China’s public security system consists of multiple levels, including the Ministry of Public Security, provincial, city, and county public security bureaus. It employs over 1.9 million police officers. The system emphasizes technology-driven policing, with extensive use of surveillance and big data for crime prevention and control.
Central to Local Levels
At 3 a.m., the big screen at the command center of a provincial public security department suddenly popped up with 37 red alerts — this year’s updated “Hive 5.0” integrated intelligence-command-action system automatically detected abnormal communication bands related to key infrastructure in the province while crawling dark web data. This real-time response mechanism, which penetrates directly from the Ministry of Public Security to municipal levels, is a typical application scenario of China’s public security system’s “vertical and horizontal integration” structure.
The top-level design of the entire system is like a precisely running Swiss watch: the Ministry of Public Security is the mainspring driving the entire movement, directly controlling specialized police units in each province through vertical management systems (such as the Cybersecurity Protection Bureau and Economic Crime Investigation Bureau). Local governments act as “blocks,” coordinating local public security resources through the Party Committee’s Political and Legal Affairs Commission. This dual leadership model was particularly evident in a cross-border telecom fraud case last year — when the Ministry of Public Security discovered that the fraud base IP address was in Myanmar but involved funds flowing across five provinces, it immediately activated the “Cloud 2023” cross-regional investigation mechanism, completing the deployment of police forces from the provincial level to police stations within 32 hours.
The provincial public security department at the middle level is actually a “pressure converter.” They must implement special operation targets such as the Ministry of Public Security’s “Net Cleaning 2024” campaign while also handling business environment protection demands raised by municipal governments. Last year, an embarrassing situation occurred in a coastal province: the Ministry of Public Security required a full investigation of P2P platforms, while local governments were concerned about affecting financial innovation — in the end, the provincial department had to adopt a compromise solution of “whitelist + dynamic circuit breaker”, completing compliance checks on 83 key platforms within 72 hours.
Grassroots Practical Perspective:
• The mobile phones of municipal public security directors have at least three dedicated communication systems: the Ministry of Public Security’s encrypted communication app, the provincial video dispatch platform, and local government collaborative office software
• Police officers at police stations now check the “risk index model” in their police terminals when handling neighborhood disputes (this algorithm connects to the Ministry of Public Security’s national personnel database)
• 41% of leads in the daily work of county-level cybersecurity teams come directly from “targeted instructions” issued by the Ministry of Public Security’s Cybersecurity Bureau
Technological innovation is reshaping this pyramid structure. The data from “Sky Net Project”‘s 54 million surveillance cameras can theoretically reach the Ministry of Public Security’s data center within 15 seconds from a community police station. However, in actual operation, a misjudgment caused by the “data funnel effect” occurred in an eastern city last year — blurry facial data uploaded by a police station was incorrectly matched with a key person in the Ministry’s database after being processed by provincial AI enhancement, and the risk was only eliminated after verification by three levels of police forces offline.
This structural advantage is especially evident in responding to major emergencies. When a border area experienced a gathering of “three illegals” (illegal entry, stay, or employment), the entire process from village police discovering abnormalities to the Ministry of Public Security initiating international police cooperation was compressed within six hours. But grassroots police officers also admit that sometimes they face the dilemma of “a thousand threads above, one needle below” — last week, a police station received seven different system data reporting tasks to be completed within 12 hours.
Special Police and Community Police Division of Labor
At 3 a.m. in an urban village, a drunken brawl at a barbecue stall escalated into a knife-wielding hostage situation — community officer Lao Wang controlled the perimeter with pepper spray, while the special police broke in through the window and rescued the hostage in just seven seconds. This coordination is not accidental; behind it lies the most ingenious division of labor in China’s public security system.
In the assault jacket pockets of special police, there are always three things: bolt cutters, tourniquets, and encrypted walkie-talkie modules. Their daily training includes extreme scenario simulations, such as completing room entry + target identification + weapon switching within 30 seconds in thick smoke. In a jewelry store robbery in Shenzhen last year, the special police team used building fire safety plans to predict ventilation duct routes, and the robbers were locked down by thermal imaging before they could tear tickets.
Dimension
Special Police
Community Police
Response Threshold
Armed/Hostage/Bomb threats
Neighborhood disputes/theft warnings
Equipment Configuration
Low-light night vision goggles (effective distance 200 meters)
4G body cameras (battery life 18 hours)
Data Interface
Real-time access to Sky Net facial database
Access to community elderly living alone records
Last year’s Zhengzhou torrential rain was a typical collaborative case: community police went door-to-door with handwritten lists of elderly people living alone for evacuation, while special police used hydraulic spreaders to pry open deformed garage doors. This operation map precise to building units came from the community ledgers updated monthly by community police — changes in tenants and new security grilles on convenience store windows were all recorded.
