State media leading backlash against local abuse of China's health codes
And what exactly are "health codes" and how they work
Some unidentified authorities in Zhengzhou City, Henan Province have apparently abused China’s 健康码 “health codes” against frauded bank depositors who were petitioning local authorities. (Sixth Tone, BBC, Reuters, $South China Morning Post, $Bloomgberg)
And this newsletter explains what exactly are "health codes," how they generally work, what happened in this case, and how China’s state media have emerged as strong critics against expanding their use for government purposes beyond COVID control.
China mandates SIM cards in smartphones be registered to a named individual backed by identity documents. Mobile carriers/Telecommunication operators can tell the approximate location of SIM cards/smartphones through cellular connection records. So, with their cooperation, the government can tell who was approximately where at which time.
Since the COVID-19 pandemic, “health codes” have become ubiquitous (SCMP) in China, at the order of the government. Almost everyone has their own health codes - QR codes accessed by scanning - on their smartphones, mostly as “mini-programs” within Tecent’s WeChat or Ant’s Alipay.
These codes are also linked with real individuals, so technically the codes can be used by the government to alert people if they have been in close contact with COVID-infected persons, provided the latter give a detailed record of their whereabouts in the past, say, two weeks.
This is the information infrastructure for a big chunk of contact tracing in China in COVID times.
Let’s say Joe tested positive for COVID today, and he told the contact tracers that he visited a certain Walmart yesterday afternoon between 3 pm and 4 pm. So the authorities can, via mobile carriers’ records, trace the visitors to that Walmart in that period of time, contact them, and turn the color of their health codes.
The colors are red, yellow, and green. Green means you are OKay. Yellow means you are medium-risk, and red means you are at high risk, perhaps due to close contact with a COVID-infected person.
Later, the government requires that every office/mall/cafeteria/restaurant/etc. prominently displays their respective identification QR codes (now known as 场所码 codes for places in some parts of China, but not Beijing) and everyone who enters must scan them.
It is about establishing a detailed and accurate record of who visited where at which time, so whenever a COVID case is discovered, it will be much easier to trace close contacts - and supposedly without the cellular records from mobile carriers. It is also used to ban high-risk individuals from entering the places.
So that’s about it. And one can easily tell the potential for abuse here - what if somebody or a government department uses their color-turning authority in the health codes on matters unrelated to COVID?
According to a notice issued by the Cyberspace Administration of China in February, the collection of personal information for the purpose of disease prevention should “be kept to a strict minimum” and must “generally avoid targeting people in a specific area to prevent de facto discrimination.” The Chinese government should give clearer signals that these outbreak monitoring systems are temporary expedients and should be used only for their original purpose: facilitating movement and freeing people from cumbersome health checks. Companies should be required to disclose the criteria used for assigning red, yellow, or green codes; to limit the circumstances under which the codes may be used; and to ensure the systems — and the relevant data — are discarded once the outbreak is over.
I want to emphasize that the system of health codes appears, as far as I can tell, fragmented. That is to say, there isn’t a centralized office or supercomputer running the codes for the 1.4 billion citizens. Instead, local governments, probably at the 市 city level (China has 300+ cities), run their respective systems.
That leads to a double-edged sword. On one hand, there isn’t one single Big Brother in charge of this matter so it’s not yet Black Mirror. In fact, perhaps contrary to popular perceptions in the West, the coordination between regional governments was so bad in the early days that City A just wouldn’t recognize health codes from City B.
On the other, an official in a local government - where you may have other business before them - may be able to change the color of your health code, as long as they have your ID information or cellphone number (they are linked anyways).
And that’s where the recent headline-making abuse kicked in. As Sixth Tone reports,
People who have arrived in Zhengzhou to withdraw money from embattled regional banks said they have found their health codes turn red — a label mostly reserved for potential COVID-19 carriers or those infected with the virus — after arriving in Henan province’s provincial capital, prohibiting them from accessing transportation networks, public services, and even going to the banks to lodge their grievances.
Thousands of depositors have attempted to withdraw money in person from at least four of Henan’s regional banks with tens of billions of yuan in frozen deposits since April. The move came after Sun Zhenfu, a shareholder of one of the banks, fled following “serious financial crimes” in March, according to media reports.
At least 12 depositors Sixth Tone spoke with said their health code turned red when they scanned city-specific QR codes at railway stations, hotels, and other venues that required them.
It remains unclear who or which government department came up with this idea and executed it, but the public backlash online has been fierce - and hopefully enough to deter the next abuser. And China’s state media are pulling no punches in this case.
侠客岛 Xia Ke Dao, an offshoot from the overseas edition of People’s Daily, has a commentary:
We don't know which "genius" came up with the idea of giving red codes to the depositors who were defending their legitimate rights, and we don't know how such an operation, which is clearly against common sense, the rule of law, and justice, can be carried out in a dignified manner!
These inexplicable red codes inevitably makes people question it is “dealing with rights defending matters” in the name of "epidemic prevention and control," which could only delayed the problem-solving [of the depositors’ issues].
To be frank, no matter which department or which people authorized the arbitrary use of epidemic prevention and control measures for the purpose of "social governance" or "stability maintenance", they should be seriously held accountable.
