“We don’t know what this government can do. We don’t know what these police can do."

Getty Images

HONG KONG — Beneath the neon lights of Causeway Bay’s shopping malls and restaurants, a man in a yellow hard hat and black shirt pressed his knee into the back of a protester who was pinned down by the police. With his cheek to the ground and his own blood pooling beneath his face, the protester pleaded for mercy. “Even my front tooth is broken. I’m sorry,” he said, his body heaving as he cried. The hard hat and black clothes have become the standard uniform of pro-democracy protesters in Hong Kong, but the man who aided police in the arrest last Sunday was actually part of an undercover operation, the police department said in a press conference earlier this week. It was the first time that authorities had publicly confirmed using undercover officers. Hong Kong’s chief executive, Carrie Lam, said the operation was to target “core extreme protesters.” Since the protests started in June over a controversial extradition bill, participants have routinely covered their faces, blocked or smashed closed-circuit television cameras, and communicated over encrypted apps to conceal their identities. But with the protests growing into a wider resistance movement, with police expanding their tactics and nearly 750 people arrested, protesters are increasingly paranoid about how the authorities are working to identify them — and who can be trusted. Before Hong Kong became a territory of China, it had been under British rule for 150 years. And when the UK handed Hong Kong back to China in 1997, Beijing promised that Hong Kong could retain its own laws for 50 years — under what’s become known as “one country, two systems.” But China has slowly encroached on Hong Kong’s freedoms — most notably taking away the ability to choose its own political leaders — and the extradition bill crossed a line, setting in motion the summer of chaos. Underlying all the street protests, the recent occupation of the airport, and the clouds of tear gas is the fear that Hong Kong’s character will be destroyed by its neighbor to the north. “We just want what was promised to us,” a protester told a frustrated traveler who had missed his flight because of the airport occupation on Monday. But that also means taking on one of the most powerful authoritarian countries in the world — one whose citizens are heavily surveilled, often with the use of facial recognition technology, and which is becoming increasingly frustrated with the protests. China initially responded by censoring news on the mainland, but since then, its rhetoric has become increasingly aggressive. On Monday, China likened the increased protest violence to “signs of terrorism emerging.” Among the protesters’ most obvious fears is a concern about how they can be tracked as arrests continue to mount. To get a better sense of this, BuzzFeed News reviewed hundreds of pages of documents released in a public records request from the Government Logistics Department. Those records showed there are at least three areas where the Hong Kong government already employs some type of facial recognition technology. At present, those areas are within its Hong Kong ID cards, inside its passports, and at the border entrance from the recently unveiled Hong Kong–Zhuhai–Macau Bridge — the longest sea crossing in the world.

Manan Vatsyayana / AFP / Getty Images Police secure a street after dispersing pro-democracy protesters.

The records are not exhaustive — the Logistics Department only processes any contract worth more than approximately $1.2 million. Smaller contracts are processed within their respective departments. The Hong Kong Police Force denied a request and an appeal by BuzzFeed News to release any documents about its use of facial recognition technology. And there are still other ways to track and identify people beyond the use of this one particular technology. Still, the documents shed some light on what capabilities the government has right now as mistrust deepens between Hong Kong and its dissenters. Both Hong Kong passports and ID cards for residents use chips that store biometric data. In September 2016, the Immigration Department called for companies to help replace the city’s Hong Kong ID cards with a next-generation smart ID card. Last November, the government began issuing the new cards, which have a biometric chip that stores a resident’s fingerprints and photo. The city is still in the process of replacing residents’ old cards, so not everyone has one yet.

The photos taken for the IDs use live facial recognition to confirm a person’s identity and are then stored in a database by the Immigration Department. The photos should be high enough resolution to include identifying features such as moles and scars, in order to provide a sophisticated level of facial recognition capability, according to a description of the contractor’s requirements. The technology should also “support facial recognition from different sources, including camera and live video.” Safran Identity & Security, a French company, won a $41 million contract to supply the cards in April 2017, according to an award notification. After a consolidation that same year, Safran is now part of Idemia, which has offices around the world.

