“Every camera that tracks a Uyghur through the streets of Kashgar began its life as a line in a budget.” Massimo Introvigne opens Bitter Winter’s account of a new C4ADS report with that line, and the study behind it, “Monitoring the Frontier”, follows the trail of tenders, signatures and paid invoices through the procurement archives kept by the Chinese state. The map it produces is commercial: which companies built the lenses fixed on Tibetans, Uyghurs, Mongols and Hongkongers, which installed them, and who sent the bill.
The Washington-based research group chose its evidence deliberately. It explains that “government records offer a novel lens on China’s surveillance apparatus because, unlike secondary public reporting or victim testimony, they document the state’s purchasing decisions and reveal which companies and technologies underpin its surveillance infrastructure.” Survivors can describe life under the lenses, the logic runs; the contracts add the names of those who built and billed for them.
Sifting the mountain took a sieve: a list of 165 Chinese-language terms used as filters, among them facial recognition, biometrics and big data. One keyword alone might surface in a tender for classroom computers or a set of traffic lights, so the team flagged records carrying two or more surveillance terms, on the reasoning that co-occurrence raises the odds a contract was genuinely about digital surveillance infrastructure.
The Xinjiang ledger
Xinjiang offers the grimmest ledger. C4ADS flagged 368 contracts there carrying two or more keywords, and police loom large among the customers: public security bureaus appear as the listed buyer in 55 of them. Xinjiang Zhixiang Technology Co., Ltd. leads the suppliers’ table with 14 contracts. China Mobile’s branch in the region follows with 10, and CCS Public Information Industry Co., Ltd. holds seven. Sanctioned names recur too. Tiandy and Uniview are both barred in the United States, the report notes, “due to their involvement in human rights violations, high-tech surveillance, and mass arbitrary detention of Uyghurs and other ethnic minorities in the PRC.”
One entry reads like a stage direction. In 2024, a Twelfth Division public security bureau under the XPCC hired Shanghai Sailing Information Technology to outfit a law enforcement case management center, with shopping-list items including units for biometric data collection and deep-learning cameras. The XPCC, the paramilitary colonising enterprise that has administered huge parts of the region since the 1950s, is the buyer; the supplier sits under a sanctioned shadow, being 100% owned by an entity on a U.S. Department of Commerce BIS list. Yet the maker of the branded equipment used in the project, Hisign, faces no restrictions itself despite the connection.
Grasslands and Hong Kong
In Inner Mongolia, where protests broke out in 2020 among Mongol parents and students as schooling shifted away from their language, the file thickens. Thirty-nine of the 692 flagged contracts there listed one of China’s three largest telecommunications companies, and one name repeats like a refrain: Hangzhou Hikvision Digital Technology Co. Ltd., sanctioned in Washington years ago, is mentioned in 1,094 of the Inner Mongolia contracts.
Hong Kong’s cameras arrive in the open. Records document plans for “the Hong Kong Police to deploy facial recognition in CCTV,” and Government Gazette notice after notice charts the spread of “surveillance cameras with AI facial recognition”. In a city where protesters once lifted umbrellas and put on masks to hide their identities, the lenses overhead are built to defeat exactly that.
Locking the front door
The report’s policy section circles back to Hisign, urging regulators and companies to scrutinise its operations, its overseas investments and its unsanctioned biometric production. It argues for tighter export controls on biotechnology and related intellectual property that reaches Chinese government partners, for enhanced human rights due diligence from European technology firms, and for treating routine telecom-subsidiary contracts as a distinct enforcement gap, since China Telecom, China Mobile and China Unicom subsidiaries keep supplying the infrastructure of control.
Behind the recommendations sits a sober finding. “Restricting investment in parent companies has not stopped subsidiaries from supplying equipment and services at the operational level,” C4ADS observes, and it calls for Entity List additions aimed at specific subsidiaries, or import restrictions. Sanctioning the parent while its offspring carry on bidding for police contracts, Introvigne writes, leaves a house with a locked front door and every window open.
Read together, the dry procurement notices compose a portrait. China’s surveillance state doubles as a marketplace, thick with intermediaries, subsidiaries, buyers and sellers. Every transaction leaves a record. From Urumqi to Lhasa, from the steppe to Hong Kong’s streets, the cameras overhead carry a price tag and a corporate pedigree, and a reader patient enough to follow the paperwork can trace both.
