Chinazism

China Sharpens Hacking to Hound Its Minorities, Far and Wide
By Nicole Perlroth, Kate Conger and Paul Mozur

Uighur teenagers on their phones in Kashgar in China’s East Turkestan colony. Chinese hackers have secretly monitored the cellphones of Uighurs and Tibetans around the globe.

SAN FRANCISCO — China’s state-sponsored hackers have drastically changed how they operate over the last three years, substituting selectivity for what had been a scattershot approach to their targets and showing a new determination by Beijing to push its surveillance state beyond its borders.
The government has poured considerable resources into the change, which is part of a reorganization of the national People’s Liberation Army that Xi Jinping initiated in 2016, security researchers and intelligence officials said.
China’s hackers have since built up a new arsenal of techniques, such as elaborate hacks of iPhone and Android software, pushing them beyond email attacks and the other, more basic tactics that they had previously employed.
The primary targets for these more sophisticated attacks: China’s ethnic minorities and their diaspora in other countries, the researchers said. 

In several instances, hackers targeted the cellphones of a minority known as Uighurs, whose home region, East Turkestan, has been the site of a vast build-out of surveillance tech in recent years.
“The Chinese use their best tools against their own people first because that is who they’re most afraid of,” said James A. Lewis, a former United States government official who writes on cybersecurity and espionage for the Center for Strategic Studies in Washington. 

“Then they turn those tools on foreign targets.”
China’s willingness to extend the reach of its surveillance and censorship was on display after an executive for the National Basketball Association’s Houston Rockets tweeted support for protesters in Hong Kong this month. 

The response from China was swift, threatening a range of business relationships the N.B.A. had forged in the country.
In August, Facebook and Twitter said they had taken down a large network of Chinese bots that was spreading disinformation around the protests. 

And in recent weeks, a security firm traced a monthslong attack on Hong Kong media companies to Chinese hackers. 

Security experts say Chinese hackers are very likely targeting protesters’ phones, but they have yet to publish any evidence.

A security checkpoint with facial recognition technology in Hotan in East Turkestan.

Security researchers said the improved abilities of the Chinese hackers had put them on a par with elite Russian cyberunits. 

And the attacks on cellphones of Uighurs offered a rare glimpse of how some of China’s most advanced hacking tools are now being used to silence or punish critics.
Google researchers who tracked the attacks against iPhones said details about the software flaws that the hackers had preyed on would have been worth tens of millions of dollars on black market sites where information about software vulnerabilities is sold.
On the streets in East Turkestan, huge numbers of high-end surveillance cameras run facial recognition software to identify and track people. 

Specially designed apps have been used to screen Uighurs’ phones, monitor their communications and register their whereabouts.
Gaining access to the phones of Uighurs who have fled China — a diaspora that has grown as many have been locked away at home — would be a logical extension of those total surveillance efforts. Such communities in other countries have long been a concern to Beijing, and many in East Turkestan have been sent to camps because relatives traveled or live abroad.
The Chinese police have also made less sophisticated efforts to control Uighurs who have fled, using the chat app WeChat to entice them to return home or to threaten their families.
China’s Ministry of Foreign Affairs did not respond to a request for comment. 

Security researchers recently discovered that the Chinese used National Security Agency hacking tools after apparently discovering an N.S.A. cyberattack on their own systems. 

And several weeks ago, a Chinese security firm, Qianxin, published an analysis tying the Central Intelligence Agency to a hack of China’s aviation industry.

Xi Jinping visiting President Barack Obama in 2015. Their agreement to halt certain cyberoperations gave China time to hone its abilities.

Breaking into iPhones has long been considered the Holy Grail of cyberespionage. 

“If you can get inside an iPhone, you have yourself a spy phone,” said John Hultquist, director of intelligence analysis at FireEye, a cybersecurity firm.
The F.B.I. couldn’t do it without help during a showdown with Apple in 2016. 

The bureau paid more than $1 million to an anonymous third party to hack an iPhone used by a gunman involved in the killing of 14 people in San Bernardino, Calif.
Google researchers said they had discovered that iPhone vulnerabilities were being exploited to infect visitors to a set of websites. 

