Back to blog
Cyber Investigations Oct 31, 2026

Inside China’s Exposed “Key Figures” Database for Ethnic External Propaganda

On October 24, 2026, the VULONE Team discovered an operational Chinese database titled 民族外宣重点人物信息库 (Key Figures Information Database for Ethnic External Propaganda). Linked to the China Internet Information Center (CIIC) and DeepChina, it held 2,580 records across 103 countries, structured as a 22-column CRM for tracking and countering voices on ethnic issues. The platform was left unencrypted on the public internet.

VULONE Team
Inside China’s Exposed “Key Figures” Database for Ethnic External Propaganda
Share Article: Copied!

Note: No intrusion, exploitation, or authentication bypass took place. The internal platform was left openly accessible on the public internet over plain HTTP, with its backend data-retrieval and spreadsheet-export routes completely unauthenticated. (Because the server remains live and unauthenticated at the time of capture, the IP address and specific endpoint paths have been withheld from this report.)


I. Discovery of the Database

On October 24, 2026, our research team found an operational Chinese database titled 民族外宣重点人物信息库 (Key Figures Information Database for Ethnic External Propaganda).

Database overview dashboard

This system functions as an operational CRM (Customer Relationship Management-style platform). In this context, it is used to track, categorize, and support efforts to counter the global conversation on China’s most sensitive ethnic issues, particularly Xinjiang and Tibet. It is not a passive reading list; it is structured for active outreach, pressure, and counter-influence work.

Sitting unshielded in the open data stream were 2,618 detailed dossiers (of which 2,580 were non-test human records). These covered 103 countries and 1,550 organizations. The records map a wide range of individuals, from Uyghur human rights activists and Tibet scholars to Western cabinet officials, D.C. think-tank fellows, Nobel economists, and pro-Beijing social media influencers.

Client-side JavaScript bundles contained hardcoded Webpack Module Federation build paths. These paths pointed directly into internal production environments. Webpack Module Federation is a technique that allows separate frontend applications to load code from one another at runtime. In this case, the configuration confirmed the system was an active operational component of “DeepChina.”

Webpack Module Federation paths showing CIIC internal structure

DeepChina operates under the direct remit of the China Internet Information Center (CIIC), which runs the sites china.org.cn and china.com.cn. For China watchers, CIIC is the core external media hub run under the auspices of the State Council Information Office (SCIO), the primary foreign propaganda office of the Chinese Communist Party, and the China International Publishing Group.


II. Inside a 22-Column “Opinion Warfare” CRM

Once test artifacts were filtered out, the operational dataset contained 2,580 high-signal human records. The architecture of the database was not designed for passive reading. It was structured as an active outreach, pressure, and counter-influence CRM.

Every individual in the dump was mapped across 22 operational columns:

Identity & Credentials: Legal name, Localized Chinese Name, Nationality, Gender, Date of Birth

Institutional Anchors: Organization, Job Title, Field, Category, Academic Degree, Major, and Bio

Actionable Direct Contact PII: Personal and institutional email addresses, direct mobile phone numbers, landlines, verified physical street addresses, and social media identifiers

Sample of database records

Within this data, operators maintained an elite, tightly curated sub-tier of 190 high-priority targets. These were mapped with tailored Chinese names and live social handles. The presence of these customized fields indicates the targets were being actively “worked” by operators managing the perimeter of the ethnic narrative.

Looking at the organizational breakdown, the targeting heavily favors academic and policy institutions that shape international public opinion.

Organization breakdown by type


III. Who Is Inside the Database?

What makes this exposure stand out is how the database places vocal critics, mainstream policy elites, and friendly foreign commentators inside the exact same tracking schema.

1. The “Dangerous” Core: Uyghur Activists, Tibet Scholars & Human Rights Watchdogs

Tagged under 新疆相关 (Xinjiang-related), 西藏 / 西藏相关 (Tibet-related), and 人权 (Human Rights), this group tracks the primary critics of Beijing’s ethnic policies:

