135 biometric contracts unsealed Xinjiang: the view on the sanctions list remained through third parties to the project

The cameras are just one of the most visible layers of Xinjiang's large-scale surveillance system. The real decision on monitoring capacity is the data centre, server, algorithm, database and procurement network that connects different equipment after the camera.

The weekly report released on 2 October by the World Uighur Congress again focused on the recent C4ADS survey. After combing government procurement and business relations, including in Xinjiang, 135 contracts involving biometric data collection techniques were discovered in Xinjiang; The Chinese monitoring company UNIVIST, which has been sanctioned by the United States, has been involved in 54 related contracts and has been able to enter the project through a significant number of third-party enterprises.

This figure is not important in proving how many cameras China has installed, but rather in revealing the gap between sanctions and actual procurement: even if an enterprise is on a restricted list, as long as equipment, software and services continue to flow through integrated dealers, distributors and project contractors, the monitoring infrastructure will not be stopped by the name of a company on the list.

Xinjiang surveillance has been upgraded from "Seen" to "Counter"

The core functions of traditional urban surveillance are video and ex post. The system formed by Xinjiang brings together face, identity cards, communications, vehicles, location and other behavioural data into an infrastructure that can be analysed on a continuous basis.

C4ADS previously stated in Hardwired Renewal that data centres are the basic layer of the system that is easily ignored. A large amount of biometric and behavioural data must be stored, matched and processed by the server to convert an average resident into a data object that can be screened, marked and tracked by algorithms.

This means that human rights risks do not exist only “who made the camera”. Servers, hard drives, processors, network equipment, database software and system integrators may be part of the chain of control.

54 contracts, visualization, which indicates that the supply chain is more complex than the sanctions list

WIT has long produced video surveillance and smart security devices and has been restricted by the United States for human rights issues in Xinjiang. The C4ADS combing contract, however, shows that the visualization still occurs frequently in the relevant monitoring projects, many of which are not in the form of direct contracting by the manufacturer.

Government procurement usually involves the local systems integrator in the overall project, and then the camera, storage, identification software and network equipment from different manufacturers. This multilayered structure, which can hide the final manufacturer deep within the project chain, makes it more difficult for foreign Governments and enterprises to judge whether technology eventually enters Xinjiang's monitoring system on the basis of a first-level supplier list.

Therefore, a truly effective supply chain review must move from a “corporate list” to a “contract network”. It is not only the company that needs to be tracked for winning the bid, but also the company that won the bid whose equipment was purchased, where the software licence came from, who provided follow-up maintenance, and which foreign technology is required to be compatible with hardware.

Surveillance mode is not limited to Xinjiang

The latest studies have placed control technologies in the same structure as Xinjiang, Tibet, Inner Mongolia and Hong Kong. This is not to say that the four regions have identical surveillance systems, but rather that Beijing is repeating the logic of digital governance, identification, network control and risk management in different political settings.

Xinjiang is one of the most extreme laboratories of the system. The long-term and large-scale surveillance of Uighurs and other Turkic Muslims is in harmony with detention, religious restrictions, travel control and family separation policies. Technology is not a neutral urban management tool here, but rather an infrastructure for the State to distinguish, screen and intervene in the daily lives of specific communities.

When similar procurement models and technical standards spread to other regions, the question is no longer just Xinjiang human rights, but rather how Chinese party governance transforms digital infrastructure into an infrastructure of political control.

The sanctions really need to be followed to the last kilometre

The United States and other democracies have included many Chinese enterprises involved in Xinjiang surveillance on sanctions or export restrictions lists over the past few years. However, C4ADS contract data reminds that sanctions can be easily diluted by complex supply chains if they remain at the level of business names only.

More effective practices require tracking three directions simultaneously: the actual branding of equipment in government procurement contracts; (a) The equity and commercial relations of intermediate integrated traders with the sanctioned companies; and whether foreign chips, server components and software are still entering the system through third countries or through non-restricted subsidiaries.

The Xinjiang surveillance system can expand in the long term, not only because Beijing is willing to invest huge amounts of public money, but also because the global technology supply chain is sufficiently complex to allow for decentralization of responsibility to dozens of companies and multi-layered contracts.

The structure was concretized by 135 biometric contracts and 54 bio-referenced records. Each contract appears to be a single government procurement, but, by connecting it, it can be seen how a set of national monitoring works can be continuously updated on a commercial network. To block the machine, international sanctions must follow the network as investigators, and not just a few company names should be removed from the list.