The tourists travelling into China were never supposed to know their phones had been compromised.
The surveillance app being installed on their devices should have been removed by the border officers tasked with the job. But their apparent carelessness has provided a rare insight into the techniques used by China to snoop on visitors and the kind of information being harvested from their phones.
Reverse engineering of a copy of the app found on a traveller’s phone by the Guardian, Süddeutsche Zeitung, Ruhr-University Bochum and the German cybersecurity company Cure53 discovered details of how it operates.
The app’s code refers to itself as CellHunter, but the icon that appears on the phone has the name 蜂采 (Fēng cǎi) – which refers to bees collecting pollen.
Unlike some of the advanced technology being used by authorities in the region to surveil citizens, the app is not especially sophisticated. Before the border police can install and operate it, the user has to unlock the phone and hand it over.
The app has two main functions: to extract personal and private information from the traveller’s device and to search for suspicious files.
Analysis shows that the app harvests emails, contact numbers, SMS messages, social media account identifiers and detailed information about the handset, including unique device identifiers.
This information is retrieved and sent for storage on a server on the border office’s local intranet.
Fēng cǎi doesn’t appear to gather detailed information about the phone’s previous locations, only the details of the most recent cell tower it has connected to, and there is no evidence that it tracks their onward movements.
However, by using the device’s identifiers that have been extracted and stored, combined with passport details, the Chinese state could, if it wanted, track travellers via future connections to mobile phone towers.
Our analysis of Fēng cǎi found it searches a phone against a list of more than 70,000 files. This appears to provide a guide to the content the Chinese state considers suspicious, including MP3s, documents and pictures.
Each of the files is identified by its size in bytes and its “hash”, a kind of digital fingerprint. The app searches the phone for files which are the same size and then generates a fingerprint for that file. If both the file size and the fingerprint match something on the list the app registers a “hit”.
Using file hashing databases the Guardian and partners were able to see what the authorities were searching for.
In our sample most of the files were extremist material such as Dabiq and Inspire, propaganda magazines produced by Isis and al-Qaida, but there was also other content that the Chinese state appears to deem undesirable. This includes the writings of the Dalai Lama, work on the history and culture of Xinjiang and content critical of China’s involvement in Taiwan.
The software appears to have been developed in Nanjing by an arm of the Chinese state-affiliated networking company Fiberhome Networks.
The Guardian is only aware of the app being used at the border crossing between Xinjiang and Kyrgyzstan.
There are several stages to the border crossing via the Irkeshtam pass, and at one stage travellers are made to unlock and hand over all their devices. Assuming nothing that concerns the guards is found, the officials are supposed to uninstall the app and return the device to the owner.
The use of the app was discovered when officials failed to uninstall it on some tourists’ phones. They later found it, sometimes only when they returned home.