China’s surveillance state is selling citizens’ data as a side hustle.

As further evidence of insider sources of government surveillance moonlighting on the data broker market, SpyCloud researchers earlier this year intercepted communications from I-Son, a cyber-espionage contractor for the Ministry of Public Security and the Ministry of State Security. pointed to a leak of documents. In a leaked chat conversation, one company employee suggested to another that “I’m only listening here to sell qb,” and “sell some qb yourself.” Spycloud researchers interpret “qb” as “qíngbào” or “intelligence”.

Given that the average annual salary in China, even at a state-owned IT company, is only around $30,000, this promise – whether credible or dubious – to sell access to surveillance data in exchange for that daily. A promise to earn about a third of the represents a strong. Temptation, argue SpyCloud researchers. “It’s not necessarily the mastermind,” Johnson says. “They are people who have an opportunity and a goal to make a little money.”

Dakota Carey, a cybersecurity researcher at China-focused policy and cybersecurity firm Sentinel One, says some government insiders are actually gaining access to surveillance data, which is expected amid China’s continued fight against corruption. is Transparency International, for example, ranks China 76th out of 180 countries in its Corruption Perceptions Index, below every EU country except Hungary — with which it belongs — including Bulgaria and Romania. Kerry says corruption is “pervasive in the security services, in the military, in all parts of government.” “It’s a top-down cultural attitude in the current political climate. It’s not at all surprising that people with this kind of data are effectively renting out their access as part of their job.

In their research, SpyCloud analysts tried to use Telegram-based data brokers to find personal information about individual Chinese state-sponsored hackers, some high-ranking Chinese Communist Party and People’s Liberation Army officials. Identified in the US indictment, and CEO of cybersecurity company I-Son, Wu Haibo. The results of those queries included a bag of phone numbers, email addresses, bank card numbers, car registration records, and “hashed” passwords—passwords likely obtained by breaching data encryption. are protected by a form of but sometimes prone to cracking. For those government officials and contractors.

In some cases, data brokers at least claim to limit searches to exclude celebrities or government officials. But the researchers say they were generally able to find a solution. “You can always find another service that’s willing to search and get some documents on them,” says Kayla Cardona, a researcher at SpyCloud.

The result, as Cardona describes it, is an even more unexpected consequence of a system that collects such vast and centralized data on every citizen of the country: not only does surveillance data leak into private hands; , but it also goes into the hands of these people. Who are watching the viewers.

“It’s a double-edged sword,” says Cardona. This data is collected for and by them. But it can also be used against them.