From The Big Story: How a Research Blog Took on Big Surveillance in China—and Won

Listen to more of The Big Story here: ⁠⁠⁠⁠http://swap.fm/l/wi-bigstorypod-feeddrop Digging through manuals for security cameras, a group of gearheads found sinister details and ignited a new battle in the US-China tech war. Written by Amos Zeeberg. Originally published on April 4th, 2023. For more of the most ambitious, future-defining stories from our favorite human writers, subscribe to The Big Story newsletter: https://www.wired.com/newsletter/the-big-story Learn more about your ad choices. Visit podcastchoices.com/adchoices

• 0:05Speaker 00

  This is the big story from Wired.

• 0:10Speaker 00

  You're listening to How a Research Blog Took on Big Surveillance in China and Won, written by Amos Zieberg, originally published on April 4, 2023. Digging through manuals for security cameras, a group of gearheads found sinister details and ignited a new battle in the U.S.-China tech war.

• 0:30Speaker 01

  AI can make businesses faster. It can also make mistakes, expose data, and execute the wrong instructions faster. Threat Locker helps organizations set boundaries AI cannot ignore by controlling what applications can run, what they can reach, and how they interact with sensitive resources. Innovation needs more than good intentions, it needs limits. Control AI with zero trust at threatlocker.com/wired. That's T-H-R-E-A-T-L-O-C-K-E-R dot com slash wired.

• 1:00Speaker 02

  Starting a business can seem like a daunting task, unless you have a partner like Shopify. They have the tools you need to start and grow your business. From designing a website, to marketing, to selling, and beyond, Shopify can help with everything you need. There's a reason millions of companies like Mattel, Heinz, and Allbirds continue to trust and use them. With Shopify on your side, turn your big business idea into... Sign up for your $1 per month trial at Shopify.com/specialoffer.

• 1:30Speaker 03

  When it comes to my policy, Farmers gives it to me straight, so there's no surprises.

• 1:35Speaker 04

  It's your coverage, you should never be confused.

• 1:38Speaker 03

  You hear that? An insurance provider with a conscience.

• 1:42Speaker 04

  We're a choir, but yes, we have that too.

• 1:45Speaker 03

  Straightforward coverage you can literally understand. That's what you get when...

• 1:50Speaker 04

  You have Farmers!

• 1:53Speaker 05

  Learn more at Farmers.com. Underwritten by Farmers Truck or Fire Insurance Exchanges or Affiliates. Products not available in every state.

• 1:59Speaker 00

  At a location he keeps secret, John Honavich was on his laptop, methodically scouring every link on a website for a conference half a world away. Hikvision, the world's largest security camera manufacturer, was hosting the event: the 2018 AI Cloud World Summit, in its hometown of Hangzhou, a city of about 10 million people not far from Shanghai. Honavich, the founder of a small trade publication that covered video surveillance technology, wanted to find out what the latest Hikvision gear could do. He zeroed in on one section of the conference agenda titled "eco-friendly, peaceful, relaxed", and found a description of an AI-powered system installed around Mount Tai, a historically

• 2:44Speaker 00

  sacred mountain in Shandong. A video showed Hikvision cameras pointed at tourists climbing the thousands of stone steps leading to the famous peak. Piano music played as a narrator explained, in Mandarin with English subtitles, that the cameras were there to identify all visitors to ensure the safety of all. The video cut to a shot of a computer screen, and Honavich hit pause. He saw a zoomed-in view of one visitor's face. Below it was data that the camera's AI had inferred. Honavich downloaded the video and took screenshots of the computer screen, for safekeeping. Later, with the help of a translator, he scrutinized every bit of text on that screen.

• 3:26Speaker 00

  "One set of characters," the translator explained, "suggested each visitor was automatically sorted into categories: age, sex, wearing glasses, smiling." When Honavich pointed at the fifth category and asked, "What's this?", the translator replied, "Minority." Honavich pressed, "Are you sure?" The translator confirmed there was no other way to read it. Honavich was shocked. In his many years in the industry, he'd never seen a surveillance company set out to automatically detect racial minorities. The feature seemed completely unethical to him, and he immediately wondered how China might use it against the Uighur people, a mostly Muslim ethnic minority group in the province of Xinjiang.

