these facilities in a particular prefecture mandated that training topics include military drill, Chinese language, legal knowledge, ethnic unity, religious knowledge and patriotic education."

A policeman holding shield and baton guards a security post leading into a center believed to be used for re-education in Korla in East Turkestan on Nov. 2, 2017.

Job ads are also a huge giveaway
As easy as it may be to silently whisk away thousands of people to new re-education centers, skyrocketing prisoner would also require a huge recruitment drive.
According to Zenz, from May 2017, counties with large ethnic minority populations "initiated a wave of recruitments" for so-called education and training centers.
But ads for such staff were often listed in the same ads as open police positions, and some ads even preferred recruitees with a military or police background.
Other job ads conflated the two roles, hiring "training center policing assistants." 

If the staff were being hired to work at a regular vocation center the high number of security personnel would be "difficult to explain," said Zenz.
Ads also frequently lacked required skills or qualifications that would normally be crucial to providing vocational training. 

Many required only a middle-school education whereas other provinces, where few Uighur would live, usually require at least a bachelor degree.
In one East Turkestan county, where Uighurs make up 95% of the population, 320 jobs available at a "training center" had three criteria: have a middle-school education, be loyal to the Chinese Communist Party, and be part of the ethnic majority Han.
An Uighur woman protests in front of policemen on July 7, 2009 in Urumqi, the capital East Turkestan

Re-education isn't the only problem Uighurs face
In an attempt to crack down on religion, authorities in East Turkestan have targeted almost any form of religious expression by Uighur Muslims.
Women have been banned from wearing burqas and veils. 

Residents were barred from fasting during Ramadan with restaurants ordered to stay open despite religious obligations. 

And in 2016, millions of East Turkestan residents were ordered to surrender their passports and must seek permission to travel abroad.
Authorities have installed surveillance apps on residents' phones and begun collecting DNA samples, fingerprints, iris scans, and blood types from all East Turkestan residents aged between 12 and 65. 

They have also collected voice samples that may be used to identify who is speaking on tapped phone calls.
There's also 40,000 facial-recognition cameras that are being used to track, and block, the movement of Uighurs in the region.
East Turkestan is considered by experts to be a testing ground for what the US State Department has described as "unprecedented levels of surveillance."
The concern is East Turkestan could also be a testing ground for a nationwide re-education system.

China’s New Frontiers in Dystopian Tech

Facial-recognition technologies are proliferating, from airports to bathrooms.

By Rene Chun

Dystopia starts with 23.6 inches of toilet paper. 

That’s how much the dispensers at the entrance of the public restrooms at Beijing’s Temple of Heaven dole out in a program involving facial-recognition scanners—part of the president’s “Toilet Revolution,” which seeks to modernize public toilets. 

Want more? 

Forget it. 

If you go back to the scanner before nine minutes are up, it will recognize you and issue this terse refusal: “Please try again later.”
China is rife with face-scanning technology worthy of Black Mirror. 

Don’t even think about jaywalking in Jinan, the capital of Shandong province. 

Last year, traffic-management authorities there started using facial recognition to crack down. 

When a camera mounted above one of 50 of the city’s busiest intersections detects a jaywalker, it snaps several photos and records a video of the violation. 

The photos appear on an overhead screen so the offender can see that he or she has been busted, then are cross-checked with the images in a regional police database. 

Within 20 minutes, snippets of the perp’s ID number and home address are displayed on the crosswalk screen. 

The offender can choose among three options: a 20-yuan fine (about $3), a half-hour course in traffic rules, or 20 minutes spent assisting police in controlling traffic. 

Police have also been known to post names and photos of jaywalkers on social media.
The system seems to be working: Since last May, the number of jaywalking violations at one of Jinan’s major intersections has plummeted from 200 a day to 20. 

Cities in the provinces of Fujian, Jiangsu, and Guangdong are also using facial-recognition software to catch and shame jaywalkers.
Across the country, other applications of the technology are proliferating. 

Many exist somewhere in the range between helpful and unsettling: A “smart boarding system” from the tech giant Baidu reduces airport check-in to a one-second face scan; at KFC China’s “smart restaurant” in Beijing, customers stand in front of a screen, have their face scanned (again, Baidu is part of the joint endeavor), and receive menu suggestions based on their age, sex, and facial expression (“crispy chicken hamburger,” roasted chicken wings, and a Coke for a 20-something male’s lunch; porridge and soy milk for a middle-aged woman’s breakfast). 

A female-only university dormitory has even employed facial recognition to keep nonresidents out.
The technology’s veneer of convenience conceals a dark truth: Quietly and very rapidly, facial recognition has enabled China to become the world’s most advanced surveillance state. 

A hugely ambitious new government program called the “social credit system” aims to compile unprecedented data sets, including everything from bank-account numbers to court records to internet-search histories, for all Chinese citizens. 

Based on this information, each person could be assigned a numerical score, to which points might be added for good behavior like winning a community award, and deducted for bad actions like failure to pay a traffic fine. 

The goal of the program, as stated in government documents, is to “allow the trustworthy to roam everywhere under heaven while making it hard for the discredited to take a single step.”

All sorts of data will feed into this new program, but facial recognition (along with gait analysis and voice recognition, also enabled by rapid advances in machine learning and cloud computing) has the potential to one day give it something like omniscience. 

China’s government and commercial sectors make available to each other the endless streams of personal information they gather. 

Because companies have access to vast amounts of consumer data, industry experts predict that in the coming months Chinese facial-recognition software will become even more accurate. 

Western companies may be exploiting the same machine-learning technology, but nobody is rolling it out like the Chinese.
According to Maya Wang, a senior researcher for Human Rights Watch’s Asia division, China’s domestic surveillance is far more advanced than most Chinese citizens realize. 

“People in China don’t know 99.99 percent of what’s going on in terms of state surveillance,” she says. 

“Most people think they can say what they want and live freely without being monitored, but that’s largely an illusion.”