An unprotected database offers a look at a surveillance system in Beijing, which matches faces to police records, monitors Wi-Fi-enabled devices, and more
including facial recognition scans on hundreds of people over several months. The data was hosted by Alibaba. https://techcrunch.com/... @davidpaulk : Facial-recognition cameras are being used to identify Uyghurs in Beijing. Take a moment to let that sink in. And this WTAF sentence: “The database also contained a subject's approximate age as well as an ‘attractive’ score, according to the database fields.” https://twitter.com/... Ryan Gallagher / @rj_gallagher : A surveillance system in Beijing was left unsecured without a password so anyone could access it through the internet; a researcher discovered it & found facial recognition being used to detect Uyghurs, an ethnic minority persecuted by Chinese govt: http://techcrunch.com/... Thanks: @campuscodi
Context & Ripple Effects
This finding lands two months after a researcher surfaced what appeared to be an unsecured facial recognition database of over 2.5 million Uyghurs, and weeks after reporting on how China's tracking of the minority became the first widely deployed racialized use of facial recognition. What is new here is geography and scope: the system sits in Beijing itself, matches faces against police records, tracks Wi-Fi-enabled devices, and even scores subjects' 'attractiveness' — and it runs on infrastructure hosted by Alibaba, one of China's flagship cloud providers.
The exposure was total: no password stood between the internet and scans of hundreds of people collected over months. It is the third such lapse in the corpus, and it foreshadows the larger exposures that followed, including an 800-million-record Chinese database left open for months.
First-order effects
- Hundreds of people scanned in Beijing — disproportionately Uyghurs — had their face-to-police-record matches, location pings, and demographic fields exposed to anyone who found the endpoint, turning a targeting tool into a leak of its targets' own data.
- Alibaba is now publicly tied to hosting an ethnic-minority surveillance workload, a reputational liability for a company courting international cloud customers.
Second-order effects
- Each successive unauthenticated find — Xinjiang, then schools serving Tibetan areas, then this — hands foreign regulators and buyers concrete evidence for treating Chinese cloud-hosted biometric systems as a due-diligence risk category rather than isolated incidents.
- Domestically, the accumulation of invasive deployments feeds the backlash that later surfaces when state TV spotlights retailers' facial-recognition practices, giving emerging pushback inside China its evidentiary base.
Third-order effects
- If deployment continues to outpace security hygiene at this scale, the binding constraint on China's surveillance industry shifts from technical capability to governance — forcing either real access controls and audits or a widening gap between what the systems collect and who can see them.
- The recurring pattern of open databases suggests biometric data becomes treated like any other regulated sensitive asset, with liability eventually reaching the platforms that host it, not just the operators who build it.
The trend: China's facial-recognition apparatus is expanding from frontier regions into the capital while its underlying data security repeatedly fails basic tests, making operational lapses — not capability — the system's most visible weakness.