  • Uyghur Activists & Researchers: US-based journalist/activist Gulchehra Hoja (古丽恰克热·霍迦, @GulchehraHoja), Alex From Xinjiang, researcher/activist Rayhan Asat, and activist Abdulhakim Idris.
  • Human Rights Officials & Campaigners: Former Human Rights Watch Executive Director Kenneth Roth (肯尼斯·罗斯), HRW China Director Sophie Richardson, UN High Commissioner for Human Rights Volker Türk, and Christian Solidarity Worldwide campaigner Benedict Rogers.
  • Xinjiang & Tibet Academics: Anthropologist Darren Byler (戴伦·拜勒), Georgetown historian James Millward (米华健), GWU scholar Sean R. Roberts, Columbia historian Morris Rossabi (罗沙比), HKUST scholar Barry Sautman (沙伯力), Case Western anthropologist Melvyn C. Goldstein (梅·戈尔斯坦), SUNY historian Tom Grunfeld (谭·戈伦夫), and Oxford scholar Charles Ramble.

2. The D.C. Think-Tank Bench

A substantial portion of the China-watching community leading at US policy institutes is cataloged in the dump:

  • Brookings Institution: Bruce Jones, Colin Bradford, Michael O’Hanlon, Jonathan Pollack, Jonathan Stromseth, Evans Revere, Jeffrey Bader, Patricia Kim, and Natalie Sambhi
  • Carnegie Endowment: Paul Haenle, Evan Feigenbaum, François Godement, Isaac Kardon, Matt Sheehan, Jon Bateman, Michael Pettis (迈克尔·佩蒂斯), and Douglas Paal.

3. Global Politicians, Diplomats & Economists

  • Statesmen & Diplomats: Former US Treasury Secretary Lawrence H. Summers, former EU High Representative Josep Borrell Fontelles, former Italian PM Romano Prodi, former Mexican President Ernesto Zedillo, former US Ambassador to China Winston Lord (温斯顿·洛德), former CFR President Richard Haass (理查德·哈斯), former US Under Secretary of State Robert D. Hormats, former Indian National Security Adviser Shivshankar Menon, UNDP Administrator Achim Steiner (阿奇姆·施泰纳), former UN Environment chief Erik Solheim, and former UN weapons inspector Scott Ritter (斯科特·里特).
  • Economists & Scholars: IMF Managing Director Kristalina Georgieva, IMF First Deputy MD Gita Gopinath (吉塔·戈皮纳特), former World Bank President David R. Malpass, Nobel laureates Joseph Stiglitz and Amartya Sen, Harvard scholars Graham Allison (格雷厄姆·艾利森), Kenneth Rogoff, and Dani Rodrik, Columbia professor Jeffrey D. Sachs, Nouriel Roubini, and IR theorist Barry Buzan.
  • Legislators: British MP George Galloway, Pakistan Senate Defence Committee chair Mushahid Hussain, Irish MEPs Mick Wallace and Clare Daly, and New Zealand MPs Lawrence Xu-Nan (南西) and Nancy Lu (陆楠).

4. Journalists & “Self-Media” (Opinion-Warfare)

The system tracks investigative reporters covering human rights abuses right alongside Western commentators and independent “self-media” influencers:

  • Mainstream & Investigative Reporters: Ian Urbina (伊恩·尔比纳, The Outlaw Ocean), Helen Davidson (The Guardian), Stephen McDonell (麦克唐纳, BBC China correspondent, tagged 独立记者), Peter Hessler (何伟, The New Yorker), Saibal Dasgupta, Reid Standish, and Kenan Malik
  • Self-Media & Commentators: Danny Haiphong, Scott Horton, Carl Zha, Ben Norton (Ben Northton), Andy Boreham, and Cyrus Janssen.

IV. The Reckoning: Why It Matters

This exposure gives a rare look under the hood of “Ethnic External Propaganda.” Influence operations are not only ephemeral bot farms. Behind the scenes, state media organs maintain structured CRMs across 103 countries, using 388 tags to simultaneously monitor human rights critics (新疆相关, 西藏, 人权) and other relevant voices.

By centralizing mobile phone numbers, landlines, physical addresses, dates of birth, and personal emails of Uyghur activists, UN officials, journalists, and scholars into a single export, the operators exposed every target in their database to third-party harvesting, doxing, and targeted phishing.

Despite housing sensitive personal data and internal operator notes, the platform was deployed over plain HTTP with port 443 closed. Every login session and database query traversed the network in cleartext.

Notice: All retained artifacts are securely isolated for threat intelligence and victim notification purposes. Full technical evidence and individual record verifications are provided strictly to affected parties and authorized legal entities upon request at contact@vulone.com.