Shanghai District Tripling Mass Surveillance, Expanding Behavioral Analytics
A sweeping mass surveillance expansion underway in central Shanghai will triple facial recognition cameras, and increase computing infrastructure by several times to power "the mining of massive data" across files for 50+ million citizens' everyday activities and behavior.
Scheduled for completion in days, on May 10, Xuhui's project targets its ~1.1 million population, even installing cameras in dozens of residential communities. Xuhui District is home to the American, French, German, Italian, and Swedish Consulates, Microsoft's Research Asia-Shanghai labs, and the Microsoft INESA AI Innovation Center. It is also described as a hub for many of China's leading AI researchers, with Huawei and Alibaba offices in the West Bund International AI Tower, twin skyscrapers dedicated to AI.
Hundreds of pages of technical documentation IPVM obtained on ongoing Shanghai projects demonstrate a citywide surveillance ramp-up being implemented at the district level. In the West, this is similar to sheriffs or county-level officials gathering data and running analytics on their residents' daily activities. This report focuses on central Shanghai's Xuhui District, with reporting on further districts in the near future.
Xuhui's "Phase III Construction Project"
In September 2023, the Xuhui District branch of the Shanghai Municipal Bureau of Public Security announced an ambitious expansion of its "Intelligent Image Recognition System," a network of 1,200 pre-existing facial recognition cameras described by 2021 maintenance documents as "combatting illegal crimes and improving social prevention and control capabilities."
In 65 pages of specifications finalized in Fall 2023, Xuhui officials ordered a "capacity expansion...necessary to fully explore the research and analysis capabilities of video surveillance."
This includes a severalfold increase in data processing, analysis, and storage capabilities intended to construct detailed profiles of every resident's real-time and past travel, "social relationships, activities, and other comprehensive information." With this data, authorities claim 'AI' analysis can scrutinize individual and group behavioral patterns, detecting deviations and triggering "early warnings" of incidents.
Files on 50+ Million People
To increase data collection, Xuhui District will install 2,500 additional new facial recognition cameras, tripling its current number. Authorities estimate they will capture and analyze 25.9 million faces daily, an average of 18,860 individuals each minute. This comes out to 175 cameras per square mile across the 21 sq mile District.
A crucial feature requires every face captured to be matched to the correct "file for each person" and stored for "big data" analysis. The system will check them against Shanghai's "municipal bureau library" with files on over 50 million people, expected to increase to 64 million with "new data added every day."
Unknown individuals and their facial characteristics are flagged, and authorities can conduct filtered searches by features including "gender, age group, and Uyghur ethnicity" in order to "facilitate finding specific types of passersby."
Contract Awarded to US-Sanctioned FiberHome
In October 2023, Xuhui officials contracted the hardware expansion to an integration subsidiary of FiberHome Telecommunications Technologies Co., a Wuhan-based IT and telecommunications company described by China Daily as "a State-owned enterprise."
FiberHome agreed to a completion date of May 10, 2024.
In 2020, the US Commerce Department added FiberHome to the Entity List, citing complicity in human rights abuses in Xinjiang.
The contract is valued at ¥31,000,000 RMB ($4.4 million USD). However, Xuhui Branch's full spending is much higher, with several other parallel contracts.
In the month of October 2023 alone, Xuhui awarded at least an additional ¥47,474,700 ($6.5 million USD) in contracts for the system, including ¥6,000,000 for maintenance, ¥18,974,700 for 1 year of networking services, ¥7,000,000 to build operation centers in 4 police stations, ¥5,000,000 for camera poles and cabling, and an additional ¥10,000,000 for further system construction and cybersecurity. This does not account for the Phase I and Phase II projects, or related contracts such as ¥11,088,800 RMB in branch cybersecurity upgrades completed months earlier.
FiberHome is a member of the United Nations Global Compact, an organization chaired by the UN Secretary-General which has recently admitted several PRC surveillance manufacturers who claimed commitments to human rights and other UN principles.
Facial Recognition Expansion Scale Examined
Much of Xuhui's Phase III project focuses on implementing additional computing power, demonstrated in the below diagram in red and yellow:
This includes:
(1) Six "Portrait Gathering" machines (人像聚档一体机), designed to enable on big data analysis by matching data to individuals, and maintaining profiles of individuals' activities, social relationships, travel, and "risk type," with storage capacity for at least 1 year of historical data.
(2) Twelve "Portrait Retrieval" machines (人像检索一体机能力) including "passerby attribute recognition" capabilities for personal characteristics such as Uyghur ethnicity, and feature-based filtered searches, to "facilitate finding specific types of passersby."
The Portrait Retrieval machines must also support searches by "risk person type," akin to a police 'hot list' for individuals of concern to authorities. Documents do not specify which "risk categories" Xuhui employs, but in other PRC cities, they have included students, petitioners, "democracy supporters," dissidents, and "members of a banned organization."