• 4:10Speaker 00

  Honavich had seen reports trickling out in the west of Uighurs being selected to constrictive surveillance and mass detentions. Clicking through the AI summit website, Honavich couldn't tell whether Chinese authorities were using this technology to oppress minorities, but he saw that danger coalescing. He quickly wrote up an article about Hikvision's ethnicity detection technology, including the video, screenshots, and a no comment from the company, and posted it on the website of IPVM, the trade publication he had founded. He talked about the discovery with one of IPVM's reporters, Charles Rollet, a Frenchman who lives outside the U.S. and also keeps his location secret. Rollet had written about how Hikvision and Dawa, the second-largest video surveillance

• 4:55Speaker 00

  manufacturer in China, were reaping huge profits from government work in Xinjiang. Rollet had a newspaper background, and though he was 25, talked like an ink-stained newsie twice his age, all scoops and calling out abuses and hard-hitting news. By trawling through publicly available materials online, Rollet had learned that Hikvision had landed a deal to build a mass face-recognition system to cover one Xinjiang county, including a re-education center and some of its mosques, and a contract to install video conferencing systems in mosques, presumably so attendees could watch sermons broadcast by the government. Dawa won the bigger contract: $686 million to build camera-equipped police stations

• 5:40Speaker 00

  in another part of Xinjiang. The deal specified that the companies would install these systems, run them for a number of years, and then pass them off to the government. In many aspects of the government's video surveillance in Xinjiang, Rollet reported the two companies were deeply involved. Hikvision and Dawa cameras also happened to hang on houses, businesses, and public buildings in the U.S. and much of the world. Security system installers eagerly sold huge numbers of the cheap cameras. Global financial institutions, such as Fidelity International and Norway's Sovereign Wealth Fund, were enthusiastic investors in the profitable, fast-growing Chinese companies.

• 6:21Speaker 00

  American chip giants Intel and Nvidia sold them silicon to power their face-recognition. That would all soon change. Over the next few years, IPVM's writers unearthed one damning detail after another on Chinese surveillance gear. Their scoops would end up influencing national policy, changing those companies' fortunes, and placing the reporters themselves squarely on the front lines of the U.S.-China Cold War. "I first met Honavich on a summer day in New York, in Brooklyn's Main Park, not far from where he grew up. There are no pictures of him on IPVM's site or on his LinkedIn, a decision I would later understand." He is a small-framed man with glasses over close-set eyes and a boyish face.

• 7:04Speaker 00

  We sat at a small table with an inlaid chessboard, and Honavich, dressed in shorts and a t-shirt, started telling me about the surveillance industry in rapid-fire sentences. "Early in his life," he says, "he developed a zeal for calling out dishonesty. Coming of age on the streets of New York in the 80s and 90s, he encountered plenty of fast talkers, which he says attuned him to deception and taught him to stand up for himself. 'In Brooklyn, you sort of learn that people will try to take advantage of you, so you're gonna have to either fold or push back,' he told me." Honavich was living in Honolulu and studying philosophy in grad school when he decided he needed a different career. He dropped out and went looking for a tech job.

• 7:46Speaker 00

  He made his way to a security startup in Silicon Valley called 3VR, where he became the director of product management. During his time in the security business, when coworkers went on sales calls, Honavich sometimes came along to answer technical questions. But he says he grew uncomfortable when he saw salespeople exaggerating or lying to win over customers. In 2007, he quit. He decided he would rather write about the industry. But the existing trade publications depended heavily on advertising and sponsorship from the same companies they covered. He'd have to build his own publication and find another business model. He coded up a quickie website, and he called it "ip-video-market.info."

• 8:29Speaker 00

  The "IP" stood for "Internet Protocol," mundane-sounding verbiage that in fact spoke to a technological revolution. Security cameras were rapidly changing from analog, low-definition videotape recorders to what were essentially little, internet-connected computers. The new cameras used digital sensors and processors to produce better images, and since they communicated through IP, they could plug right into a user's local network and the internet. Honavich declared independence from marketing. The site would never accept advertising or sponsorships, and started to write. Free to say what he wanted about the industry, he was forthright, verging on combative.

• 9:09Speaker 00

  In an early series of posts, he took aim at one camera company, which he described as "the worst by a massive margin." He criticized it for overselling its cameras' capabilities and called it out for allegedly lying in an advertisement. "The industry needs to fight back," he wrote, "against malicious manufacturer marketing," betraying his tendency to sound like a comic book superhero. Probing for ways to make money, he wrote an ebook about video surveillance, posted a link to buy it online, and emailed everyone he could think of. The next morning, he was euphoric to find that more than a dozen people had bought the ebook, bringing in several hundred dollars. It wasn't much, but Honavich took it as a sign. There were people who would pay for his insights.

