China’s ‘data doors’ scoop up information straight from your phone

Facial recognition devices have become commonplace across China. But, what you probably didn’t know is that some of these machines can snatch up information straight from your smartphone.

Photo credit: 123RF

While they look like regular metal detectors on the outside, they’re much more than that. Aside from facial recognition and ID card verification, the so-called “three-dimensional portrait and integrated data doors” vacuum up MAC addresses, IMEI numbers, and other identifying information from electronic devices. This data is unique to a user’s hardware, and it could potentially be used to track people.

A new report from Human Rights Watch (HRW) uncovered the use of these data doors at certain checkpoints in Xinjiang, where the government is using heavy surveillance to monitor the local Uyghur Muslim minority.

“People that went through it only knew that they were going through facial recognition, but they didn’t know identifying information from their electronic devices was also being collected to be logged and tracked,” said Maya Wang, a senior researcher for China at HRW.

China already has Skynet, the biggest video surveillance network in the world. It’s also trialing facial recognition blacklists such as those that shame jaywalkers, unlicensed drivers, and even bad tourists.

Collecting this kind of information from electronic devices is a new level of privacy invasion. A data door maker called Pingtech explains in a patent that in addition to IMEIs, the devices can pick up mobile phone wifi MAC addresses, as well as IMSI and ESN numbers for identification and location tracking.

Data doors, however, are not the only way it’s happening.

According to TechCrunch, a smart-city system with facial recognition cameras in one Beijing district has also been equipped with sensors that monitor wifi-enabled devices, suggesting it can collect IMEI and IMSI numbers.

The system was discovered by Condition Black security researcher John Wethington after the database was left accessible without a password.

What exactly this information is being used for remains an open question. Numbers such as IMEI are unique identifiers assigned to SIM-capable devices like mobile phones.

Independent cybersecurity expert Greg Walton, who worked on the HRW report, said that aside from identification, mass transit systems might want to harvest unique identifiers from devices to measure traffic.

However, this kind of information can also be used to track people physically. In many countries, IMEIs and other information from phones are used by the police to track down stolen phones, missing people, or suspects (they still need a warrant, at least in the US).

A device’s identifying numbers such as IMEI and IMSI could serve as beacons for authorities. When combined with other data from facial recognition, surveillance cameras, license plates, or even phone records and social media posts, a clearer picture of a person’s life emerges.