According to this logic [of applying red codes to “trouble-makers”], all the difficult social problems and long-drawn-out disputes that nobody wants to take care of can be solved with the red code. How easy! “We don't know if the problem will be solved, but you stay home and don't go anywhere!”
This is not solving the problem, but intensifying it. This is not "smart and capable", but a typical example of lazy government and shirking responsibility. The people who came up with these ideas might thought they were quite clever, but unfortunately, their brains are skewed.
In the past, some local regions abused credit information which should have been limited to the financial field, incorporating bare-chested walking on the street and running red-lights into personal credit information. A financial tool to measure the ability and willingness to repay debts on time was thus turned by some people into a “basket” for social governance that can include everything. We have specifically criticized that.
[Pekingnology: Yes, it is commenting on some local experiments in the much-touted 社会信用体系 social credit system. By the way, here is a recent, clarifying podcast by Spectator’s Cindy Yu interviewing Vincent Brussee with Merics and Jeremy Daum with China Law Translate.]
Recently, a place also introduced a policy that as long as your community doesn’t have petitioners, the students in the community could benefit by getting a few points in the high school admissions exam. The result? One or two day after its introduction, the place, under public pressure, "admitted to poor consideration."
How do similar "tumultuous operations" always appear? The root cause is the lack of awareness of the rule of law. No petitioners in the community so a few added points for the students there? How come? Is there a basis in law? Is it fair to the students of other communities? By the same token, based on what law that health code assignments for epidemic prevention can be used for other purposes? Have they thought about the bad consequences of breaking the rules by abusing epidemic prevention?
China has achieved great results in epidemic prevention and control based on efficient and accurate scientific methods and general compliance with the policy. The health code is the information infrastructure for epidemic prevention and control. Some people playing smart and faint tricks based on their own "small goals" of governance are not only unhelpful, but will also lose the faith of people.
Scientificity and seriousness of health code must be maintained: Global Times editorial
However, these [Zhengzhou city government] replies are apparently not enough to quell doubts. According to information spread online, it seems that the "red codes" were "precisely" given to those bank deposit holders. Some of these people told the media that after they scanned the health code to fill in their personal information, their code appeared red and the reason given was that "they needed to sit in quarantine". But those non-bank deposit holders who took the same trip to Zhengzhou didn't encounter the same problem. In addition, according to media reports, several depositors who didn't go to Zhengzhou were also given red codes after filling out their information.
To know the truth requires a more in-depth investigation and a more authoritative answer. The health code is a technical means designed to make the public compromise some personal information rights to comply with the needs of society's public health security. It can only be used for epidemic prevention purposes. It is the responsibility of the relevant authorities to protect the privacy of citizens to the greatest extent during the epidemic prevention process. If speculation of the abuse of the power to misuse the health code is allowed to circulate on the internet, it will generate damage to the government's credibility. Whether the situation circulated on the internet is in line with the facts, it is necessary for the local authority to give a convincing response.
Misuse of health code-related information is not a trivial matter. If someone tries to use the health code for purposes other than epidemic prevention, this kind of behavior is not only against social morality, but also suspected of violating the law or regulation. As to how personal privacy is protected, there are clear specifications in the series of national standards for personal health information code issued by the State Administration for Market Regulation -- that is, the collection, processing and utilization of personal health information should comply with the national standard "Information security technology - Personal information (PI) security specification," and the latter clarifies that the PI controllers shall establish a minimum access control policy for the personnel with authorized access to PI, so that they could only access minimized PI necessitated by their duties and have minimized data operation authorization to fulfill their duties.
There is a high degree of consensus throughout society that health code information should never be misappropriated. In fact, the vast majority of the country is becoming more and more cautious in protecting privacy when it comes to handling relevant information. For example, when announcing the epidemiological investigations recently, many places have avoided disclosing information that is not related to epidemic prevention. It is because of this strong consensus that people are sensitive to any hint of a breach of this bottom line, and no one should take a chance that they can cheat the public on this issue.
The role of the health code in the regular epidemic prevention and control is so pivotal that its scientific nature and seriousness must be maintained. Some grassroots disputes or "technical errors" must not be allowed to affect public confidence and the overall situation in the fight against the epidemic. The relevant departments in Zhengzhou should conduct prudent and strict investigation and verification. The process should be expedited as much as possible. If this is caused by technical problems, a complete and convincing chain of evidence must be presented; if there is indeed regulation-violation in the process, they must be corrected as soon as possible.
胡锡进 Hu Xijin, the former Chief Editor of the Global Times who remains a pivotal opinion maker in China’s public opinion, led the pushback in his Weibo post yesterday
As a veteran media professional, I would like to remind that health codes everywhere should only be used for pure epidemic prevention purposes, and under no circumstances should they be used by local governments for other social governance goals unrelated to epidemic prevention, a rule that everywhere must adhere to. If any locality prevents the movement of specific people by regulating health codes for other purposes, this is clearly a violation of the relevant epidemic prevention regulations and will also undermine the prestige of health codes and public support for epidemic prevention. This does more bad than good to our overall social governance.
It should be noted that media outlets such as the 第一财经 Yicai and 南方都市报 Southern Metropolis Daily played a pivotal role in bringing the incident to public attention in the first place.