• 9:54Speaker 00

  Honavich started charging ninety-nine dollars for annual access to the site. Within a few years, he had amassed enough subscribers to move IPVM out of his house and into a barebones office, a one-hundred-square-foot storage unit in Honolulu, and hire a few more writers, including Ethan Ace. Ace, who lived in Pennsylvania, was an experienced security system installer and frequent commenter on IPVM's posts. With a big red beard and shaggy hair, he sometimes thought about living off the hilly Pennsylvania land near where he grew up, making omelets from eggs laid up the road. In 2013, Ace wrote one of the publication's first posts testing Hikvision cameras, comparing four of them against models from other manufacturers.

• 10:37Speaker 00

  He was impressed to find that they were as good as the other brands while costing much less. Those early posts established not just a voice and market for IPVM, but also an ethical framework based on uncompromising integrity. If IPVM gave a product a positive review, Honavich would bar its maker from using the site's words as a promotional tool and threaten to cancel the subscription of any company that broke this rule. Honavich also felt that the term "Chinese company" could be interpreted as having racist overtones, so he had writers use the idiosyncratic term "PRC company" instead. Whatever the term, those companies were about to dominate the IPVM-ers' world.

• 11:19Speaker 00

  In 2015, Ace flew to Shenzhen to attend the China Public Security Expo at a colossal convention center. Throngs of people stood outside in hour-long lines waiting to get in. Ace saw people selling their entrance badges as they left. A few entrepreneurial folks were hawking packets of company brochures they had collected from booths. Once inside, Ace walked over to the large Hikvision exhibit. It was mobbed by people gawking at demonstrations of face-recognition cameras, biometric doors, and other products that hadn't yet made it to the US. Once in a while, a drone would pop into the air. It struck him that the well-known Western and Japanese brands that had long dominated the market were afterthoughts here.

• 12:04Speaker 00

  Panasonic's booth was sparsely attended. Ace could see that surveillance wasn't a niche business in China. It was part of popular tech culture, and Hikvision was leading the pack. Within two years, Hikvision would become the number-two seller of security cameras in the US. But as Honavich kept an eye on the emerging powerhouse, he began to notice problems. In its English-language materials, Hikvision portrayed itself as an ordinary company, separate from China's government. But Honavich wrote a series of posts showing that it had spun out of a government-owned firm, which remained its largest and controlling shareholder, and that it had received billions of dollars in government loans.

• 12:46Speaker 00

  "Hikvision's dazzling growth," he argued, "was mostly fueled by government contracts." By Honavich's reckoning, Hikvision wasn't functionally separate from the Chinese government. China's other surveillance giant, Dawa, also came under IPVM scrutiny. In March 2017, a security researcher going by the name Bashis published a post in the subscriber area of ipvm.com. "I'm speechless and almost don't know what I should write," he began. Bashis described a security vulnerability in numerous Dawa products that revealed the device's usernames and inadequately obscured versions of the passwords. Bashis wrote, "This is like a damn Hollywood hack. Click on one button and you are in."

• 13:31Speaker 00

  And he said it seemed like a backdoor left intentionally by the creator. Anyone who exploited the vulnerability could potentially watch the camera's video stream and, since IP cameras are networked computers, also use the camera to access the rest of the victim's internal network, or as a bot to launch online attacks. A well-known security writer covered the leak in a blog post and called it "an embarrassingly simple flaw." In Bashis's post, he included a short section of code to show how easy it was to exploit the vulnerability. Honavich quickly took down the code, but it spread on email lists and other sites. Dawa scrambled to distribute patches over the next few days.

• 14:12Speaker 00

  IPVM was becoming a hub for people who worried about these companies' security. Andrew Elvish had seen the problems up close and spoke about some of his concerns to IPVM reporters. Elvish was the vice president of marketing at Genentech, a maker of software for video surveillance systems. In one incident, a Genentech client was using a Hikvision camera and needed some help. When the client opened a customer support case with Hikvision, the company sent back images from the client's camera without asking for the login information, according to Genentech's security chief, Christian Moran. It seemed clear to Moran that Hikvision and Dawa had "magic keys" to access their cameras whenever they wanted. "These devices can serve as beachheads," Moran says,

• 14:57Speaker 00

  "through which nefarious actors can take down the rest of your network." Genentech eventually stopped using Hikvision and Dawa gear. "IPVM played an instrumental role in exposing these very suspicious cybersecurity flaws," Elvish says. Dawa and Hikvision deny leaving intentional backdoors, saying such security problems are normal for any major tech manufacturer and that they patched them appropriately. "There is no evidence anywhere in the world indicating that Hikvision's products are used for unauthorized collection and transit of information or data of end-users. "Hikvision would never compromise or harm our customers' interests," Hikvision told me in a statement. Dawa put out a statement saying, "We have provided remedies to correct those issues with our customers.