Although Google did not release the names of the targets, Apple said they had been found on about a dozen websites focused on Uighurs.
“You can hit a high school student from Japan who is visiting the site to write a research report, but you are also going to hit Uighurs who have family members back in China and are supporting the cause,” said Steven Adair, the president and founder of the security firm Volexity in Virginia.
The technology news site TechCrunch first reported the Uighur connection. 

A software update from Apple fixed the flaw.
In recent weeks, security researchers at Volexity uncovered Chinese hacking campaigns that exploited vulnerabilities in Google’s Android software as well. 

Volexity found that several websites that focused on Uighur issues had been infected with Android malware. 

It traced the attacks to two Chinese hacking groups.
Because the hacks targeted Android and iPhone users — even though Uighurs in East Turkestan don’t commonly use iPhones — Mr. Adair said he believed that they had been aimed in part at Uighurs living abroad.

An analyst at FireEye. “If you can get inside an iPhone, you have yourself a spy phone,” said John Hultquist, the company’s director of intelligence analysis.

“China is expanding their digital surveillance outside their borders,” he said. 

“It seems like it really is going after the diaspora.”
Another group of researchers, at the Citizen Lab at the Munk School of Global Affairs at the University of Toronto, recently uncovered an overlapping effort, using some of the same code discovered by Google and Volexity. 

It attacked the iPhones and Android phones of Tibetans until as recently as May.
Using WhatsApp messages, Chinese hackers posing as New York Times reporters and representatives of Amnesty International and other organizations targeted the private office of the Dalai Lama, members of the Tibetan Parliament and Tibetan nongovernmental organizations, among others.
Lobsang Gyatso, the secretary of TibCERT, an organization that works with Tibetan organizations on cybersecurity threats, said in an interview that the recent attacks were a notable escalation from previous Chinese surveillance attempts.
For a decade, Chinese hackers blasted Tibetans with emails containing malicious attachments, Mr. Lobsang said. 

If they hacked one person’s computer, they hit everyone in the victim’s address books, casting as wide a net as possible. 

But in the last three years, Mr. Lobsang said, there has been a big shift.
“The recent targeting was something we haven’t seen in the community before,” he said. 

“It was a huge shift in resources. They were targeting mobile phones, and there was a lot more reconnaissance involved. They had private phone numbers of individuals, even those that were not online. They knew who they were, where their offices were located, what they did.”
Adam Meyers, the vice president of intelligence at CrowdStrike, said these operations were notably more sophisticated than five years ago, when security firms discovered that Chinese hackers were targeting the phones of Hong Kong protesters in the so-called Umbrella Revolution.

The attacks on iPhones, which Uighurs in East Turkestan don’t typically use, suggested that Uighurs abroad were among the targets, said Steven Adair, president of Volexity.

At the time, Chinese hackers could break only into phones that had been “jailbroken,” or altered in some way to allow the installation of apps not vetted by Apple’s official store. 

The recent attacks against the Uighurs broke into up-to-date iPhones without tipping off the owner.
“In terms of how the Chinese rank threats, the highest threats are domestic,” Mr. Lewis said. 

“The No. 1 threat, as the Chinese see it, is the loss of information control on their own population. But the United States is firmly No. 2.”
Chinese hackers have also used their improved skills to attack the computer networks of foreign governments and companies. 

They have targeted internet and telecommunications companies and have broken into the computer networks of foreign tech, chemical, manufacturing and mining companies. 

Airbus recently said China had hacked it through a supplier.
In 2016, Xi Jinping consolidated several army hacking divisions under a new Strategic Support Force, similar to the United States’ Cyber Command, and moved much of the country’s foreign hacking operation from the army to the more advanced Ministry of State Security, China’s main spy agency.
The restructuring coincided with a lull in Chinese cyberattacks after a 2015 agreement between Xi and President Barack Obama to cease cyberespionage operations for commercial gain.
“The deal gave the Chinese the time and space to focus on professionalizing their cyberespionage capabilities,” Mr. Lewis said. 

“We didn’t expect that.”
Chinese officials also cracked down on moonlighting in moneymaking schemes by its state-sponsored hackers — a “corruption” issue that Xi concluded had sometimes compromised the hackers’ identities and tools, according to security researchers.
While China was revamping its operations, security experts said, it was also clamping down on security research in order to keep advanced hacking methods in house. 

