State media leading backlash against local abuse of China's health codes

And what exactly are "health codes" and how they work

Some unidentified authorities in Zhengzhou City, Henan Province have apparently abused China’s 健康码 “health codes” against frauded bank depositors who were petitioning local authorities. (Sixth Tone, BBC, Reuters, $South China Morning Post, $Bloomgberg)

And this newsletter explains what exactly are "health codes," how they generally work, what happened in this case, and how China’s state media have emerged as strong critics against expanding their use for government purposes beyond COVID control.

China mandates SIM cards in smartphones be registered to a named individual backed by identity documents. Mobile carriers/Telecommunication operators can tell the approximate location of SIM cards/smartphones through cellular connection records. So, with their cooperation, the government can tell who was approximately where at which time.

Since the COVID-19 pandemic, “health codes” have become ubiquitous (SCMP) in China, at the order of the government. Almost everyone has their own health codes - QR codes accessed by scanning - on their smartphones, mostly as “mini-programs” within Tecent’s WeChat or Ant’s Alipay.

These codes are also linked with real individuals, so technically the codes can be used by the government to alert people if they have been in close contact with COVID-infected persons, provided the latter give a detailed record of their whereabouts in the past, say, two weeks.

This is the information infrastructure for a big chunk of contact tracing in China in COVID times.

Let’s say Joe tested positive for COVID today, and he told the contact tracers that he visited a certain Walmart yesterday afternoon between 3 pm and 4 pm. So the authorities can, via mobile carriers’ records, trace the visitors to that Walmart in that period of time, contact them, and turn the color of their health codes.

The colors are red, yellow, and green. Green means you are OKay. Yellow means you are medium-risk, and red means you are at high risk, perhaps due to close contact with a COVID-infected person.

Later, the government requires that every office/mall/cafeteria/restaurant/etc. prominently displays their respective identification QR codes (now known as 场所码 codes for places in some parts of China, but not Beijing) and everyone who enters must scan them.

It is about establishing a detailed and accurate record of who visited where at which time, so whenever a COVID case is discovered, it will be much easier to trace close contacts - and supposedly without the cellular records from mobile carriers. It is also used to ban high-risk individuals from entering the places.

So that’s about it. And one can easily tell the potential for abuse here - what if somebody or a government department uses their color-turning authority in the health codes on matters unrelated to COVID?

Cai Yineng 蔡一能, an editor at Sixth Tone, the Shanghai-based “China state-affiliated media” according to Twitter, warned in an editorial in April 2020:

According to a notice issued by the Cyberspace Administration of China in February, the collection of personal information for the purpose of disease prevention should “be kept to a strict minimum” and must “generally avoid targeting people in a specific area to prevent de facto discrimination.” The Chinese government should give clearer signals that these outbreak monitoring systems are temporary expedients and should be used only for their original purpose: facilitating movement and freeing people from cumbersome health checks. Companies should be required to disclose the criteria used for assigning red, yellow, or green codes; to limit the circumstances under which the codes may be used; and to ensure the systems — and the relevant data — are discarded once the outbreak is over.

I want to emphasize that the system of health codes appears, as far as I can tell, fragmented. That is to say, there isn’t a centralized office or supercomputer running the codes for the 1.4 billion citizens. Instead, local governments, probably at the 市 city level (China has 300+ cities), run their respective systems.

That leads to a double-edged sword. On one hand, there isn’t one single Big Brother in charge of this matter so it’s not yet Black Mirror. In fact, perhaps contrary to popular perceptions in the West, the coordination between regional governments was so bad in the early days that City A just wouldn’t recognize health codes from City B.

On the other, an official in a local government - where you may have other business before them - may be able to change the color of your health code, as long as they have your ID information or cellphone number (they are linked anyways).

And that’s where the recent headline-making abuse kicked in. As Sixth Tone reports,

People who have arrived in Zhengzhou to withdraw money from embattled regional banks said they have found their health codes turn red — a label mostly reserved for potential COVID-19 carriers or those infected with the virus — after arriving in Henan province’s provincial capital, prohibiting them from accessing transportation networks, public services, and even going to the banks to lodge their grievances.

Thousands of depositors have attempted to withdraw money in person from at least four of Henan’s regional banks with tens of billions of yuan in frozen deposits since April. The move came after Sun Zhenfu, a shareholder of one of the banks, fled following “serious financial crimes” in March, according to media reports.