• 15:41Speaker 00

  We take cybersecurity very seriously." In May and June of 2017, Hikvision lashed out at Honavich in four posts on its own blog. "Does the online blogger devote 100% of his time to writing tabloid-style headlines and a sensationalist anti-China rhetoric?" asked one post. "Hiding behind a keyboard, the tabloid staff takes unfounded potshots at our entire industry, bullying one company at a time. It is cyberbullying, and it is a cyberattack on hard-working people." One post suggested that the default name given to anonymous commenters on IPVM posts, undisclosed, might be a Honavich sock puppet.

• 16:23Speaker 00

  A few days after the sock puppet post, Jeffrey He, the president of Hikvision USA, emailed Honavich to invite him to an off-the-record meeting at a hotel in New Jersey's Newark Liberty International Airport. Honavich had talked with He a number of times in the course of reporting, and he figured Hikvision leadership wanted to clear the air. Honavich showed up at a small conference room in the hotel, where He and two other senior Hikvision employees were waiting. They faced each other across a conference table. "One of the Hikvision people held a clipboard," Honavich recalls, "and began asking him questions from a written list. Why did he write the things he posted on IPVM? How did the company really make money? What did he have against Hikvision?"

• 17:07Speaker 00

  Honavich was taken aback and tried to explain that he had no hidden agenda or revenue source beyond subscribers. To him, the meeting felt like a criminal interrogation. "Where were you on the Fourth of May?" type stuff. A Hikvision representative said that Honavich and He had agreed the meeting would be off the record and declined to comment further. After about fifteen minutes of grilling, Honavich went to the bathroom to catch a breath. He was surprised to take that much heat in person, but he saw himself as someone who could handle it. "As he told me during our meeting in Marine Park, I get satisfaction out of standing up." Soon, IPVM's coverage caught the attention of policymakers in Washington, DC. Intelligence agencies and news outlets in the US and other Western countries

• 17:51Speaker 00

  were already sounding alarms about networking equipment made by Chinese companies, particularly Huawei, one of the world's tech giants. Now, parts of the US government were concerned about Hikvision and Dawa too, and began imposing sanctions on them. In August 2018, Congress passed a law barring the federal government from buying gear from Huawei, Hikvision, and Dawa, among other Chinese tech companies. The Congressional Executive Commission on China, a bipartisan group that monitors human rights and the rule of law in the country, cited Rolle's coverage in its 2019 annual report, writing that "IPVM provided evidence that the video-surveillance company Hongzhou Hikvision Digital Technology

• 18:34Speaker 00

  was directly involved in the construction, operation, and ongoing maintenance of the Xinjiang Surveillance System."

• 18:42Speaker 01

  AI tools can write code, access files, connect to the internet, and execute commands at a speed no human can match. That productivity is powerful, but it also means one bad instruction or compromised tool can quickly become a security incident. Threat Locker helps organizations use AI without losing control. Put zero-trust guardrails around tools like Claude Code and control exactly what they can execute, access, and connect to. Set clear boundaries around the applications, files, systems, and online destinations your AI tools are permitted to use. Because a proven AI tool should not mean giving it unrestricted access to your environment. Control what runs, control what it can do, control what it connects to. Learn how Threat Locker can help you safely embrace AI at threatlocker.com/wired.

• 19:27Speaker 01

  That's T-H-R-E-A-T-L-O-C-K-E-R dot com slash wired.

• 19:35Speaker 06

  Clothes shopping really isn't my thing. But I still want to look sharp and feel confident. That's why I use Stitch Fix, the OG personal styling service. No more scrolling through websites or wasting my day at the store. My stylist sends pieces picked just for me straight to my door. Free shipping, free returns, no subscription required. Get started today at stitchfix.com. That's stitchfix.com.

• 20:03Speaker 07

  When you spend enough time around great companies, you notice that the best ones treat trust as a growth strategy, not a box to check. Vanta helps companies build and prove trust from day one. Its Agentic Trust Platform connects compliance, risk, and trust at enterprise scale. Vanta delivers a 526% return on investment over three years and pays for itself in just three months. Learn why over 16,000 of the fastest-growing companies use Vanta at vanta.com.