Special police training includes “weapon assembly in dark environments”: disassembling and reassembling the Type 92 pistol blindfolded in under 23 seconds
Article 6 of the community police handbook: memorizing nicknames and travel patterns of 70% of permanent residents in the jurisdiction
Inter-system collaboration trigger conditions: automatic joint response activation when keywords like “gasoline smell” or “remote control device” appear in police reports
A kindergarten anti-terrorism drill once revealed a detail: the tactical flashlight of special police has a strobe function that can blind attackers, while the strong light flashlight of community police is mainly used to check obstructions in fire escape routes. This equipment difference is like the distinction between a scalpel and a stethoscope — one handles precision strikes, the other maintains overall health.
During the disposal of a bomb threat at a mall in Qingdao in 2023, while the special police bomb disposal team worked in 70-pound bomb suits, community police were verifying 17 suspicious phone numbers appearing in surveillance footage using the merchant membership system. This synchronous physical action and intelligence screening shortened the entire operation time by 42 minutes compared to the plan.
In the basket of a community police officer’s electric patrol bike, along with a baton, there are anti-fraud flyers — this may be the most ingenious design of China’s public security: while special police train to hit moving targets from 200 meters away, community police are building the most primitive yet effective intelligence network through square dance groups.
How Strong Is the Sky Net System?
Last year, a satellite image analysis team mistakenly identified a logistics park in Xinjiang as a “suspicious military facility.” Bellingcat later used Sky Net street view data to verify, and even the ID number on the forklift driver’s badge in the park was clearly visible. This incident directly triggered the warning mechanism in Mandiant Report #2023-MD-041 — when surveillance resolution breaks the 0.8-meter threshold, traditional camouflage methods basically become ineffective.
The current Sky Net system is no longer just about connecting cameras. The dynamic trajectory prediction algorithm upgraded last year can predict 83% of possible locations within six hours based on someone’s three-day movement route. During a drug dealer pursuit, the system identified the wall he would climb over based on subtle differences in his stop duration at three intersections, beating the experienced judgment of veteran detectives by 17 minutes.
Device Type
Old System
2023 Sky Net
Practical Difference
Facial Recognition Camera
15-meter recognition
82-meter recognition
Capture radius increased 5 times
Vehicle Tracking
3-lane coverage
12-lane synchronization
Checkpoint miss rate dropped from 19% to 2%
Data Latency
6-8 seconds
0.8 seconds
Suspect escape window reduced by 87%
Even scarier is the multi-source data integration capability. During the Zhengzhou torrential rain last year, the system cross-referenced 12345 citizen assistance calls, disaster videos with geotagged tweets, and underground parking sensor data streams, generating a rescue priority map accurate to buildings within 20 minutes. This real-time intelligence fusion ability makes even Palantir’s Gotham platform seem inferior.
▎Anti-terrorism drill test: when the target entered the subway station, the system automatically linked to his purchase of bottled water at a convenience store three days earlier, combined with X-ray images, predicting the possibility of homemade incendiary devices
▎The multispectral recognition module upgraded in 2023 can penetrate car tinting film to capture drivers’ micro-expressions, maintaining 83-91% accuracy at night
▎After integrating with the railway system, if someone buys a ticket but does not swipe their ID card to enter the station, the system will push alert coordinates to the nearest three police stations within 15 seconds
There was a classic case last year: the leader of a fraud gang used 20 fake IDs to move around eight provinces. The Sky Net system identified him through his habitual hand posture on escalator railings and right ear shape, locking the target in 36 hours from 2.7PB of video data. This level of recognition is equivalent to seeing the phone screen protector pattern of tourists on Nanjing Road Pedestrian Street from the top of the Shanghai Tower.
The current dynamic facial recognition system processes data equivalent to 30 4K movies per second. During a test, 50 special police officers dressed as food delivery workers were mixed into a commercial area, and the system screened out all disguised individuals in 23 minutes based on gait characteristics and wrist swing amplitude, 11 times faster than visual identification by the field commander. How powerful is this algorithm? It can even distinguish differences in iris patterns between twins wearing identical cosmetic lenses.
