Reading the Zhangjiakou Foreign-Personnel Platform Story on the Facts Alone

Hello, this is Ryuta Hamamoto from TIMEWELL.

Last week it was reported that a system for managing foreign nationals, apparently designed for the public security bureau in Zhangjiakou, Hebei province, had been reachable from the open internet for a period¹. Roughly 12,000 records, of which more than 300 belonged to foreign journalists. Screenshots included the names of the Hokkaido Shimbun and Bloomberg².

Stories like this run hot very quickly, so let me state my position up front. This article does not condemn China. It does two things: separate what has been confirmed from what is reported, and work out how companies should redesign the way they run expatriate assignments and business travel. The emotional response belongs to each reader. It is not mine to supply.

There are two separate reports. Mixing them blurs the facts

Some sorting is required first. This is not one scoop but two pieces of reporting, from different outlets at different times. Blur them together and you lose track of what has actually been corroborated.

The Telegraph came first, publishing an exclusive in May 2026. Its correspondent Sophia Yan wrote that her own record was in the platform, containing her passport number, mobile number and place of work, and marked "trackable"³. The description of a dedicated journalist inquiry section holding passport numbers, ID photos, private cellphone numbers and dates of birth also comes from that report.

The second is The New York Times piece of August 2, 2026¹. Its starting point is Marc Hofer, an Amsterdam-based cybersecurity researcher and journalist, who in January 2026 found a dashboard reachable from the open internet. By May it was no longer accessible². The Times reported on data Hofer had saved and shared with them.

The Japanese wire copy that circulated on the 3rd and 4th, from Jiji, Kyodo and Yomiuri alike, was all secondary reporting off the Times². Each says so explicitly. Knowing that lets you place any fragment you see on social media in one lineage or the other.

One more thing belongs in the frame. According to the Times, the company identified as connected to the platform and the Zhangjiakou Public Security Bureau both declined to respond to requests for comment¹. I could not find an official statement from China's foreign ministry either. So this is reporting that stands without an account from the parties involved. Nothing I found contradicts it, but that characteristic is worth keeping in view while reading.

What was reportedly recorded

The system is referred to as the Dynamic Control Platform for Overseas Personnel. Zhangjiakou co-hosted the 2022 Beijing Winter Olympics and is known as a ski destination.

The specific fields are the heart of the story. Birth date, sex, marital status, address, occupation. That much reads like ordinary residency administration. The reporting gets more specific after that: flights taken and trains ridden, down to the seat number¹. Hospital visits. Gas payments. Separate streams of data from surveillance cameras, medical records, bills and facial recognition, pulled together into a single record for one person.

Around 12,000 records in total. More than 700 foreign residents of the city, more than 300 foreign journalists, plus people from Hong Kong and Taiwan and foreign students¹.

That breakdown has direct operational consequences. If the city's foreign resident population is around 700 and the total is 12,000, most of the records belonged to people who did not live there. Short business trips and transit connections count. Internal discussions almost always open with "how do we protect our expatriates," but by headcount, most companies send far more travelers than they post. Unless the same assumptions reach the person who visits twice a year for three days, the largest group stays untouched.

The Telegraph reporting adds one capability beyond individual records: relationship modelling, mapping who a person met, how often, and in what context³. Lines and surfaces rather than points. That is the part that caught me as a practitioner. You can be careful about your own movements and still have your outline drawn from the other side of the meeting.

I should note that explanations circulating on social media describe AI automatically generating personal profiles, and automatic alerts to police when someone enters a jurisdiction. That is where I first encountered the story too. Neither held up against the reporting I was able to check⁴. Since I cannot support them, they stay out of this article.

For the legal framework on the Chinese side, meaning how the anti-espionage law and the national intelligence law bear on expatriates and corporate data, I worked through the statutes in anti-espionage law, national intelligence law and the risk to Japanese companies. This piece stays on how to read this particular story.

"One uniquely dangerous country" is probably the wrong frame

This is the part I most wanted to write.

Reading a story like this, it is tempting to land on "so that's China for you." As an operating stance that makes your countermeasures sloppy, because they end up driven by feeling. Travel or don't travel. The discussion ends on that binary.

Look at it more coldly and the structure being reported is this: multiple government-held databases, resolved to the individual, arranged so a person can be followed over time. That structure is not unique to China. Immigration records, transport bookings, medical records, utility bills. Governments and operators everywhere hold these. What differs is how far a legal system permits them to be joined across silos, and who is allowed to look at the result.

An aside, but the technique of resolving records to a person and tracing relationships is adjacent to what we work on every day. Counterparty screening in export control links corporate registries, ownership structures and co-authorship on papers and patents to surface concerning connections. The shape of the work is similar. What differs is purpose, and the controls governing who may see how much. Calling the technique itself evil gets the argument nowhere, and the same technique is what finds sanctions evasion. The controls are what deserve scrutiny. That is where I come down.

So the operational question is not "which country is dangerous" but what records are we generating in the places we travel to, and how far can those be joined. Framed that way, the procedure does not change when the country does, and you stop spending meetings on an unanswerable question.

On top of that, two elements here land specifically for Japanese companies. First, journalists from Japanese outlets were among those reported. Knowing that Japanese nationals can concretely be in scope carries operational weight on its own. Second, the granularity. If train seat numbers persist, then "who traveled on the same train" can be reconstructed after the fact. The combination of who accompanied a trip and which sites were visited often says more than the movement itself.