• 20:35Speaker 00

  As IPVM waded deeper into big policy questions, Honavich decided to hire someone to deal with government officials and research how surveillance affected the public. Connor Healy, just out of college and trying to figure out what to do with his life, came across IPVM's posting on a job board and was intrigued. It didn't say much about qualifications, instead emphasizing that the company needed someone with a strong sense of ethics. Healy saw himself as principled and eager to stand up for his beliefs, and in an interview, he convinced Honavich of the same. Healy started working for IPVM in the middle of 2020 and soon joined an investigation into fever scanners that many venues bought during the pandemic. IPVM's engineers were skeptical of the scanner's abilities

• 21:19Speaker 00

  to detect fevers under real-life conditions and wanted to test them at the company's new headquarters in Bethlehem, Pennsylvania. Healy was brought in to help with the research. The HQ was a big step up from the storage facility in Honolulu. Inside the century-old, 12,000-square-foot former silk mill in two cavernous, concrete-floored rooms, IPVM employees tinkered with piles of security gear. Ethan Ace rigged a bunch of fever scanners to a rolling cart and began probing them. In one extreme test, an engineer rode by the rig on a skateboard to see how the scanner behaved when given little time to register his temperature. In another, he held a hot bag of water on his forehead until he couldn't stand it anymore, then walked by.

• 22:04Speaker 00

  The scanners, they learned, were measuring people's skin temperatures from afar, then using an algorithm to try to divine their internal temperatures. When Ace compared the raw readings with the algorithm's interpretations, he could see that the software was squeezing nearly all of the measurements, no matter how high or low, into the small range of normal human body temperatures. "The fever scanners," Ace said, "were in fact rigged to almost never show fevers." The devices were giving customers a false sense of comfort, the testers included, while pulling in hundreds of millions of dollars for their makers. As Healy looked at the graphs and their meaning became clear, he was astonished by the company's greed.

• 22:46Speaker 00

  He took a walk with Honavich and confessed to having some doubts. What if they'd made a mistake? Honavich, having spent 20 years fighting mendacity in the security industry, told Healy to follow the data and not be swayed by corporate claims. "That's one of the founding premises of IPVM. Being dishonest and unethical is a competitive advantage," Honavich told me. Negating that advantage was IPVM's raison d'etre. Healy and Ace pulled the data together, wrote up an academic article, and got it published in the Journal of Biomedical Optics. Within days, the U.S. Food and Drug Administration warned the public that fever scanners could be inaccurate and sent warning letters to some manufacturers.

• 23:30Speaker 00

  Healy's first leap into a policy argument had gone well. Soon, he would be helping IPVM wage much bigger wars with much bigger opponents. In December 2020, an IPVM employee made a blockbuster discovery. The reporter, who keeps his identity secret because of the harassment some IPVMers get for their controversial work, discovered that Huawei and a Chinese AI unicorn called MegV had tested a literal Uighur alarm. The system used AI to analyze people's faces, and if it determined that a passerby was Uighur, it could send an alert to authorities. At the time, Huawei wasn't publicly known to be participating in China's racial surveillance system.

• 24:13Speaker 00

  IPVM partnered with two Washington Post tech reporters to get the information out. The Post published an article on the same day as IPVM and credited the security outfit with the discovery. Dozens of publications picked up the story. For the first time, an IPVM report was national news. Reacting to the Post report, U.S. Senator Ben Sasse from Nebraska said, "While Huawei sells contracts with fancy talk about connecting people around the world, they're working to send Uighurs to torture camps in China." Senator Marco Rubio from Florida tweeted, "The sick people at Huawei developing software to recognize the faces of Uighur Muslims and alert the communist government of #China." Antoine Greisman, a French soccer star who had appeared

• 24:58Speaker 00

  in prominent ad campaigns for Huawei, canceled his sponsorship deal. Huawei released a statement saying it wasn't involved in ethnicity detection. Yet the Post reporters promptly found other documents on a Huawei website showing it had worked on race-detecting systems with at least four other partners besides MegV. Spurred by his colleagues' discoveries, Rolle, the former newspaper reporter, began turning up more evidence of racial surveillance in China. He found product support documents for DAWA cameras that provided real-time Uighur warnings to police. Another document showed that DAWA cameras could track people in the illegal sex business, thieves, and Uighurs with hidden terrorist inclinations.

