Cashing in on dystopia

In a piece called “The Long March to Privacy,” The Economist once talked about the advancements Chinese had made in their attitudes toward privacy. After decades in which virtually every aspect of their lives had been “an open book,” subject to constant government scrutiny, Chinese citizens were now “beginning to bristle at the intrusiveness of nosy employers, data-mining marketers and ubiquitous security cameras.”

That article ran 11 years ago, when China was on the cusp of the mobile digital revolution. Today, as big data promises a commensurate revolution in surveillance capabilities, privacy in China (as elsewhere) faces enormous new challenges. And so, taking a fresh look last month, The Economist voiced concern over plans in China for a far-reaching “social credit system,” a bold experiment in digital social control applying financial, social and possibly even political data points to the lives of all citizens.

But if, like The Economist, we look to the horizon for confirmation of our fears “about Big Data leading to Big Brother,” we risk overlooking the privacy horror story unfolding right under the noses of Chinese citizens  —  namely, the sale of personal data through an information black market that appears to be plugged into national police and government databases already.

Just days before The Economist ran its article on China’s proposed social credit system, an investigative report by one of China’s leading commercial newspapers revealed that citizens’ private information can be purchased conveniently  —  thanks to the very platforms driving digital change  —  by anyone able and willing to drop a few hundred dollars.

In a December 12 expose occupying two full spreads in Guangzhou’s Southern Metropolis Daily, reporters Rao Lidong (饶丽冬) and Li Ling (李玲) carefully documented their successful attempts to obtain personal information about consenting colleagues through “tracking” services advertised online. See a scan of the newspaper below:

For a modest fee of 700 yuan, or about 100 dollars, the reporters were able to obtain an astonishing array of information based on one colleague’s personal ID number, including a full history of hotel rooms checked into, airline flights taken, internet cafes visited, border entries and exits, apartment rentals, real estate holdings  —  even deposit records from the country’s four major banks.

But that wasn’t all. The reporters were also able to purchase live location data on another colleague’s mobile phone, pinpointing their position with disturbing accuracy.

Hundreds of tracking services are advertised on internet-based platforms in China, offering clients the power to unlock, with as little as a phone number or ID, the personal data of just about any Chinese citizen. You can find them on Tencent’s WeChat and QQ services, on the Taobao online marketplace and on Weibo. And while some of these services are unreliable or outright fraudulent, others are able to deliver accurate information from what must be national police and government databases, as well as from banks and mobile carriers.

In other words, through a simple mobile transaction, you, too, can be Big Brother.

When one of the reporters approached a service provider, identified in the report as “XX Trade and Commerce” (XX商贸), saying they needed a background check on someone engaged to marry a relative, the firm offered a “full-service” package for 850 yuan, or 120 dollars. The reporter opted instead for a national search of hotel stays, providing a colleague’s ID number as required.

Within 48 hours, the reporter was sent a screenshot with a comprehensive log of the colleague’s hotel stays, including an image of the record for their last stay, on October 30, 2016.

The screenshot revealed that the colleague’s earliest hotel stay was on August 10, 2011, at 9:48 p.m., when they checked into the Best China Hotel in Xi’an, staying in Room 310.

For an additional payment of 600 yuan, the reporters learned, they could order a search to discover who their colleague had stayed with at the hotel. There was no need to place the order, of course. The colleague could supply the remaining details.

• The reporters’ colleague confirmed that he had stayed in the hotel in Xi’an in 2011 with his family members after taking the college entrance examinations.

The last hotel record provided for the colleague was an image file with a blue background that included all of their personal information  —  hotel booking number, ethnic group, date of birth, ID card number, current residential address and hotel room number. A copy of the colleague’s ID card was included at the left-hand side of the entry. Check-in times accurate to the second were provided for each hotel record.

Obtaining permission and an ID number from a second colleague, the reporters purchased the so-called “ID super-tracking service,” a comprehensive search across information categories, negotiating the price down to 700 yuan. Twenty-four hours later, they received two Excel files that included ID super-tracking of this colleague across nine categories  —  including hotel stays, visits to internet bars, places of both permanent and temporary residence, bank accounts, driving records (including infractions), motor vehicle registration, airline flights and train journeys.

As before, the newspaper was in a position to verify the accuracy of the information provided:

• Our colleague at Southern Metropolis Daily confirmed that the information in the file was entirely accurate, and basically amounted to a super-tracking of his ID going back to April 2011. In particular, the information in the table “Basic National Population Info” was entirely identical to the information on his residence permit, and the picture provided was the picture on his personal ID.

Hoping to gauge the reliability of the mobile location services on offer, the reporters obtained permission from yet another colleague, sharing their mobile number with the tracking firm and paying a fee of 600 yuan.

Thirty minutes later, the reporters received an image of that colleague’s position, including a map and GPS coordinates. The coordinates perfectly matched the colleague’s reported location.

Owing perhaps to censorship guidelines, the Southern Metropolis Daily report did not draw out the broader implications of its findings  —  that either government and police insiders are routinely selling access to a treasure trove of personal information, or that national databases are vulnerable to outside hacking.

China may have Big Brother ambitions for social control. And President Xi Jinping appears to many observers to match these ambitions with his own unprecedented consolidation of power. But this privacy horror story  —  “Terrifying!” its headline began  —  is a sobering reminder of the porous and fragmented nature of China’s institutions.

We often imagine China as having the kind of centralized authoritarian system that might be capable of implementing a watertight and monolithic system of digital social controls. And certainly, in the digital age, there is merit in the idea that an expansive hold on big data may possess the key to political power. But as data becomes ever more precious, securing this resource could become virtually impossible  —  particularly in a system like China’s, which lacks adequate legal and political protections.

One possible alternative, hardly less frightening, to a centralized and devilishly efficient social credit system is the emergence of a vast “flesh search” universe in which the unspoken rule is a cash-fueled information free-for-all. Those who wish to investigate their enemies and competitors will find a wealth of services promising access. And those with the requisite connections, political privilege or other resources will find eager agents ready to sanitize, glamorize and otherwise doctor their social credit profiles.

Big Brother’s hopes for all-seeing clarity could very well end in fatal confusion.