The System That Doesn't Need You to Do Anything

A Chinese firm is building AI to identify political dissidents before they have done anything publicly dissident. The technology is still in development. The aspiration is operational. Those two facts sit together, and they matter differently than most of the coverage has treated them.

The New York Times reported on 1 June, citing internal documents and researcher analysis, that Geedge Networks — the company that commercialised China's Great Firewall — has been developing systems that ingest telecommunications data, social media behaviour, and location patterns to build predictive profiles of individuals.¹ The goal, as described, is not to monitor known dissidents. It is to score the general population for the likelihood that a given person might become one. This is not a refinement of existing surveillance. It is a different architecture entirely.

The line that matters. There is a meaningful difference between a state that watches people who have acted and a state that scores people who have not. Reactive surveillance — monitoring someone because they attended a protest, published a pamphlet, or contacted a foreign journalist — at least requires the person to have done something. Pre-emptive scoring requires nothing. It operates on behavioural patterns that the algorithm reads as precursors: what you search, where you go, who you call, how often you connect to a VPN. The concept of innocence becomes, within that system, structurally incoherent. You cannot clear yourself by doing nothing, because doing nothing is also a data point.

That distinction is not abstract. It is the line between surveillance (reactive) and pre-emption (predictive), and it is the policy boundary that every democracy is going to have to draw once this technology becomes exportable.

Who is already being scored. It is worth being precise about the populations at risk, because the "research stage" qualifier in the NYT reporting is true but potentially misleading about how far precursor systems have already gone.

Xinjiang's Uyghur population has been subject to population-scale predictive detention systems for years. Human Rights Watch documented the Integrated Joint Operations Platform (IJOP, the Chinese government's mass-surveillance app used in Xinjiang) in 2019. Maya Wang, the HRW researcher who led that work, described what IJOP does plainly: "treat an entire population as suspects."² Tibetan communities, Hong Kong pro-democracy networks, and Falun Gong practitioners have been historical target categories for the Chinese security state's monitoring infrastructure.

Geedge's reported work is not, then, a beginning. It is the proposed extension of a logic already operational in specific regions into a more general, AI-scaled predictive layer. The novelty is the mechanism and the aspiration to scale — not the political intent, which has been consistent.

Why the chip controls actually matter here. The NYT reporting includes a detail that has received less attention than it deserves: US semiconductor export controls are cited as having materially slowed Geedge's development.¹ This is significant in a way that goes beyond the usual chip-war framing.

The public debate around export controls on advanced semiconductors has been fought largely on economic and national-security grounds: protecting American chip industry advantage, slowing Chinese frontier AI development, maintaining compute moats (the capital barriers created by access to the most advanced chips, which constrain who can train the largest models). Those are real arguments. But the people whose safety most directly depends on whether those controls hold are not chip industry shareholders. They are Uyghurs in Xinjiang, pro-democracy activists in Hong Kong, and any Chinese citizen whose browsing history, movement data, or social graph might one day be run through a predictive scoring system.

This is, as far as I can identify, one of the first concrete instances of reporting in which a specific consumer-surveillance AI use case — not frontier model training — is cited as operationally constrained by export controls. The controls have primarily been debated in terms of large training runs and military AI applications. Here they are functioning as a human-rights instrument, slowing a system whose primary use case is political repression.

That framing should matter to the policy conversation. Export controls are not just technology policy. In this context, they are civil liberties policy for populations that have no other lever.

The capability gap is real and not reassuring. I want to take the "research stage" qualifier seriously, because sloppy capability inflation does no one any favours. The NYT characterises this as developmental; the neutral research consensus available to me describes internal documents and researcher analysis, not a deployed operational system.¹ It is possible that the reporting describes an aspiration and a demand signal more than a functioning product.

But here is what that framing does not change. The demand signal is real: MSS-aligned (Ministry of State Security) customers are identified as the source of the requirement.¹ The technical foundation is real: Geedge has the data relationships that come from operating the Great Firewall commercially, which means access to the training data such a system would require. The constraint is chip access, not legal prohibition or ethical choice. When the binding constraint on building a mass political pre-emption system is semiconductor supply rather than any question of whether it should exist, the development trajectory is not in doubt — it is only paced.