• 25:41Speaker 00

  Sitting at a café and goggling at the file on his laptop screen, Rolle felt that he was face-to-face with the banality of evil, bland technical manuals for an automated system of brutality. Thinking of movies he had seen about historical genocides, he started to cry. IPVM provided the documents to The Los Angeles Times, and the paper published its own investigation in February 2021. IPVM's reporters went on a tear, digging up more damning evidence and providing it to bigger publications to disseminate. The BBC published a report on Huawei's patent filings for AI race detection in China. Reuters wrote that Hikvision and DAWA had helped draft technical standards

• 26:24Speaker 00

  for mass-face-recognition systems. The Wall Street Journal revealed that Hikvision had deep, longstanding ties to the Chinese military, and so on. Each time, the companies involved insisted that the project was a one-off test, an unimportant slip-up, or regular corporate behavior. Concerns about the company's security and human rights issues finally erupted. In November 2021, President Biden signed a law that blocked the introduction of new video surveillance equipment from Hikvision and DAWA and communications equipment from Huawei and U.S. telecom networks. Models that the companies had already sold in the U.S. would become obsolete over time, gradually consigning them to irrelevance.

• 27:07Speaker 00

  "IPVM played a crucial role in exposing the Chinese government's gross human rights abuses perpetuated with the help of its video security and surveillance systems," U.S. Representative Claudia Tenney from New York, a co-sponsor of the law, told me. "IPVM's work is key to unearthing the full extent of the security risks posed by the CCP and state-controlled or directed technology companies. Even the security industry, much of which had continued to support Chinese manufacturers because of their cheap and popular gear, largely turned against them." The Security Industry Association Trade Group expelled DAWA, and Hikvision quit soon after, leaving no doubt about who it blamed for its departure. "It has been disappointing and frustrating

• 27:52Speaker 00

  to witness the cynical, anti-competitive, unscrupulous, and disingenuous efforts of IPVM to target member companies and undermine the mission of SIA with its invective and opaque financial motives," Hikvision wrote in a resignation letter obtained by the website Security Info Watch. Honavich banged out a feisty response. "We are only opaque to Hikvision because they cannot understand putting ethics over profits," he wrote in a post on IPVM. A PRC government organization with 40,000-plus employees, Hikvision cannot control IPVM, an American small business with just 25. The fight for the U.S. market was over, and Hikvision began a slow retreat. But IPVM wasn't done with China.

• 28:39Speaker 01

  AI tools can write code, access files, connect to the internet and execute commands at a speed no human can match. That productivity is powerful, but it also means one bad instruction or compromised tool can quickly become a security incident. Threat Locker helps organizations use AI without losing control. Put zero trust guardrails around tools like Claude Code and control exactly what they can execute, access and connect to. Set clear boundaries around the applications, files, systems and online destinations your AI tools are permitted to use. Because approved AI tools should not mean giving it unrestricted access to your environment. Control what runs, control what it can do, control what it connects to. Learn how Threat Locker can help you safely embrace AI at threatlocker.com/wired.

• 29:23Speaker 01

  That's T H R E A T L O C K E R dot com slash wired.

• 29:29Speaker 02

  Starting a business can seem like a daunting task unless you have a partner like Shopify. They have the tools you need to start and grow your business. From designing a website to marketing to selling and beyond, Shopify can help with everything you need. There's a reason millions of companies like Mattel, Heinz and Allbirds continue to trust and use them. With Shopify on your side, turn your big business idea into... Sign up for your $1 per month trial at Shopify.com/specialoffer.

• 29:57Speaker 00

  This holiday, all plans, even unlimited, are just $15 a month. A holiday deal this good obviously deserves an enormously expensive holiday song, like "All I Want..." Right, okay, we can afford that. You know what? Forget the music budget. We're gonna stick with whatever's in the public domain. Give it a try at mintmobile.com/switch.

• 30:16Speaker 07

  Upfront payment of $45 for three months, $90 for six months or $180 for 12-month plan required. $15 per month equivalent. Taxes and fees extra. New customer offer for initial plan term only. Greater than 50GB may slow when network is busy. See terms.