If you want a quick read on your own economic security exposure across overseas sites and counterparties, the free export control and economic security assessment is a reasonable place to start.

Change the design, without drama

So what do you actually do? Nothing dramatic is required. It sits on top of procedures most companies already wrote for anti-espionage law compliance.

Start by minimizing what travels. A dedicated travel device instead of the production laptop, data limited to what that specific trip needs, local accounts separated from the corporate identity. Most firms already have a policy covering this, so the honest read of this story is that it is a prompt to re-check whether the policy is actually being followed. Policy on paper, loose in practice, is the most common state I see.

Next, movement and meeting records. Know precisely who went where and met whom, on your own side. Not because you are being watched, but so that you can explain yourself from your own records if you are ever asked. The weakest position is one where the only record belongs to the other party. It is the same instinct as keeping transaction records in export control.

Something else that gets missed: consideration for local counterparties and partners. If relationships can be recorded, what lands in those records is not only your employees. Who someone met is information about the other party too. This is not an argument for fewer meetings. It returns you to the ordinary discipline of meeting in ways that make sense from the other side as well. Keep the purpose and background of a visit in your own records and you have material that serves both parties later. Letting local relationships wither out of excess caution is, in economic security terms, a net loss.

Then the handback. Wiping the travel device, disabling local accounts, checking the path by which any data came home. Dull work, and reliably where the gaps are.

One last note on how to communicate this internally. Share a story like this as "it's dangerous, be careful" and people tense up without changing behavior. "Work on the assumption that records persist" is neutral, and in practice it gets followed. Fear does not move people. A changed premise changes procedures.

The use of simply having the facts

To recap. On August 2, 2026 The New York Times reported that the dashboard of a foreign-personnel management system, apparently designed for the Zhangjiakou public security bureau, had been reachable from the open internet. It was found by an Amsterdam-based researcher in January 2026 and was no longer accessible by May. Roughly 12,000 records, more than 300 of them foreign journalists. Granularity reportedly extends to train seat numbers and hospital visits. The company identified as connected and the bureau in question did not respond to requests for comment.

The earlier Telegraph reporting, from May 2026, is where the "trackable" label and the relationship modelling come from. Different lineage, so cite them separately. The claims circulating about automatic profile generation and automatic alerts did not check out against anything I could reach.

What I took away was less surprise than recognition. Resolving government-held data to a person and making it followable over time is not technically remarkable. Which is exactly why building it in as a premise beats being shocked by it. Write down what records you generate when you travel and the list will be longer than you expect. Starting there is enough.

If you want to revisit how you run overseas operations and travel policy through an economic security lens, the thinking behind TRAFEED may be useful. For a conversation about your specific situation, get in touch.

---

Footnotes

1. The New York Times, "How China Keeps Tabs on Foreigners" (Lily Kuo and Pei-Lin Wu, August 2, 2026). The system name "Dynamic Control Platform for Overseas Personnel," the fact that it appeared designed for the Zhangjiakou Public Security Bureau, the roughly 12,000 records including more than 700 foreign residents of the city, more than 300 foreign journalists, people from Hong Kong and Taiwan and foreign students, the recorded fields (birth date, sex, marital status, address, occupation, flights and trains taken including seat numbers, hospital visits, gas payments, and the aggregation of surveillance camera, medical record, billing and facial recognition data), Marc Hofer having shared saved data with the paper, the connection drawn to the Beijing company Origin Dynamic (partly owned by the Yancheng city government), and the fact that the company and the bureau did not respond to requests for comment, all come from that article. https://www.nytimes.com/2026/08/02/world/asia/china-surveillance-foreigners.html / Text verified via a reposted version. https://u.osu.edu/mclc/2026/08/03/how-china-keeps-tabs-on-foreigners/ ↩ ↩² ↩³ ↩⁴ ↩⁵

2. Jiji Press, "China's foreign surveillance data temporarily open; Japanese journalists listed — US paper reports" (distributed 07:11, August 4, 2026), reporting the New York Times account: that the system appeared to belong to the public security authorities of Zhangjiakou, Hebei; that Marc Hofer found it in January 2026 and it was no longer viewable by May; and that screenshots showed pixelated ID photos alongside the names Hokkaido Shimbun and Bloomberg, with journalists' names, sex, nationality and passport numbers apparently listed. https://www.jiji.com/jc/article?k=2026080400160&g=int / Kyodo News and Yomiuri Shimbun carried the same substance. All are secondary reporting off the US paper. ↩ ↩² ↩³

3. The Daily Telegraph exclusive (May 2026, Sophia Yan). The characterization of the platform as tracking foreigners, journalists and individuals deemed of interest to the state; the reporter's own record containing her passport number, mobile number and place of work and marked "trackable"; the journalist inquiry section holding passport numbers, ID photos, private cellphone numbers and dates of birth; and the relationship modelling function linking who was met, how often and in what context, all come from that reporting. The paper's own announcement: https://x.com/Telegraph/status/2056756282623725664 / As of writing, the article text sits behind a subscription and could not be verified directly; the above rests on the paper's own announcement and citations in other outlets. ↩ ↩²

4. Explanations circulating on social media describing AI automatically generating personal profiles, and automatic police alerts triggered when a person enters a jurisdiction, could not be confirmed in any of the reporting above at the time of research, and are therefore not treated in this article. The same applies to any official comment from China's foreign ministry. ↩