It is not reassuring that the main obstacle to a mass political pre-emption system is a chip shortage.

The arc from authoritarian markets to everywhere else. The history of surveillance technology is not a history of tools staying within their intended markets.

Palantir's early contracts with DHS and CIA funded a data-integration platform that was later sold to police departments across the United States and United Kingdom, with applications far beyond their origin in counterterrorism analysis. NSO Group's Pegasus spyware was built for state intelligence clients and ended up on the phones of journalists, lawyers, and activists in countries its developers would not publicly claim as customers. The pattern is not inevitable, but it is consistent enough to treat as a prior: tools built to state-customer specification for authoritarian markets find export markets, migrate through diluted versions, and eventually enter Western procurement chains through vendors whose original customers are not disclosed.

The UK is currently conducting a review of lethal-autonomy standards for military AI. US ICE (Immigration and Customs Enforcement) and CBP (Customs and Border Protection) have active AI procurement contracts. Neither context is equivalent to China's predictive dissent system — but both represent governments acquiring AI tools for population-management purposes with limited public deliberation about the scoring logic embedded in those tools. The architecture of pre-emption — building a profile from data patterns and acting on predicted risk rather than documented behaviour — does not stop being dangerous when it is deployed in a liberal democracy. It simply has more legal friction around it. For now.

The consent question nobody is asking. There is a version of this conversation that focuses almost entirely on the technical question: does the system work, can it actually predict dissent, is the accuracy high enough to be operationally useful? I understand why that question gets asked. Capability matters; a system that cannot actually identify future dissidents causes less harm than one that can.

But the consent question is prior to the capability question, and it is almost entirely absent from the coverage. The populations being scored for political risk are not consulted about whether such scoring should occur. The data used — location data, internet usage, telecommunications — is not collected with consent. The categories being predicted ("harmful information," "political risk") are defined by the state, not by any process that involves the people being scored.

This is the design choice that matters most, and it is not specific to authoritarian states. Predictive policing systems in democratic contexts — PredPol in the United States, the Harm Assessment Risk Tool (HART) in Durham Constabulary in the UK — have faced sustained challenge from civil liberties organisations partly on this ground: the people subject to predictive scoring were not consulted, the categories were defined by the operator, and the logic of the score was opaque to the person being scored.³ Liberty (the UK human rights organisation) argued that Durham's HART system was almost certainly unlawful for this reason. The difference between those systems and Geedge's reported work is one of degree and purpose, not of kind.

If you build a system that acts on predicted future behaviour, you need a theory of what makes that action legitimate. "The state has an interest in preventing dissent" is a theory — it is just one that most of the world's population would reject as sufficient. Democratic policing systems have not yet produced a satisfying answer either.

What to watch and what is at stake. Three things seem most consequential going forward.

First: whether US export controls hold and whether enforcement keeps pace with third-country re-export. The controls are not absolute. Smuggling routes, third-country intermediaries in Malaysia, the UAE, and others, and domestic Chinese chip development (SMIC has produced 7nm-equivalent processes) mean the constraint is real but not sealed.⁴ The Geedge case is evidence the controls are biting. It is not evidence they are sufficient.

Second: whether the "research stage" framing obscures the operational scope of precursor systems. IJOP in Xinjiang is not research. Sharp Eyes — China's broader public-camera AI network — is not research. Geedge's predictive layer would extend a system that is already operational in high-priority target communities. The gap between "not yet at scale" and "already in use against specific populations" matters for how the reporting is read.

Third: the export market. If Geedge's system matures, it will have buyers. The question for democratic governments is not only whether to allow that export — it is whether their own procurement practices create the normative environment in which predictive political risk scoring becomes unremarkable. The UK and US are not building Geedge's system. But they are building adjacent systems, with adjacent logic, through procurement processes with limited public deliberation. The line between "crime prediction" and "political risk prediction" is a policy choice, not a technical fact. States that want to cross it will find that the tools already exist.

I find it hard to read the Geedge story as primarily a China story. It is that. But it is also a story about what gets built when the binding constraint on a political repression system is chip supply. It is a story about who is already being scored and has been for years. And it is a story about an architecture of control that, once demonstrated at scale, does not stay in one country.

Footnotes

¶