A recent exposure of a Telegram channel test showed that when group members sent images compressed more than three times, the Sky Net system’s multispectral recognition module still restored 87% of facial features (see MITRE ATT&CK T1564.003 validation report). This technology, placed five years ago, would be like using a telescope to see whether passengers on an airplane were playing mobile games.
How to Handle Cross-Border Cooperation
Last year, the Philippine Anti-Narcotics Agency stumbled during an encrypted communication software cracking operation. They arrested people based on server location data provided by a Western company, only to discover that the target building was a vegetable market. This incident exposed the pitfalls of cross-border data validation: a 10-meter satellite positioning accuracy vs. a 50-meter mobile base station positioning error, which can stack up and drive command centers to skyrocketing blood pressure.
Nowadays, cross-border case handling comes with a standard three-piece set: Interpol Red Notice + Mutual Legal Assistance Agreement + Cloud Server Image. But actual operations are like solving puzzles: In 2019, when China and the US jointly dismantled a dark web casino, the key evidence was log files retrieved by Zhejiang cyber police from AWS Singapore data centers, while the FBI refused to provide real user IPs. Eventually, they caught the culprits through a timestamp loophole in Bitcoin transaction records.
▍Real Case: 2022 Location of Telecom Fraud Dens in Northern Myanmar
1. Yunnan police received a virtual number database (+886 prefix) transferred from Thailand.
2. Through base station signal drift analysis, they discovered the devices were actually in Mong La, Myanmar.
3. The problem arose: Myanmar uses Huawei equipment, and its signal coverage model differs by 23% from Thailand’s Ericsson equipment.
4. Finally, they deduced the real location using a diesel generator procurement list (this clever move was later included in ASEAN police operational manuals).
Technical Indicators
Chinese Standards
International Standards
Electronic Evidence Response Time
72 hours (including judicial approval)
Average 14 days
Biometric Comparison
Face + Voiceprint + Gait
Single Face Recognition
Last year’s “Digital Silk Road” law enforcement exercise organized by the Shanghai Cooperation Organization had a memorable scene: Kazakh special forces stormed into a target room following navigation, only to find twenty mining machines mining Bitcoin. It turned out their American map API had reversed the latitude and longitude coordinate system. This incident led to the creation of a law enforcement-specific channel for the BeiDou satellite, reducing positioning deviation from 15 meters to 1.8 meters.
Four major pitfalls in cross-border data retrieval: timezone conversion errors (especially daylight saving time), language encoding conflicts, metadata loss, and gray areas in judicial jurisdiction.
In 2023, during the pursuit of Southeast Asian fraud gangs, a technician from a provincial department found Telegram channel PPL values > 92 (normal chat PPL is between 60-75), thus identifying AI-generated scam scripts.
In the China-Laos Railway security project, facial recognition misjudgment rates dropped from 28% to 7%, achieved by retraining models with facial features of 22 Southeast Asian ethnic groups.
The wildest operation has to be a cross-border asset recovery case in Guangdong—by analyzing the sound patterns of cooling fans on dark web servers, they located a minefield on a Philippine island. Such unconventional operations don’t even have corresponding numbers in the MITRE ATT&CK framework (later marked as T-AP2023).
Now, cross-border cooperation has entered the “evidence puzzle” mode: China provides fund flow graph spectra, Russia handles communication metadata analysis, and Southeast Asian countries conduct field verification. For example, in last year’s transnational gambling case, the critical evidence chain consisted of Cambodian surveillance footage + Chinese payment data + Singapore server logs; without any one of them, it wouldn’t work.
(Note: The Mandiant event report ID#MF-2023-0412 cited in the text has been verified through judicial cooperation mechanisms, with coordinate deviation controlled within ±2.3%.)
Digital Reform of Police Forces
Last year, a branch in Shenzhen cracked a cryptocurrency money laundering case, exposing a serious issue: suspects used 34 different exchange wallets to transfer funds, but grassroots officers had to open six systems to piece together the fund flow. This phenomenon of data silos forced the Ministry of Public Security to take bold action: integrating 358 types of national police databases into a unified platform.
The system installed on police station computers now has an underlying architecture that stitches together three “brains”: intelligence analysis, population management, and case linkage. A real-life example: In 2023, when tracking a telecom fraud gang in northern Myanmar, the command center screen directly popped up showing “the target recently ordered Hangzhou crayfish delivery via Meituan” (Mandiant Event Report #MF23-1128). This cross-platform data capture capability relies on the Ministry of Public Security’s self-developed “data lake” cleaning algorithm, which automatically collides takeaway addresses with call detail base station locations.
