Since shortly after the outbreak of the COVID-19 pandemic, Chinese citizens in the course of everyday life have routinely used mobile apps tied to their health records to produce QR codes that act as a passport—for movement around town or between localities. Residents of most big cities are now accustomed to registering their personal information or showing digital badges of their health status and travel history before entering public buildings.
These apps and the data that feed them are designed to be a powerful tool to stymie transmission of the virus, limiting people's movements if health, location, or other indicators determined by authorities suggest they may pose a risk. In early 2020, Chinese cyberspace authorities had already emphasized that digital responses to the nascent pandemic should not use personal information for other purposes. Last month, however, authorities in Henan province reportedly manipulated a health app system to immobilize potential protesters who feared teetering banks could lose their savings; more than a thousand people's health codes turned red, apparently to keep them off the streets.
However they are used or abused, the health apps are a constant new presence in Chinese daily life. Here are some basics on how they work:
What functions do they serve?
Health codes and other pandemic apps are accessed through multiple channels, but mainly through two widely-used apps: Tencent's WeChat and Ant Group's Alipay. WeChat offers messaging, social feeds, a digital wallet, gaming, and hundreds of other services. The Alibaba-linked Alipay, mainly a digital wallet, also has gradually gained additional functions over the years. Requiring users to register with their real names and national ID numbers, the two apps share the ability to access public services. On either app, users are able to pay their electricity fees and phone bills, make appointments at hospitals, and buy train tickets. These functions were already prevalent before the pandemic under the label of “city services” 城市服务, but the COVID-related functions and lockdown policies accelerated people’s attachment to these apps, which at this point are indispensable for everyday life in China.
There are three main types of COVID-related functions: health codes, travel or location history, and vaccination and testing.
Health codes
The development of the "health code" (健康码) started in early 2020 and was led by Tencent. Localities also developed their own health codes, introducing different names and design features. By the end of 2020, the government urged localities to recognize health codes from other regions while allowing localities to keep their own. Despite the variations, all health codes contain three modes: green, yellow, and red, generally signaling healthy, potential exposure to the virus, and COVID-positive, respectively. A green health code is required in order to enter most establishments and public places such as airports, shopping malls, and hospitals. To acquire a health code, users need to enter their travel history for the past 14 days. In some localities such as Beijing, facial recognition is required in order to register.
Travel and location history
The apps also track travel history and embed information in an "itinerary code" (行程码), in which location history is tracked through mobile phone connections to local base stations of China's big three telecom companies. Recently, the location tracking system has expanded, adding a function for checking whether you have boarded public transportation with potentially exposed or diagnosed patients.
Vaccination and testing
Records of vaccination and PCR tests can be checked on the apps as well, with data provided by the National Health Commission. QR codes also prevail in other areas, such as a code designated to each individual for daily PCR tests in Shanghai (核酸码) and codes for people to scan to gain entrance to important venues (场所码).
Distributed Development, Unified Goals
COVID-19 data is spread out over multiple platforms and accessed in multiple ways. For instance, there are at least four channels through which to check individual vaccination records: an official government website; an app built by the State Council; a mini-program on WeChat; and a mini-program on Alipay.
In all cases, the data come from the National Health Commission, and the National Government Service Platform 国家政务服务平台 (created by the State Council and still running as a trial). This platform has other purposes, including serving as a public database for diploma records, as well as marital and birth records.
The platform’s access to information in various departments and localities points to COVID apps’ central-local structure. Take health codes for example. They can also be accessed via the same four channels as vaccination records, in addition to an app built by the local provincial or city government that carries similar functions. The localities have generally built their apps separately, in collaboration with an array of developers. For example, in Sichuan province, the local big data center was responsible for developing the platform, while in Guizhou province, the state-owned enterprise Guizhou-Cloud Big Data was the main developer.
All this COVID-related data can be accessed through WeChat and Alipay mini-programs in the city services category within the app. On both WeChat and Alipay, the city service category is open for registration only to “government or utility work units” (政府或事业单位) and requires the owner to register with his or her real name. Thus, both the central government service platform and localities can apply for a mini-program on the two apps, leaving them to find developers to build their tools.
Where does the information go?
All of these COVID-related codes and apps require information to be coordinated from a wide range of national institutions, including both government and state-owned enterprises. Information for travel history is provided by the three state-owned telecom companies; vaccination and test records are from the National Health Commission; the health codes source information from the health sector, public transportation, and Customs. Serving as central nodes in a web of localities developing their own health codes and online service systems, these platforms also share information among different localities, enabling them to recognize each other’s health codes.
The emergence of these powerful platforms showcases the Chinese government’s ambition to collect and utilize data, and there is a potential that governments will expand use of such codes and apps beyond the context of the pandemic. This possibility is signaled by the forthcoming linkage between the public transportation system and the health code system in Beijing, in which passenger health code status will be automatically checked when travelers board public transportation.
One week after the Beijing news was released, Lao Dongyan, a law professor at Tsinghua University 清华大学, one of China’s top universities, posted her concerns on Weibo. She pointed out that this linkage would enable a trinity consisting of facial recognition, health code information, and public transportation history, making it easy for officials to track individuals’ whereabouts and identities. “It is detrimental to the protection of personal information by linking all sorts of databases without adequate law or regulation.” Less than 24 hours after they were posted, her comments were removed from Weibo.
