Why China’s COVID-tracking QR codes raise surveillance concerns

Chinese police have extensive surveillance capabilities at their disposal – including a vast network of mounted cameras that canvass public places – as they pursue protesters who spoke out last month against China’s stringent COVID-19 policies. Yet even more ubiquitous than the cameras is a relatively new tracking tool: the individual digital health QR codes that live on the cellphones of nearly all residents.

Designed for contact tracing, the health codes are key to enforcing China’s COVID-19 rules, and now constitute one of the most widely used population control technologies in the world. 

Chinese who took to the streets to demand freedom from lockdowns and COVID-19 tests are acutely aware that the required health codes on their cellphones track not only their COVID-19 risk status, but also their minute-by-minute movements – where they go, how they travel, and the people they encounter – data that is available to police.

While it’s uncertain whether police officers are leveraging health code data as they swarm cities, stake out protest locations, and crack down on unrest, there have been cases in recent months of Chinese authorities abusing the codes to block demonstrations. 

Ng Han Guan/AP

Residents show their health code before they enter a market as restrictions are eased in Beijing, Dec. 3, 2022. Chinese authorities on Saturday announced a further easing of COVID-19 curbs with major cities such as Shenzhen and Beijing.

A key question now – as China’s leaders downplay the severity of COVID-19 and begin to ease restrictions – is whether the health codes will be abandoned, or instead “normalized” and repurposed for other uses, experts say.

While loosening the COVID-19 rules is likely to increase public expectations that the country will end the health code system, Chinese authorities have already suggested they may want to retain the powerful surveillance tool. Legal scholars in China have started pushing back against that possibility, saying the codes contain sensitive personal information and should only be used temporarily and for specific emergencies.

“When the epidemic is over, the health code should be abandoned,” says Liu Deliang, law professor and dean of the Asia-Pacific Institute of Artificial Intelligence Law at Beijing Normal University. “Continuing to use it would result in unreasonable harm to people’s freedom.”

The use – and abuse – of China’s health codes

After the epidemic swept the city of Wuhan in 2020, causing thousands of deaths, most Chinese residents accepted the use of the health codes as a necessary means of curbing the outbreak. The codes have helped keep cases and casualties in China low compared with many other countries.

But the technology also created an unprecedented new surveillance capability in each person’s pocket. The health codes use a green, yellow, and red stoplight system for COVID-19 risk status, and people are required to scan their mobile QR code wherever they go. Only those with green codes can enter public places – from grocery stores and apartment buildings to train stations and parks. People with yellow and red codes are quarantined at home, in shelters, or in hospitals.

The health codes link people’s ID cards, facial features, phone numbers, vaccination status, and COVID-19 test results, using cloud computing and big data, while tracking their movements through mobile communication networks.

Over the past three years, the use of the codes has expanded – for example, by enforcing frequent testing and by linking the codes to public transit systems.

But they have also put a new tool in the hands of authorities – from neighborhood committee members to city and provincial officials – that has led to arbitrary use and abuse of the codes.

In June 2022, authorities in the central province of Henan deliberately turned the health codes of more than 1,300 people around the country red to prevent them from protesting over a bank scandal in the Henan city of Zhengzhou.

In July, officials in Henan’s Minquan County automatically gave red and yellow codes to all residents – regardless of health status – in a draconian bid to try to prevent the spread of COVID-19. That same month in Wuxi, Jiangsu province, authorities announced people must conduct rapid COVID-19 tests two or three times a day, and violators would have their credit investigated and be blocked from entering public places.

“When will the abuse of health codes stop?” wrote Hu Bin, a lecturer at the China University of Political Science and Law, in an August article. Once such technical tools are in the hands of officials, “they can easily be abused and cause serious consequences.”

Thomas Peter/Reuters

People hold white sheets of paper in protest of COVID-19 restrictions, after a vigil for the victims of a fire in Urumqi, as outbreaks of the coronavirus continue in Beijing, Nov. 27, 2022. While it’s uncertain whether police are leveraging health code data as they crack down on the unrest, there have been cases in recent months of Chinese authorities abusing the codes to block demonstrations.

Tool of social health?

“The misuse of the health code information – by adding requirements and forcibly giving people red codes – restricts people’s movements … and violates people’s interests,” says Dr. Liu. He says China needs laws to clarify its epidemic control measures and the legality of health codes in the context of protecting citizens’ basic rights.

Still, Chinese authorities have floated the idea that the health codes could become routine, while some localities have already attempted to expand their use into new domains.

“The zero-COVID-19 policy may go away, but some of the policy tools may be retained in building the so-called surveillance state in China,” says Yanzhong Huang, director of the Center for Global Health Studies at Seton Hall University in South Orange, New Jersey. The health code system “essentially provides a proof of concept that it can work.”

“The state, whether it’s on the local level or the national level, they have every incentive to keep these tools as mechanisms for their general ‘governance’ purpose,” says Xiao Qiang, a research scientist at the School of Information at the University of California, Berkeley.

Health codes could become expanded or normalized, just as subway security checks did after the Beijing Olympics in 2008, says Jeffrey Ding, assistant professor of political science at George Washington University.

“The fear is that this becomes not just about COVID control but takes on this broader meaning of social health,” says Dr. Ding, publisher of the ChinAI newsletter about artificial intelligence in China.

Pushback expected

Such efforts can backfire. The coastal city of Suzhou sparked controversy in late 2020, for instance, when it tried to popularize a “civilization code” that would mete out punishments and rewards based on whether people obey traffic laws or engage in volunteer work. “Citizens with high civilization points will enjoy priority and convenience in work, life, employment, study, and entertainment,” said the official announcement.

“Will you be told you cannot be offered the job because you are not civilized?” one person commented online.

Following a public outcry, the Suzhou initiative was withdrawn after only four days, reflecting concerns of citizens over what was viewed as government intrusion into their private lives. “There is pushback from Chinese people in terms of what society they want to live in,” says Dr. Ding.

Similarly, the recent outpouring of popular frustration over China’s strict zero-COVID-19 policies suggests that retaining the health code system in a post-pandemic world may be met with significant opposition.

“If there isn’t a reasonable purpose for the health code, the ordinary people will complain,” said one Beijing worker, standing outside a park closed due to the city’s record outbreak. “They won’t accept it.”