• 30:29Speaker 00

  In September 2021, Connor Healy, IPVM's government liaison, flew to London to participate in a people's tribunal chaired by the lead prosecutor of the war criminal Slabodan Milosjevic. The goal of the trial was to determine whether the Xinjiang crisis amounted to genocide, and Healy was there to testify on IPVM scoops in the region. At a reception for participants, a human rights researcher told Healy about an ethnic minority family that was in trouble. The father, Ovalbek Turdaqun, an ethnic Kyrgyz and citizen of China, had spent a year in a re-education center in Xinjiang. He, his wife and their son had fled to Kyrgyzstan,

• 31:12Speaker 00

  but they were at risk of being deported back. Healy reached out to some of his contacts. A US State Department official suggested the family try to get to a neutral country such as Turkey and from there petition the US government to let them in. A Christian organization agreed to pay for the family's exit, but Healy was having trouble finding someone who could shepherd them to Turkey. He decided to do it himself. In December, Healy flew to Bishkek, Kyrgyzstan, and found himself in a child's bedroom sitting across from Turdaqun. The Kyrgyz man sat in silence, drawing on his palm with a pen. His wife sat beside him, a calm and determined look on her face, while their 11-year-old son smiled happily,

• 31:57Speaker 00

  unaware of what was about to unfold. Healy was going to try to escort them across the border that day. A Russian man who transported kids for a local school pulled up in a small bus, and they filled it with seven suitcases stuffed with almost everything they owned. As the group left the city and drove down dark roads, Healy bought plane tickets on his phone, having left it until the last minute to keep Chinese authorities from tracking them. He couldn't shake what he'd heard from a human rights contact. If the Chinese government was going to kill them, it would likely be in the car on their way out of the city. They made it to the airport, and Healy and the family nervously approached border control. Healy took their passports and, along with his own,

• 32:40Speaker 00

  handed them in a stack to a customs officer. The officer flicked through Healy's, looked at the other passports, frowned and walked off. A few minutes later, he returned with a more senior officer whose uniform was covered with ribbons and medals. The two officers argued with each other in Kyrgyz for a few minutes. Then the senior officer turned to Healy and asked whether he loved Kyrgyzstan. Healy nervously blurted out something about the beauty of the mountains before realizing he sounded ridiculous, since the city was blanketed in thick smog. The officer paused for a minute, then let them through. The clang of the stamp on the passports was the sweetest sound Healy had ever heard. As Turdaqun, who didn't speak much English,

• 33:24Speaker 00

  walked through, he smiled at Healy and said, "Nice." In Istanbul, Healy interviewed the parents for three days in a hotel room over glasses of Turkish tea to find material for their application to immigrate to the US. Turdaqun described in detail how he was shocked with electric batons, injected with noxious chemicals and tied to a steel interrogation chair in a room by himself for over 24 hours at a time. The ever-present masters in his cell were three security cameras. If he talked to another inmate, a guard watching the video feed would bellow at him through a loudspeaker to stop. When he wanted to use the rudimentary toilet, he would look at a camera and ask for permission.

• 34:09Speaker 00

  Even outside the camp, Turdaqun said he was watched by face recognition cameras hanging all over Xinjiang. And when he went out, police often quickly appeared and interrogated him. Healy showed Turdaqun an image of the Hikvision logo on his phone, and he recognized it. "Ah, that's a brand of video camera. They're everywhere," he said. The same logo, he said, was on the cameras in his cell. Healy flew back home after the interviews, but continued to help the family with their application, as did other advocates. A human rights lawyer who wants to call Turdaqun as a witness at the International Criminal Court in The Hague wrote a letter to the US government on the family's behalf. "It is vital that his evidence is available for the ICC

• 34:54Speaker 00

  and for the international community," he wrote in the letter, as quoted in The Guardian. "It is crucial to keep them safe and secure." After three months in Istanbul, the family got a special type of immigration visa for people called to testify in court. And in April 2022, they flew to the US. As they exited security at Washington Dulles International Airport, Healy was there to welcome them to the United States. He and Turdaqun hugged. Now that the family was safely in the US, Healy wrote a post on IPVM about Turdaqun's experiences, the first direct evidence of Hikvision cameras being used in detention cells in Xinjiang. "As a reporter, I was never going to get as involved in the story as Healy did.

• 35:39Speaker 00

  Still, I wondered whether I might be able to peek inside the dark world of Chinese surveillance myself. Using what I'd learned of IPVM's reporting techniques, I made a short list of search terms, starting with "minority" in Chinese, and began scouring the internet. When I got a result that looked promising, I copied the text into a translation tab. It didn't seem like much, so I went back and tried different searches, sometimes incorporating new terms I came across. Within half an hour, I found a Chinese page on Hikvision's Indonesian website describing a server that analyzed surveillance video. One of the facial attributes that the server's software was supposed to detect: "Minority, unknown, yes, no."

