Most days, Marc Hofer, a cybersecurity researcher and journalist based in Amsterdam, trawls the internet for clues about how China surveils its citizens, a subject that has fascinated him since he worked there as a foreign correspondent.

Mr. Hofer, 46, was doing his usual scan earlier this year when he came across something called “Dynamic Control Platform for Overseas Personnel.” It was a futuristic dashboard — like something from the movie “Minority Report” — that appeared to track foreigners in the northern Chinese city of Zhangjiakou, a popular skiing spot that co-hosted the 2022 Winter Olympics.

The system’s dashboard said it tracked more than 700 foreign residents living in the city. In total, it had entries for nearly 12,000 people, which included fugitives, people from Hong Kong and Taiwan, as well as more than 300 foreign journalists. Some of them had not been to Zhangjiakou.

Suddenly, Mr. Hofer saw his own face — in a photograph taken by Chinese immigration officials for their records. Next to it was his passport number and the cellphone number he had used in China.

He was floored. “Whoever put that stuff in there had access to real data,” he recalled. He also noticed a list of users who had recently logged into the site — it included the names of police stations in Zhangjiakou and other cities.

China monitors its 1.4 billion people on an unparalleled scale, with the help of cameras, cellphone signals and national IDs. The database Mr. Hofer found offered a rare window into how extensively the Chinese authorities also surveil foreigners, displaying entries about people categorized by nationality, with their birth date, sex, marital status, address and occupation, and sometimes their religion.

It also included instances when they were captured on camera at traffic intersections, markets, shopping malls or other locations, including a mosque.

Chinese companies hoping to sell their surveillance platforms to the police often create demo web pages that use photos and information about people taken from social media. This was different, Mr. Hofer said: “This is more than some guys playing around, or a student, or a low-level project.”

That day, in January, he began downloading as much data as possible from the site. By May, it had been taken offline.

Designed for the Police

The New York Times found links between the platform and Origin Dynamic, a Beijing company that provides robotics, surveillance services and equipment to the police, according to public tender documents.

Origin Dynamic had filed a patent application in 2023 for a similar system, which it described as an “information interface for non-Chinese citizens” and was nearly identical to the Zhangjiakou platform in its design and functions. The company is owned in part by the city government of Yancheng in Jiangsu Province.

Origin Dynamic and the Zhangjiakou Public Security Bureau did not respond to requests for comment sent by email and fax.

Mr. Hofer, who shared the data he saved with The Times, believed that the dashboard had been designed for the Zhangjiakou Public Security Bureau, the city’s police department. It included information that only the Chinese authorities would have had access to, and the user log that Mr. Hofer saw listed eight police stations in Zhangjiakou and three from other cities.

It was not clear how, or if, the police have used the database in their work. But its existence illustrates how the Chinese authorities aggregate vast amounts of data from surveillance cameras, medical records, bills, facial-recognition tools and other sources to monitor and analyze the behavior of foreign residents. It had fields for places they frequented, hospital visits and gas payments, as well as flights and trains taken, including seat numbers.

For example, it logged the movements of a woman from Mongolia as she went from a residential compound in Zhangjiakou to shopping malls, restaurants and supermarkets. In some instances, the database indicated, she had been tracked using facial recognition.

Under Xi Jinping, the ruling Chinese Communist Party has overseen a drive to use big data in the name of public safety to stamp out dissent and prevent potential terrorist attacks.

Other countries employ similar kinds of surveillance systems, but in China, there is little protection against police overreach, according to Maya Wang, the deputy Asia director at Human Rights Watch.

“That kind of integration of data is really quite unprecedented and illustrates China’s lack of safeguards,” Ms. Wang said.

An Unsecured Platform

When Mr. Hofer first came across the platform’s login page, a username and password had already been filled in. The fact that a system with sensitive personal information on hundreds of people was accessible to anyone who could find it on the internet suggested a major lack of privacy protections.

Greg Walton, a cybersecurity researcher who has studied similar Chinese systems, said the exposure of this one was not an anomaly. It was a consequence of China’s “surveillance sprawl,” which is fueled by an expanding ecosystem of vendors, contractors and public security agencies, he said.

Mr. Walton, a senior investigator at the SecDev Group, a Canadian research firm, said that each new platform “increases the number of places where sensitive personal data can be misconfigured, copied or left externally discoverable.”

The Times verified that data in the entries for six people besides Mr. Hofer was accurate. A Times reporter who used to be based in Beijing was in it, listed in an entry that included the name of her child. Her name was misspelled, but her passport and other information were correct.

Work on the Zhangjiakou system appeared to have started in 2021, and changes were made to it as recently as April, according to Mr. Hofer, who has documented his findings in a Substack newsletter. Several fields in the database were empty or filled with dummy text, suggesting it was still under construction.

Residents were tracked on cameras in public locations, but the platform also pulled from sources not directly connected to the police. It had a list of foreigners and Chinese citizens who had visited the city’s Thaiwoo Ski Resort, including photos of them taken there, their full names and passport numbers.

Sorting by Country and Religion

The platform labeled people from Australia, Canada, New Zealand, the United Kingdom or the United States as being in the “Five Eyes Alliance.” That is a reference to the intelligence-sharing agreement between the five countries that Beijing frequently criticizes as promoting Cold War-style divisions.

It also highlighted residents from what it called “key countries” — a list that included Egypt, Iran, Israel, Morocco, Pakistan and Sudan.

Visitors from Hong Kong, home to widespread anti-Beijing protests in 2019, and Taiwan, a self-governing democracy that China claims as its own, had their own categories. The database also tracked international students, foreign spouses and “key persons,” a euphemism often used by the Chinese authorities to refer to activists or fugitives, or others deemed to be threats to social stability.

Many of the foreign students listed appeared to be from Pakistan and India and were studying at Hebei North University in Zhangjiakou. Profiles of the students included their religion, marital status, focus of study and times they had been captured on cameras at the school’s entrances.

The platform also claimed to be able to map a person’s relationship network. An illustration of the function showed the names of three Pakistani men in their 20s, linking them to one another after they were captured on camera together.

One set of entries that Mr. Hofer downloaded included names of residents who had been penalized under Chinese law. It showed one woman who had been fined 1,000 Chinese yuan (about $150) in 2021, for example, for not registering a change of address. Other examples included foreigners who had been cited for teaching without required licenses.

The information appeared to have been entered by an official at the Zhangjiakou police station named Zhang Jinglong, according to files downloaded by Mr. Hofer that listed him as a contributor.

An official by that name was profiled by the Zhangjiakou police in 2020. He was praised for monitoring discussions online and actively participating in them to “guide citizens to establish correct” views.

Last year, an artificial intelligence lab in the police bureau was named for him.

Screenshots of the platform were provided by Marc Hofer, the cybersecurity researcher.