The US State Department also contracts with Idemia for facial recognition technology to process US passports. None of this is unusual — many countries are increasingly using similar national ID cards that store biometric data. But those cards have also long raised privacy concerns because the data can be used to track citizens, especially if that data is centralized within the government. Nearly a decade ago, the UK introduced a national ID card but later decided to scrap it and shredded the database back in 2011. The Electronic Frontier Foundation, a data privacy advocacy group, opposes integrating biometric data into national ID cards altogether. In Hong Kong, there are legislative protections for the use of personal data, including what’s held by the Immigration Department’s databases. “The minimum requirement of the law is not to collect excessive data,” said Anita Lam, a Hong Kong lawyer who works on data privacy cases. But once that data is collected, the legislation does allow some exemptions of the protection of that data to prevent or detect criminal activity. Some criminal cases “could justify using more intrusive means,” Lam added — such as potentially accessing the data.

Vivek Prakash / AFP / Getty Images Protesters shine lasers toward riot police during a standoff in the Wan Chai District.

Many of the hundreds of arrests have come at the end of this summer’s routine street clashes. But police have also arrested the administrator of a Telegram group, the app that protesters have used to share information, and also recently arrested a student carrying 10 laser pointers on suspicion of possessing offensive weapons (he was later released). That move enraged protesters, who held a demonstration in response, shining lasers at the Hong Kong Space Museum en masse to dispute the idea that laser pens could be considered a serious weapon. On the nights when the police and protesters stand off against each other, it’s common to see the street light up with the green and blue laser pens of protesters, along with the bright white beams of the Hong Kong police’s own blinding lights flickering back and forth. A recent tweet went viral about how protesters are “using lasers to avoid facial recognition cameras. A cyber war against Chinese artificial intelligence,” and was picked up by media outlets. But while lasers could potentially damage the chip in a camera, it’s more likely they’re just obstructing the view and making it difficult for police to get any clear photos of the protesters, according to Sam Samuels, a surveillance and former UK police officer. Police traditionally have evidence-gathering teams that could be working to take high-resolution photos of protesters in order to identify them, said Samuels. Undercover cops are likely taking photos and videos of protesters too. And if there’s a database of photos tied to a national ID, “once they’ve got a good facial shot, they can just run it through the database and find it very easily,” he said.

Manan Vatsyayana / AFP / Getty Images Police fire tear gas shells at pro-democracy protesters.

While this remains legal, as the data privacy lawyer, Lam, explained, so far Hong Kong says it isn’t doing this. In response to questions about whether the Immigration Department had shared data with the Hong Kong police, the department said it “employs stringent access control to protect the data confidentiality and integrity. Only authorised personnel of this department may have access to the data and there is no sharing of the database among government departments (including the Hong Kong Police Force).” In June, the government also said that none of its departments, including the police force, had used or tested automated facial recognition as part of its CCTV systems. But a more specific records request to the Hong Kong Police Force for information on any use of facial recognition technology was denied on the grounds of security and that it would impede current operations. High-resolution photos, undercover operations, and phone data can all be used to identify and track someone too. “If I were a protester, I would wear something to obscure my face and wouldn’t take my mobile phone — and then you become anonymous,” said Samuels. Protesters have taken precautions to conceal their faces since the beginning of the demonstrations. Before storming the city’s legislature in July, protesters smashed the cameras outside the front doors of the government building. In the street that afternoon, another protester held up a cardboard sign with the words “No Photo” written in both English and Cantonese.

Regular cheers here for ppl not to take photos to protect identities as crowds keep getting bigger #AntiELAB #HongKongProtests #HongKongextraditionbill

And in the city’s metro system, protesters often leave one-way paper tickets taped to the kiosks for each other so they can move around without swiping their Octopus cards — which can be used to pay for virtually anything in Hong Kong, but also store personal and usage data. “We’re all protecting ourselves and hiding our identities,” said Bun Chen, a protester who was in Causeway Bay on Sunday night, wearing the standard protester uniform of all black and a face mask. “We don’t know what this government can do. We don’t know what these police can do,” he said. As the rhetoric in Hong Kong grows more charged and clashes more violent, it raises questions about what further measures the government will take to maintain law and order in the city. Earlier this week, Chief Executive Carrie Lam warned that protesters were “pushing the city into an abyss.” She also told the media that she could not determine how the police should deal with protesters — essentially taking a hands-off approach. The Hong Kong police are "the pillar of the rule of law,” she said.

Vivek Prakash / AFP / Getty Images Protesters throw projectiles near the Chinese Liaison Office after a march on July 21.