The Chinese police recently said they planned to enforce national laws against unauthorized vulnerability disclosure, and Chinese researchers were recently banned from competing in Western hacking conferences.
“They are circling the wagons,” Mr. Hultquist of FireEye said. 

“They’ve recognized that they could use these resources to aid their offensive and defensive cyberoperations.”

Chinese Cops Now Spying on American Soil

China is compiling a global registry of its ethnic minorities who have fled persecution, threatening to detain the families of those who don’t comply. The message: Nowhere is safe.

By BETHANY ALLEN-EBRAHIMIAN

A major human rights crisis is unfolding in northwestern China, according to the United Nations, which said last week that the Chinese government is holding one million or more ethnic minorities in secretive detention camps.
Yet even for those who have escaped China, surveillance and intimidation have followed. 

As part of a massive campaign to monitor and intimidate its ethnic minorities no matter where they are, Chinese authorities are creating a global registry of Uighurs who live outside of China, threatening to detain their relatives if they do not provide personal and identifying information to Chinese police. 

This campaign is now reaching even Uighurs who live in the United States.
A few months ago, Barna, who lives in a major U.S. city and requested that her real name not be revealed, received an odd message from her mother, who lives in China. 

Barna’s mother asked her to send her U.S. car license plate number, her phone number, her U.S. bank card number, and a photo of her ID card. 

Barna’s mother said that China is creating a new ID card system that includes all Chinese, even those who are abroad.
Since her mother was located in China and they were talking via WeChat, a Chinese chat app permitted by China’s internet regulator since it gives authorities access to messages and phone calls, Barna knew that their conversation was likely being monitored. 

So she told her mother that she did not have a car in the United States and that she only uses her Chinese bank card, though her mother knows this isn’t the case.
But Barna agreed to send the photo of her ID card. 

“From her unsettled voice, I can tell she has been pushed by the authorities,” said Barna. 

“For the sake of my mom’s safety, I said OK.”
In recent months, many other Uighurs living in the United States have received similar demands from Chinese authorities, relayed by family members back in China who were paid official visits from local public security bureau officials. 

One Uighur living on the east coast told The Daily Beast that Chinese police had demanded a copy of the individual’s employment contract with their university; another was told they had to provide a letter from their academic supervisor. 

If they don’t comply, these Uighurs know that their relatives may be detained.
“I’ve heard about many of these cases of influence and intimidation from Chinese authorities being extended to Uighurs abroad, whether they are students or journalists or everyday people,” said James Millward, a professor of Chinese and Central Asian history at Georgetown University. 

“In many cases they are permanent residents, green card holders, or even citizens in the United States, Australia, or elsewhere.”
There are about 10 million Uighurs in China. 

Uighurs are a Turkic-speaking, largely Muslim ethnic minority concentrated in China’s northwestern colony of East Turkestan. 

In recent decades, a low-level insurgency in the region has brought occasional violence, and in 2009 ethnic riots there killed hundreds.
Beijing accuses Uighur separatists of religious extremism and has launched a shocking campaign of religious and cultural repression that has dramatically escalated in the past year and a half. 

Anywhere between 100,000 to a million Uighurs or more have been herded into extrajudicial concentration camps in East Turkestan; exact numbers are extremely difficult to assess, as the Chinese government tightly restricts access to the region and has not acknowledge the camps’ existence. 

In the camps, Uighurs are forced to renounce Islam, to memorize Chinese Communist Party (CCP) propaganda, and to swear allegiance to the party. 

In some Uighur villages, up to 40 percent of the population has disappeared. 

Chinese authorities have also recently embarked on a campaign to build crematoria in East Turkestan.
At the same time, Beijing has been constructing an experimental high-tech totalitarian regime in East Turkestan. 

They’ve lined the streets with security cameras equipped with facial-recognition software, created a region-wide DNA database of all residents, and implemented a rating system encoded in every person’s ID card, categorizing the individual as “safe” or “not safe” based on criteria including how often the person prays.
These technologies, first tested on Uighurs and other ethnic minority groups, are now being exported to countries like Pakistan as part of China’s “safe cities” project.
As a result of the growing oppression, many Uighurs have tried to flee abroad. 

But Beijing has launched an unprecedented global campaign to get them back, or to monitor them where there are. 

