,
10 tweets,
3 min read
Read on Twitter
THREAD: How did we find the policing app at the heart of Xinjiang's mass surveillance? It was an accident. Let me tell you. See also: hrw.org/news/2019/05/0…
2 years ago, we started getting reports about Xinjiang's political education camps. In one interview with a Xinjiang resident, my colleague @SophieHRW had the genius to asked this simple, but essential Q: How do the police know who to put in camps?
To this question, the interviewee said, there's a computer system called "yitihua" ("Integrated") and described seeing the system spits out lists of names for police interrogation and detention.
That's how it all started. In the course of researching our Feb 2018 press release about the IJOP, I found the app publicly available.
Not knowing what, if, anything, can be done to an app, I contacted our director of information security @seamustuohy, who recently joined @hrw, because I have a security Q: Is it safe to download it?
.@seamustuohy had experience looking into surveillance apps before. So he did his magic, and gave me a bunch of files which I hardly understand. But in it there are "text strings"--phrases in Chinese like "suspicious person" "immediate arrests" "religious atmosphere"
But it was really difficult to know how the phrases relate to each other because they are in snippets of code. So that's where the reverse engineering part comes in: we enlisted Cure53.
I don't read code; Seamus/Cure53 doesn't read Chinese. So we essentially combined our brains through an intensive, reiterative process of reverse engineering the app.
Just to say the reverse engineering was very, very difficult: first, working on Xinjiang is already like working in codes, with tons of official euthemisms and transliteration complexities. Working on source code on top of that was like decoding two layers of code.
But we managed! Thank you @seamustuohy, Cure53; @meta_lab also provided valuable insights and encouragement. Without them, there is no report. Read it here: hrw.org/video-photos/i…