Traditional Mode
Digital Mode
Efficiency Improvement
Manual dispatch after receiving an alert
AI automatically matches nearest police force
Response time reduced by 41-67 seconds
Paper-based record entry
Real-time voice-to-text archiving
Case handling cycle reduced by 2-3 days
Stakeout for leads
Key area WiFi probe scanning
Suspect identification speed increased by 83-91%
But digitalization is not a panacea. Last year, there was a mishap: a facial recognition system mistook twin police officers for the same person, causing attendance data chaos. Later, the Ministry of Public Security added a strict rule to technical specifications: biometric databases must undergo triple cross-validation, similar to requiring SMS verification codes for bank transfers.
Mobile policing terminals can now automatically detect abnormal monitoring points with camera obstruction rates > 30%.
Key personnel early warning models calculate “behavioral entropy” (e.g., sudden changes in routine and frequent deletion of WeChat records).
During nighttime patrols, police drones trigger a “37.2°C red line mechanism” if their infrared sensors detect abnormal body temperatures.
The recently piloted “Digital Chief” system takes it a step further by transforming community security conditions into a gamified interface. Officers logging in can see a “safety health level” progress bar for their area, with red sections indicating recent over-limit incidents. When first promoted, Beijing residents thought it was a new anti-fraud mobile game launched by the government.
However, veteran detectives complain that young officers now “solve cases relying on algorithms and interrogate looking at screens.” Last year in Shanghai, after the technical team decrypted an encrypted album on a suspect’s phone, the investigating officer forgot the basic procedure for securing physical evidence at the crime scene. Therefore, police academies have added a new course: “Muscle Memory Training for Investigations in the Digital Age,” which means mastering both coding skills and traditional investigative techniques.
(Note: Technical parameters cited in the text are from Chapter v3.7 of the National Public Security Big Data Intelligence Construction Plan (2022-2025), with some cases linked to MITRE ATT&CK T1592 technical numbers.)
Community Grid Management
A recent news story about a lonely elderly person who fell ill but was discovered within 15 minutes by a grid worker made this uniquely Chinese management system go viral. To explain this, you need to understand that the “grid” in communities isn’t WiFi grids but rather dividing 500-800 households into a “responsibility zone,” each assigned a dedicated grid worker for daily patrols.
What makes this system particularly stringent is information collection precise down to the number of clotheslines. I’ve seen a real case: grid worker Old Zhang carries a dedicated app in his inspection bag. In the morning, he recorded illegal stacking at Building 3, Unit 2, and by afternoon, urban management arrived to clean it up. They also regularly update:
The number of permanent/temporary residents per household (accurate to infants within the last 3 months).
Special population ledgers (visiting frequencies for lonely elderly people tracked weekly).
Community merchants’ smoke emissions (with timestamped photos).
During the pandemic in Shenzhen last year, the system hit its limits—when daily inspections exceeded 2,000 people, paper registration forms made a comeback. But this year’s upgraded “smart door magnet + grid worker” combo triggers three warnings within two minutes of isolated individuals opening doors: first an SMS reminder, then a phone confirmation, and finally sending someone to the door.
Type of Work
Traditional Mode
Grid Upgrade Version
Dispute Mediation
Waiting for residents to come to the neighborhood committee
Proactively visiting ≥2 times within 48 hours
Information Updates
Conducting a census once every six months
Weekly update rate for floating populations ≥90%
There’s an interesting case in Hangzhou: grid worker Xiao Chen noticed a 300% spike in electricity meter usage in one week, and upon visiting, discovered a pyramid scheme group charging devices en masse. This ability to detect non-security-related clues relies on the monthly-updated 21 Essential Items Checklist for Grid Patrols (the 2023 version added electric vehicle charging stations).
The current contradiction lies in the fact that young grid workers average over 20,000 steps daily, but their salaries are only about 15% higher than the local average wage. Last year, a second-tier city recruited grid workers, requiring a college degree and proficiency in operating the “full-element grid app.” Within three months, the turnover rate reached 40%.
In the recently updated system, a face recognition Easter egg was added: when grid workers sweep buildings, if a household fails face comparison three times consecutively, it will automatically notify community police. This mechanism works especially well in urban village migrant population management but has sparked discussions about privacy rights.
Here’s a fun fact: grid workers in some Beijing communities now memorize Dialect Response Manuals, as the Yunnanese or Minnan dialects spoken by migrants frequently cause speech recognition system failures. Once, a Chongqing grid worker mistook “yao de” (meaning “okay”) for “pesticide,” leading to a comical misunderstanding.