China has used its geopolitical clout to repatriate, forcibly if necessary, Uighurs living or studying in countries from Thailand, Egypt, Turkey, and even the United States. 

Of those who returned to China, many immediately disappeared, presumably into one of the camps. China also recruits Uighurs living abroad, as detailed in a Buzzfeed report in July.
Now, Beijing is seeking to create a detailed database of those who haven’t returned.
“The reason that Uighurs are a canary in a coal mine,” explained Millward, “the reason that everyone should pay attention to this, even if they aren’t concerned about the fate of this ethnic group, is that these are tools of control that are now being employed by the CCP and are easily applied to other individuals as well.”
“The totalization and securitization of information in China, and then the globalization of that reach, is most apparent with regard to the Uighurs but is by no means limited to Uighurs,” he said.
The growing human rights crisis in East Turkestan, and China’s expanding campaign of control and harassment abroad, has attracted growing attention from U.S. lawmakers and human rights groups. On July 26, the Congressional-Executive Commission on China held a hearing on the crisis there, and lawyers and activists are pushing for the U.S. government to levy sanctions under the Global Magnitsky Act on the Chinese officials directly responsible for the concentration camps.
For Uighurs living in the United States, demands from Chinese police thousands of miles away serve as an unwelcome reminder that nowhere, not even the United States, is free from the long arm of the Chinese state.
“They are just telling us, ‘We are watching you. Wherever you go, still you are a Chinese,’” said one Uighur who lives in the greater Washington, DC region. 

“Even though abroad, it doesn’t mean they can’t do something to you. Because they have your friends, your relatives. I think that’s what they want to tell us.”

Big Brother Xi

Privacy concerns as China expands DNA database

By Stephen McDonell

File picture of a blood sample being taken

China is building a vast DNA database with no appropriate privacy protection.
While a genetic database of convicted or suspected criminals exists in many countries, China is thought to include anyone, regardless of valid grounds for suspicion.
Ordinary citizens are being asked to have their blood drawn for a DNA sample, Human Rights Watch says.
Vulnerable groups and minorities appear to be a particular target of the push.
Those include migrant workers, political dissidents and ethnic or religious minorities like the Muslim Uighurs in China's far western Xinjiang region.
Xinjiang authorities are reported to have bought around $10bn (£7.7bn) in equipment to step up the collection and indexing of DNA.

'Expansion needs to stop'
Human Rights Watch warned that the collection programme is used to increase political control.
"Mass DNA collection by the powerful Chinese police absent effective privacy protections or an independent judicial system is a perfect storm for abuses," Sophie Richardson, China director at Human Rights Watch said in a statement.Police are asking ordinary individuals to provide blood for DNA sampling

DNA collection can have legitimate policing uses in investigating specific criminal cases, she explains. 

"But only in a context in which people have meaningful privacy protections."
"Until that's the case in China, the mass collection of DNA and the expansion of databases needs to stop."
There are plenty of people here in China who would say: "What's wrong with the police collecting your DNA? If you have done nothing wrong you have nothing to fear."
Yet this is a country without an independent legal system. 

So, for others, it feels creepy that the state is collecting the DNA of tens of millions of its citizens simply because it can and that many being required to give a blood sample are selected because they belong to a certain target group.
According to Human Rights Watch, police notices describe target populations beyond "suspects and criminals" and include categories such as "focus personnel" (dissidents, activists, those with prior criminal records) or "migrants" (Chinese citizens who travel to a city without official permission to live there).
Ultimately, the question for Chinese people is do you trust the Communist Party with your DNA?
There are those who would add that this enormous data collection from people not connected in any way to a crime is potentially illegal under Chinese law but, as I say, this is a country where the Party controls the courts.
Beijing recently introduced new restrictions in Xinjiang in what it describes as a campaign against Islamist extremism.

The Uighurs face widespread discrimination in Xinjiang

The measures include prohibiting "abnormally" long beards, the wearing of veils in public places and refusing to watch state television.
Recent years have seen bloody clashes in the region and the Chinese government blames the violence on Islamist militants and separatists.
Since 1989 when China started collecting DNA, it has amassed the genetic information of more than 40 million people. 

In the US, the national DNA index of offenders has only 12.7 million offender profiles.
Percentage-wise the US is still ahead of China though, having about 4% of the population indexed while China only has 2.9%.