Chinese authorities are secretly installing ‘data-stealing’ spyware apps on visitor phones
Chinese officials are reportedly forcing tourists entering Xinjiang from China’s Kyrgyzstan region to install “text-stealing malware” on their smartphones, as part of their wider crackdown on the local Muslim population, according to a joint investigation by The New York Times, the Guardian, Motherboard, Süddeutsche Zeitung and German broadcaster NDR.
The malware known as BXAQ or Fengcai, is installed by security guards at the border who physically seize the phone. The software copies all the data including visitor’s text messages, calendar entries and phone logs to a Chinese server. It also scans the device for specific sets of files, including “Islamic extremist content”, as well as innocuous materials and academic books on Islam.
“(This app) provides yet another source of evidence showing how pervasive mass surveillance is being carried out in Xinjiang,” said Maya Wang, China senior researcher at Human Rights Watch.
“We already know that Xinjiang residents — particularly Turkic Muslims — are subjected to around-the-clock and multidimensional surveillance in the region.
“What you’ve found goes beyond that: it suggests that even foreigners are subjected to such mass and unlawful surveillance.”
According to The Guardian, people using the remote Irkeshtam border crossing into China are “routinely having their phones screened by guards”.
Designed by a Chinese company, the app reportedly puts the 100 million yearly visitors to Xinjiang at risk of state surveillance.
Edin Omanovic, State surveillance Programme Lead at Privacy International, branded the malware as “unlawful, pervasive, and draconian”.
“Modern extraction systems take advantage of this to build a detailed but flawed picture into people’s lives. Modern apps, platforms, and devices generate huge amounts of data which people likely aren’t even aware of or believe they’ve deleted, but which can still be found on the device,” he said.
“This is highly alarming in a country where downloading the wrong app or news article could land you in a detention camp,” he added.
Tourists too are not happy about the spyware being installed in their phones, as the authorities did not warn them about it in advance or informed what the software is looking for, or that their details are being taken.
“I don’t like it. If they were doing it in my home country I would be aghast,” one traveler told The Guardian. “but when you are traveling to China you know it might be like this.”
The Guardian and its investigative allies were able to confirm the app was installed on Android devices using “side-loading.” However, a reporter from Süddeutsche Zeitung said they also saw machines being used to search iPhones at the border.