• 36:24Speaker 00

  The translation was stilted, but in the context of everything IPVM had reported, clear enough. I'd stumbled upon what appeared to be another tiny part of China's racial persecution system. I thought of something Honavich had told me. If the Nazis were here, they would probably design user manuals for everything they built. A sickening feeling came over me. This wasn't evidence filtered through someone else's description subject to interpretation. It was a vile secret the internet had whispered just to me. When I went back to the page a few weeks later, it had all been translated to English. The bit about detecting minorities scrubbed. I scrambled through documents on my hard drive and realized I'd made the rookie mistake of failing to archive the page.

• 37:09Speaker 00

  No screenshots, no PDFs, no proof. I copied and pasted the URL as fast as I could into the Wayback Machine, an archive of websites, and found an old version of the page. It was as I'd remembered it, touting the server's minority detection. I quickly saved it in three formats. Even as our faces are increasingly tracked and analyzed by computers and distant sirens of dystopia ring louder, the US has largely declined to regulate video surveillance and face recognition. In the absence of restrictions, Honavich says he's waiting for trouble. "AI can do magically positive things for society, but you can do terrible things as well," he says. "There's a risk of police using it.

• 37:54Speaker 00

  There's a risk of companies using it. There's a risk of people using it." By now, I understood why Honavich was so careful to limit his own exposure to face recognition. "They can start mining all these videos and figuring out where you are," he says. "I try to keep basically a low profile on the internet. It's not gonna 100% stop it, but I'm not sure why I want to give them more shots to identify me all over the place." "Who's them?" I ask. "The them." Could be the US, could be China, could be whoever. With a prick of anxiety, I wondered what "the them" might know about me and whether I should take down public pictures of myself.

• 38:37Speaker 00

  I concluded there was no point. My face was already out there in the cloud, available for anyone to analyze. That loss of privacy was forever.

• 38:53Speaker 01

  Thank you for listening to The Big Story from Wired. For more of our journalism, visit wired.com or subscribe to the magazine. We'll be back every Sunday, Wednesday and Friday with new stories for you to listen to. This story was narrated by me, Brendan North. The producer was Rose Kirshner. Fran Bandy was our mixing and mastering engineer, and our senior features editor is Jason Key. Special thanks to Wired's Global Editorial Director Katie Drummond, Executive Director of Features and Special Projects, Rehan Harmansi, and Executive Director of Global Audio, Nico Steele. This series was developed by Michelle O'Brien.

• 39:33Speaker 01

  AI tools can write code, access files, connect to the internet and execute commands at a speed no human can match. That productivity is powerful, but it also means one bad instruction or compromised tool can quickly become a security incident. Threat Locker helps organizations use AI without losing control. Put zero trust guardrails around tools like Claude Code and control exactly what they can execute, access and connect to. Set clear boundaries around the applications, files, systems and online destinations your AI tools are permitted to use. Because approved AI tools should not mean giving it unrestricted access to your environment. Control what runs, control what it can do, control what it connects to. Learn how Threat Locker can help you safely embrace AI at threatlocker.com/wired.

• 40:18Speaker 01

  That's T H R E A T L O C K E R dot com slash wired.

• 40:23Speaker 00

  This holiday, all plans, even unlimited, are just $15 a month. A holiday deal this good obviously deserves an enormously expensive holiday song, like "All I Want..." Right, okay, we can afford that. You know what? Forget the music budget. We're gonna stick with whatever's in the public domain. Give it a try at mintmobile.com/switch.

• 40:42Speaker 07

  Upfront payment of $45 for three months, $90 for six months or $180 for 12-month plan required. $15 per month equivalent. Taxes and fees extra. New customer offer for initial plan term only. Greater than 50GB may slow when network is busy. See terms.

• 40:54Speaker 00

  Traditional home security only alerts you after a break-in, and that's too late. SimpliSafe is changing that.

• 41:00Speaker 04

  Stop, this is SimpliSafe. Police are on the way.

• 41:03Speaker 00

  We don't just alert, we help stop crime before it starts. Plans starting around $1 a day. Right now, get 70% off your new system with professional monitoring at simplisafe.com/spotify. SimpliSafe, ahead of crime in real time. Outdoor deterrence plans start at $49.99 a month. Visit simplisafe.com/licenses for alarm license information.