(3) Four "Portrait Data Storage" (人像视图数据存储) machines with 288 TB of storage (totaling 1.152 petabytes), designed for long-term data storage used in "big data" analysis.
(4) Three "Intelligent Image Data Storage" servers, each with 240 TB of storage for local storage, "intelligent image applications" and to "intelligently detect key data, perform data analysis, and provide early warnings."
Other hardware includes 3 "Video Watermark Nodes" (视频水印节点), intended to "ensure that [Xuhui] branch can trace the source of any data leaks," and a "Video Desensitization Node" (视频脱敏节点), "necessary to support desensitized playback of recordings with a security clearance level higher than the user's security clearance level."
One Person, One File
The project emphasizes China's "One Person, One File" model intended to ensure surveillance information is properly tagged to the right individual as it is collected and stored in "the file for each person." Individuals' files include "basic personal information, social relationships, portrait photos, activity patterns, and other comprehensive information." In other cities, these files have included everything from records of international travel to positive HPV results.
One Person, One File is emphasized for its importance in "mining of massive data, big data correlation, and collision analysis, and providing useful big data intelligence." Unless surveillance data is tied to individuals, it is challenging to analyze patterns, relationships, or make predictions, as those files contain important contextual information - if they are a "democracy supporter," for instance.
One Person, One File requirements regularly appear in PRC surveillance projects, with solutions patented by numerous PRC technology companies, including Huawei.
Requires Hikvision, Cisco, Huawei Integration
The tender requires "the integration of Hikvision platform SDK," with no mention of other surveillance camera manufacturers. While the brand of the new 2,500 facial recognition cameras is not specified, the 2021 maintenance contract notes hundreds of Hikvision devices, as well as Dahua.
Integration with several other manufacturers is also required, including Cisco and Huawei:
The intelligent monitoring subsystem needs to provide graphical network topology functions and support the management of Cisco, Huawei, H3C, Ruijie, Maipu, Hillstone, and Netstrong.
It does not specify what products or software must be interoperable, but likely refers to networking infrastructure, which each provides.
Background: PRC Mass Surveillance
This system is the product of years of PRC national policy effectively intended to automate and scale public security bureau tasks that ordinarily require large workforces: monitoring individuals, the company they keep, their characteristics, what risks they pose, and so on.
In theory, this overcomes human resources limitations on China's totalitarian ambitions and system. Beijing hopes to rely on technology to peer into and control the lives of an increasingly large number of people with the same or fewer public security forces. Unlike people, computers follow orders consistently and without moral questions.
According to the Wall Street Journal, this is core to "one of [Xi Jinping's] grandest ambitions: the creation of a new type of modern government":
This new phase in Mr. Xi’s rule will bring fresh scrutiny to one of his grandest ambitions: the creation of a new type of modern government, powered by data and mass digital surveillance, that can rival democracy globally. As it amasses ever more data on the movements and habits of its people and develops new ways to process it, China’s Communist Party dangles the promise of a perfectly engineered society.
This "perfectly engineered society" comes at the risk of enabling government abuses. As WSJ pointed out, in Xinjiang, "The result is the largest incarceration of a religious minority since World War II." Even for those not incarcerated, many describe the 642,000 mi² region as an "open-air prison," where cameras can trigger police intervention.
Exemplifies Pervasiveness of PRC Surveillance vs. The West
The Xuhui District project demonstrates how pervasive surveillance is in the PRC, even on a local level. Xuhui District's population of 1.1 million is roughly equivalent to that of Indianapolis, El Paso, Calgary, or Birmingham. Yet the scale of this city district's surveillance infrastructure lacks any comparison in the Western world. Even London's famous "Ring of Steel" uses only ~650 government-operated cameras (often incorrectly reported as 500,000).
This epitomizes a fundamental difference between how the West and the PRC approach monitoring their own citizens. While penetrating surveillance does occur in the West - the US National Security Agency (NSA) being a well-known example - it does not exist at the level of a local sheriff. By contrast, Xuhui shows how, in the PRC, surveillance occurs not just in communities but also within communities.
How Well Does This Work?
This report largely takes these documents at face value. Reasonable questions could be raised about whether and how well the claimed capabilities of China's mass surveillance systems actually work. In IPVM's experience testing video analytics, for instance, actual performance is often disappointing under real-world conditions.
However, performance issues in these systems do not necessarily reduce the privacy and social control concerns raised by these systems. PRC authorities are using them; if they do not work well, then they are not only invasive but arbitrary. Furthermore, as long as the public believes they work, the psychological impact remains.
In upcoming reports, we will examine how this system targets Uyghurs and how it employs various surveillance technologies and manufacturers.