At least 12 depositors Sixth Tone spoke with said their health code turned red when they scanned city-specific QR codes at railway stations, hotels, and other venues that required them.

It remains unclear who or which government department came up with this idea and executed it, but the public backlash online has been fierce - and hopefully enough to deter the next abuser. And China’s state media are pulling no punches in this case.

侠客岛 Xia Ke Dao, an offshoot from the overseas edition of People’s Daily, has a commentary:

给维护正当权益的储户赋红码，不知是哪个“天才”想出来的主意，更不知这种明显有违常识、法治、公理的操作，怎么就能堂而皇之地施行！

We don't know which "genius" came up with the idea of giving red codes to the depositors who were defending their legitimate rights, and we don't know how such an operation, which is clearly against common sense, the rule of law, and justice, can be carried out in a dignified manner!

这样莫名其妙的红码，难免让人质疑是以“疫情防控”之名，行“处理维权”之实，将矛盾延后、推迟。

These inexplicable red codes inevitably makes people question it is “dealing with rights defending matters” in the name of "epidemic prevention and control," which could only delayed the problem-solving [of the depositors’ issues].

不客气地说，疫情防控措施被随意用于“社会治理”或“维稳”目的，不管是哪个部门、哪些人授意干的，都应被严肃追究责任。

To be frank, no matter which department or which people authorized the arbitrary use of epidemic prevention and control measures for the purpose of "social governance" or "stability maintenance", they should be seriously held accountable.

***

照这逻辑，所有棘手的社会矛盾、久拖不决的纠纷、不想处理的麻烦，一个红码了事，多么省心又潇洒！问题解不解决不知道，反正你们老实待着，哪儿都甭去。

According to this logic [of applying red codes to “trouble-makers”], all the difficult social problems and long-drawn-out disputes that nobody wants to take care of can be solved with the red code. How easy! “We don't know if the problem will be solved, but you stay home and don't go anywhere!”

这不是解决问题，而是在激化矛盾。这不是“聪明能干”，而是典型的懒政塞责。想出这些主意的人挺会抖机灵，可惜脑筋动歪了。

This is not solving the problem, but intensifying it. This is not "smart and capable", but a typical example of lazy government and shirking responsibility. The people who came up with these ideas might thought they were quite clever, but unfortunately, their brains are skewed.

以前，有的地方滥用本应限于金融领域的征信，把什么街上光膀子、闯红灯都纳入征信，一个衡量按时偿债能力和意愿的金融工具愣是被某些人搞成了社会治理的“筐”，啥都往里装，岛上专门批评过。

In the past, some local regions abused credit information which should have been limited to the financial field, incorporating bare-chested walking on the street and running red-lights into personal credit information. A financial tool to measure the ability and willingness to repay debts on time was thus turned by some people into a “basket” for social governance that can include everything. We have specifically criticized that.

[Pekingnology: Yes, it is commenting on some local experiments in the much-touted 社会信用体系 social credit system. By the way, here is a recent, clarifying podcast by Spectator’s Cindy Yu interviewing Vincent Brussee with Merics and Jeremy Daum with China Law Translate.]

最近也有地方出台政策，只要你这个社区多长时间没有信访人员，区内孩子中招考试降几分录取，结果刚出台一两天，就在舆论压力下“承认考虑不周”。

Recently, a place also introduced a policy that as long as your community doesn’t have petitioners, the students in the community could benefit by getting a few points in the high school admissions exam. The result? One or two day after its introduction, the place, under public pressure, "admitted to poor consideration."

类似的“骚操作”怎么总出现？归根结底是缺乏法治意识。辖区内没有上访就降分录取，凭什么？于法有据吗？对其他辖区的孩子公平吗？同理，为防疫更加科学精准而采取的健康码赋码措施竟然可以用于其他目的，依循何法？滥用防疫手段破坏规则，会带来什么样的恶果，想过吗？

How do similar "tumultuous operations" always appear? The root cause is the lack of awareness of the rule of law. No petitioners in the community so a few added points for the students there? How come? Is there a basis in law? Is it fair to the students of other communities? By the same token, based on what law that health code assignments for epidemic prevention can be used for other purposes? Have they thought about the bad consequences of breaking the rules by abusing epidemic prevention?

