To protect sensitive data, China’s government has built one of the world’s strictest cybersecurity and data-protection regimes. Despite those efforts, a thriving cross-border underground market has grown up around the trade in the data of Chinese citizens.
Much of that data comes from another of the Chinese government’s big security projects: its extensive surveillance network.
Earlier this month, an anonymous user on a popular online cybercrime forum put up for sale data of an estimated 1 billion Chinese citizens that was stolen from the Shanghai police. The heist was one of the largest in history and included particularly sensitive data, such as government ID numbers, criminal records, and detailed case summaries such as allegations of rape and domestic abuse.
The Wall Street Journal has since found dozens more Chinese databases offered for sale, and occasionally free, in online cybercrime forums and Telegram communities with thousands of subscribers. Four of the stolen caches contained data likely taken from government sources, according to a Journal review, while several others were advertised as containing government data.
Tens of thousands more databases in China remain exposed on the internet with no security, totaling over 700 terabytes of data, the largest volume of any country, according to LeakIX, a service which tracks such databases.
The Ministry of Public Security, Cyberspace Administration of China and Shanghai government didn’t respond to requests for comment.
All countries struggle to keep their data protected. The U.S. is second to China with nearly 540 terabytes of data left open on the public internet, LeakIX’s analysis shows. China is unique, however, for the comprehensive and sensitive nature of its exposed data—a consequence of the way it centralizes multiple streams of information from government and corporate sources on state-run surveillance platforms.
Amassing so much data in a single place inherently increases the risk it will escape into the wild, according to cybersecurity experts. One weak or stolen password, successful phishing attempt or disgruntled employee “can cause the whole system to come down,” says
Vinny Troia,
founder of dark web intelligence firm Shadowbyte, which scans the web for unsecured databases.
Now that vulnerability is undermining Beijing’s efforts to keep…
Click Here to Read the Full Original Article at WSJ.com: World News…