Original: x.com/mirrorzk/status/1925110432420757616
Hawkeye-B: Digital review tool for border inspection ports
At several ports and border inspection sites nationwide, an electronic security screening device known as the “Hawkeye-B Terminal” is being discreetly deployed. Developed by CETC Institute 23, the device is capable of extracting Android/iOS chat records without needing to unlock devices, detecting VPN usage, and recovering remnants from apps such as Telegram. According to publicly released technical procurement lists from local law enforcement systems, this type of mobile forensic platform has been piloted at ports in Beijing, Shanghai, Shenzhen, Xiamen, Urumqi, and other locations.
In most cases without the travelers’ awareness, these devices have been integrated into border control operations. Compared to traditional manual searches, the Hawkeye-B boasts remarkable automation and intelligence: within minutes of a traveler’s phone connecting to the device, it can perform hundreds of fingerprint extractions and model matches to determine whether the device exhibits any potential risky behavior.
The powerful functions of Hawkeye-B
Even if you clear your chat history and uninstall sensitive software, it can still extract large amounts of data from the system residues, including:
-
Recently installed/uninstalled apps (including Telegram, Signal, Tor, VPN tools)
-
Telegram data directory remains, such as Android’s org.telegram.messenger cache file
-
WiFi access record and public network IP mapping
-
SIM card replacement history, binding IMEI related information
-
Chat record keyword trigger (such as wall-blocking, USDT, outbound transfer)
These data will be automatically labeled with “risk” and uploaded simultaneously to the backend of the public security network security system, becoming part of your personal device behavior portrait
Background Technical System
The Hawkeye-B does not operate in isolation; it connects to the internal intelligence systems of the police or border control through local modules or dedicated network nodes:
- Behavior Profiling System: Models and compares the device’s operational habits and access records.
- Social Graph Engine: Analyzes the device’s contacts, group chats, and friend information to construct a social connection map.
- Risk Control Rules Engine: Uses AI models to determine whether the traveler triggers further screening logic.
The entire process is completed locally within minutes, with no need for a network connection, allowing it to advise on whether manual intervention is required.
Who Gets Flagged for Priority Scans?
According to some judicial documents, descriptions from field operatives, and technical tests, the following groups are more likely to be selected by the Hawkeye-B at entry:
- Individuals using a combination of a Chinese passport and a foreign phone number on a long-term basis.
- Those who frequently use communication tools such as Telegram, Signal, encrypted email, etc., prior to entry.
- Devices that have installed VPN tools (such as SS/V2Ray) — even if these tools have been uninstalled, they may still be recognized.
- People who frequently travel to and from Hong Kong, Macau, Southeast Asia, Turkey, and other specific regions.
- Cryptocurrency professionals (especially those involved with TRX, BNB, USDT).
- Users of privacy-centric systems or devices that employ the Tor network (such as GrapheneOS, Tails, Orbot).
The core principle behind these devices is based on system residue and behavioral pattern recognition, so simply clearing chat records or uninstalling VPNs is completely ineffective.
If you have already immigrated, make sure to disable cloud backups, clear photo EXIF data, and delete your browser history before traveling. High-risk cryptocurrency professionals who need to return to the country for visits should avoid installing Telegram, Signal, or associating Chinese phone numbers on their primary devices.
Summary
In this era where device detection precedes conversation and algorithmic decisions come before explanations, it’s imperative to adhere to the fundamental rules:
- Do not bypass restrictions illegally.
- Do not possess illegal applications or materials.
- Do not participate in cross-border capital transfers or money laundering with anonymous cryptocurrencies.
- And above all, don’t be complacent by trying to technically evade the law.
Technology is advancing rapidly, but legal principles remain unchanged. Instead of gambling on not being caught, it’s better to avoid actions that you might end up regretting.
Sorry, the title may a bit exaggerated, but many overseas Chinese websites have reposted this post, this very true, I am very worried
Mirror Tang Original comment on X:
"No need to unlock. After plugging in, read the unencrypted areas under /var/mobile/Library/Caches and Logs directly. "
“iOS crash log network configuration picture thumbnails application installation list”
- Here is the solution I can think of:
Before passing customs, close the USB port in GOS, erase all ESIMs, set duress password, or restore the default settings
About anyone who wants a details report: Considering that China is basically a huge black box, almost like North Korea, I don’t think there will be any report. As a Chinese, I can tell you that any real news about China needs to be published in media in other countries or in Chinese democrats overseas. If someone could speak Chinese or lived in China, you will noticed the original content is quite real, and even if the Chinese Communist authorities announced one day that all Chinese people were banned from going abroad, I wouldn’t be surprised. I posted the same content on the Privacy Guides not long ago, but because no detailed report deleted by the administrator, I hope this can stay here for a longer time. . . , I know this article looks a bit unbelievable, but i hope you guys can give some solutions than questioning the authenticity, pls