中国能取得疫情防控的巨大成果，基础是高效精准的科学手段和对政策规则的普遍遵守。健康码称得上疫情防控的信息基础设施，一些人基于自己的治理“小目标”，耍小聪明出昏招，不仅于事无补，更会失信于民。

China has achieved great results in epidemic prevention and control based on efficient and accurate scientific methods and general compliance with the policy. The health code is the information infrastructure for epidemic prevention and control. Some people playing smart and faint tricks based on their own "small goals" of governance are not only unhelpful, but will also lose the faith of people.

An editorial from the Global Times, which is a translation of their Chinese-language editorial 环球时报评储户“被红码”：必须维护健康码的科学性严肃性

Scientificity and seriousness of health code must be maintained: Global Times editorial

***

However, these [Zhengzhou city government] replies are apparently not enough to quell doubts. According to  information spread online, it seems that the "red codes" were "precisely" given to those bank deposit holders. Some of these people told the media that after they scanned the health code to fill in their personal information, their code appeared red and the reason given was that "they needed to sit in quarantine". But those non-bank deposit holders who took the same trip to Zhengzhou didn't encounter the same problem. In addition, according to media reports, several depositors who didn't go to Zhengzhou were also given red codes after filling out their information.

To know the truth requires a more in-depth investigation and a more authoritative answer. The health code is a technical means designed to make the public compromise some personal information rights to comply with the needs of society's public health security. It can only be used for epidemic prevention purposes. It is the responsibility of the relevant authorities to protect the privacy of citizens to the greatest extent during the epidemic prevention process. If speculation of the abuse of the power to misuse the health code is allowed to circulate on the internet, it will generate damage to the government's credibility. Whether the situation circulated on the internet is in line with the facts, it is necessary for the local authority to give a convincing response.

Misuse of health code-related information is not a trivial matter. If someone tries to use the health code for purposes other than epidemic prevention, this kind of behavior is not only against social morality, but also suspected of violating the law or regulation. As to how personal privacy is protected, there are clear specifications in the series of national standards for personal health information code issued by the State Administration for Market Regulation -- that is, the collection, processing and utilization of personal health information should comply with the national standard "Information security technology - Personal information (PI) security specification," and the latter clarifies that the PI controllers shall establish a minimum access control policy for the personnel with authorized access to PI, so that they could only access minimized PI necessitated by their duties and have minimized data operation authorization to fulfill their duties.

There is a high degree of consensus throughout society that health code information should never be misappropriated. In fact, the vast majority of the country is becoming more and more cautious in protecting privacy when it comes to handling relevant information. For example, when announcing the epidemiological investigations recently, many places have avoided disclosing information that is not related to epidemic prevention. It is because of this strong consensus that people are sensitive to any hint of a breach of this bottom line, and no one should take a chance that they can cheat the public on this issue. 

The role of the health code in the regular epidemic prevention and control is so pivotal that its scientific nature and seriousness must be maintained. Some grassroots disputes or "technical errors" must not be allowed to affect public confidence and the overall situation in the fight against the epidemic. The relevant departments in Zhengzhou should conduct prudent and strict investigation and verification. The process should be expedited as much as possible. If this is caused by technical problems, a complete and convincing chain of evidence must be presented; if there is indeed regulation-violation in the process, they must be corrected as soon as possible.

胡锡进 Hu Xijin, the former Chief Editor of the Global Times who remains a pivotal opinion maker in China’s public opinion, led the pushback in his Weibo post yesterday

作为一名老媒体人，我想提醒，各地的健康码只应用于纯粹的防疫目的，在任何情况下都不应被地方政府用于与防疫无关的其他社会治理目标，这一规则各地务需坚守。如果有哪个地方为了其他目的通过调控健康码阻止特定人员流动，这显然违反相关防疫法规，也会损害健康码的威信，损害公众对防疫的支持。这对我们的整体社会治理是得不偿失的。

As a veteran media professional, I would like to remind that health codes everywhere should only be used for pure epidemic prevention purposes, and under no circumstances should they be used by local governments for other social governance goals unrelated to epidemic prevention, a rule that everywhere must adhere to. If any locality prevents the movement of specific people by regulating health codes for other purposes, this is clearly a violation of the relevant epidemic prevention regulations and will also undermine the prestige of health codes and public support for epidemic prevention. This does more bad than good to our overall social governance.

It should be noted that media outlets such as the 第一财经 Yicai and 南方都市报 Southern Metropolis Daily played a pivotal role in bringing the incident to public attention in the first place.