Cybersecurity

A Police Dashboard on 700 Foreigners Sat Open

A police surveillance dashboard in Zhangjiakou held profiles on more than 700 foreign residents and 300 foreign journalists, and it was left unsecured. The vendor patent behind it is the part that should change how you brief staff travelling to China.

CybersecurityBy Servola Tech Desk2026-08-034 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

A Police Dashboard on 700 Foreigners Sat Open

Key takeaways

An unsecured police dashboard built for the Zhangjiakou Public Security Bureau in Hebei province held profiles on more than 700 foreign residents and nearly 12,000 entries in total, including more than 300 foreign journalists. Anyone who found it could read the file, not only the authority that commissioned it.
The record on each person was an aggregated dossier, not a name on a list: nationality, date of birth, sex, marital status, address, occupation, sometimes religion, plus camera sightings at road junctions, markets and shopping centres. Assume that a staff posting to China produces a record of this shape and that it is durable.
The finding that matters commercially is the vendor. Links were traced to Origin Dynamic, a Beijing supplier of robotics and surveillance equipment to police, which filed a patent application in 2023 for an information interface for non-Chinese citizens. This is a product with a roadmap, not one city improvising.
Treat this as two separate risks. State collection is the one every operator already assumes and prices in. The second is that the collected dossier sat behind no meaningful access control, so the exposure runs to criminals, competitors and data brokers as well, and that is a risk most travel policies do not name.
Do three things this quarter: brief travelling and posted staff that an aggregated profile is being built and is not secured, minimise the personal data your local entity holds on assignees beyond what local law compels, and record in your GDPR processing register that employee data may enter a foreign state system.

A journalist found his own passport number

Hofer, a journalist, went looking through a police surveillance dashboard and found himself in it. The entry held a photograph taken by Chinese immigration officials at the border, a passport number and the mobile number used while in the country. It was not a leak in the ordinary sense, and nobody had to break anything to see it. The dashboard was reachable and unsecured.

The system had been built for the Public Security Bureau of Zhangjiakou, a city in Hebei province not far from Beijing. It is an unremarkable place to find a comprehensive foreigner-tracking platform, and that is precisely what makes it worth an hour of an operator's attention. Nothing about Zhangjiakou suggests it was chosen as a showcase.

What the dashboard actually held

The platform carried nearly 12,000 entries in total, covering fugitives, people from Hong Kong and Taiwan, more than 700 foreign residents of the city and more than 300 foreign journalists. Each person was categorised by nationality and carried a structured profile: date of birth, sex, marital status, address, occupation, and in some cases religion.

Attached to those profiles were sightings. Individuals appeared in camera captures at traffic intersections, in markets, in shopping centres and, in at least one instance, at a mosque. The distinction worth holding onto is between a list and a dossier. A list records that somebody is present. What this system produced was a continuously updated pattern of life, assembled from identity documents and public cameras and joined into a single view of a named person.

The vendor is the finding, not the city

One city running an unusually thorough system would be a curiosity. The reporting traced links between the platform and Origin Dynamic, a Beijing company that supplies robotics, surveillance services and equipment to police forces. The same company filed a patent application in 2023 covering a comparable system, described as an information interface for non-Chinese citizens.

Read those two facts together and the shape of the thing changes. A patent application is what a supplier files when it intends to sell something repeatedly and wants the design protected while it does so. This is a productised capability with a named vendor and intellectual property behind it, which means the sensible planning assumption is not that Zhangjiakou is unusual. It is that Zhangjiakou is an installation, and installations have siblings.

Two risks, and most policies name only one

Every competent travel and posting policy already assumes state collection. Firms brief staff on clean devices, on what to carry, on what to say, and they price the assumption that a foreign authority may hold a record. That risk is old, understood and largely managed. It is not what is new here.

The new risk is the access control, or rather its absence. An aggregated dossier on your employee, sitting in a system that anyone able to find it could read, is exposed to a much wider set of parties than the authority that built it: ordinary criminals, commercial data brokers, and anyone running a competitive intelligence operation against your firm. A profile combining passport number, home address, employer, movements and religion is exactly the raw material for targeted fraud, coercion or an impersonation attempt against your finance function. The state was the intended reader. The security failure means it was not the only possible one.

Three changes worth making this quarter

Brief the people affected, and brief them accurately. Staff posted to or travelling in China should be told that a structured profile is being assembled, that it will include immigration photography and movement data, and that on the evidence of this case it may not be securely held. That last clause is the part that changes behaviour, because it converts an abstract political risk into an ordinary data-exposure risk that people already know how to think about.

Then reduce what you add to the pile. Hold the minimum personal data on assignees in your local entity that local law requires, and stop volunteering more. Finally, make the record honest: if employee personal data can foreseeably enter a foreign state system, that belongs in your processing register and in your transfer risk assessment, not in an unwritten assumption. European employers carry obligations to their staff about what happens to their personal data, and a documented assessment is worth more than an informal understanding when somebody eventually asks.

Frequently asked questions

Does this only affect firms with staff based in China?

No. The dashboard covered short-term presence as well as residents, and the entries were built partly from immigration records captured at the border and partly from public cameras. A short business trip generates the identity record and the camera sightings just as a posting does. The difference is duration of exposure, not whether a profile exists.

What is the practical difference between this and surveillance we already assume?

Access control. Assumed state collection means a foreign authority holds a record, which is a known and manageable risk. This system was left unsecured, which means the same aggregated dossier was readable by anyone who located it, including criminals and commercial data brokers. The consequence is targeted fraud and impersonation risk against your organisation, not only a political risk to the individual.

Does this create a GDPR problem for us?

It creates a documentation duty rather than an automatic breach. Where employee personal data can foreseeably be collected into a foreign state system, that should appear in your record of processing activities and in the risk assessment covering transfers and postings, with staff informed. The exposure itself is outside your control; whether you assessed and disclosed it is not.

The surveillance was the expected part. The unlocked door was not, and the patent application tells you this design was built to be sold more than once. Brief your people on the second fact, because it is the one that turns a distant political concern into an ordinary exposure of your own employees' data.

SurveillanceChinaData exposureEmployee dataTravel riskOrigin DynamicGDPRVendor systems

One Request Could Hijack Your WordPress Site

On 17 July 2026 WordPress shipped forced updates 6.9.5 and 7.0.2 to close wp2shell (CVE-2026-63030), a pre-authentication remote code execution flaw in core that an anonymous request could trigger on a default install. Why the automatic patch is not where your job ends.

3 min read

Law & Regulation

Your Vendor Decides When Your 72 Hours Start

CareCloud's records system was hit on 16 March. It determined on 24 June that data was taken. Letters went out from 30 July. Your GDPR clock is 72 hours.

6 min read