two weeks later, simon thinks he's being followed again. around the same time, simon receives an anonymous email. its title — "chinese agents will find you and bring you back." i worry about my personal safety and other people around me. simon cheng is one of the leading figures in the hong kong democracy movement. four years ago, he was working at the british consulate and was asked to monitor escalating protests. weeks later, he vanished during a consulate trip to mainland china. simon says the police used his visit

to a massage centre to accuse him of soliciting prostitution. they framed me up to say i solicited prostitutes. simon says he was accused of being a british spy, then tortured.

he says he was restrained in a device known as a tiger chair... ..seen here in videos from chinese social media. when simon was released, he fled to the uk and has now been granted asylum. in london, he set up an organisation to help others who've left hong kong. today, his house is on a special police protection register and he's constantly looking over his shoulder.

the chinese embassy in london didn't answer panorama's questions about simon cheng. my name isjohn culver. i was an analyst specialising on east asia for the central intelligence agency. it's gotten more like classic cold war. for decades, chinese intelligence was fairly casual, not very aggressive, and that's changed progressively over 20 years and especially over the last decade. so, we're seeing more what i would call classic spycraft. china has become a superpower in the last two decades — economically booming, militarily confident and increasingly authoritarian. you're seeing a more assertive chinese foreign policy.

they're asserting their power as the second largest economy and by most measures, the second most capable military force on the planet. in march, xijinping secured an unprecedented third term as china's president. i think they are now pushing harder. president xi is taking tighter and tighter control. he believes that the west is incapable of making decisions about china because of their worry about the trade and the way they do business, and i think he's probably right. president xi isn't just taking tighter control at home, but abroad as well. his police forces have been accused of setting up a network of overseas police stations. we have identified over 100 stations

in at least 53 countries. human rights group safeguard defenders says some of these sites may have been used for "persuasion to return" operations of chinese ex—pats. using public records, they estimate more than 7,000 people around the world have been forced to return to china. i mean, imagine the idea that you are not safe anywhere, that they can get to you anywhere you are, that they will employ every means necessary, you know, to either shut you up or get you back to china. i don't think there's anything more sinister than that. police here are aware of at least three sites in the uk. 0ne located at an office block in croydon... ..one at an estate agency in hendon... ..and one at a restaurant in glasgow.

the government says no evidence of illegal activity has been identified... ..but says the sites were set up without permission and their presence "will have intimidated those "who have left china and sought safety and freedom here." but china has moved quickly to close down alleged overseas police stations. in america, there have been arrests by the fbi. here, the government has been accused of not acting fast enough. the uk government has shifted its position — weakened it, in my view — and now refuses to say whether china poses a threat. i think the phrase is an "epoch—defining challenge", and we're going to meet it, apparently, with robust pragmatism. certainly, i don't

think the chinese care. the directors of two businesses associated with the sites in hendon and glasgow didn't respond to panorama. the owner of the third in croydon says the accusations against him are "baseless". china may be targeting its critics abroad, but should we all be worried about chinese cameras lining our streets? hikvision and dahua are two of the biggest video surveillance companies in the world... ..with combined annual profits of almost £2 billion. china's been accused of using these cameras to control and monitor the minority muslim uyghur population. cameras made by hikvision

and dahua line the streets, where they're not only watching people but actively analysing them, even with horrendous features like ethnicity alerts, where they can pick people out of a crowd that they believe to be uyghur. the chinese embassy in london says the... hikvision says it... ..and... dahua says it... hikvision and dahua cameras can also be found up and down the uk. we spent months and months submitting thousands of freedom of information requests,

and we found that the majority of public bodies are using chinese state—owned surveillance cameras. these companies have dominated, completely dominated, the surveillance market in the uk. nobody knows how many hikvision and dahua cameras are in the uk, but big brother watch says 227 councils and 15 police forces use hikvision and 35 councils use dahua. you're talking about data on millions and millions of people that could be processed to potentially generate very detailed reports about each of us and what we do. and if that sounds hyperbolic, then you really need to understand what it is the chinese government does in terms of surveillance in its own country, against its own population. panorama can now show how security issues in some hikvision and dahua cameras can be exploited. ipvm is one of the world's leading authorities

on surveillance technology. working with the bbc, they designed a series of tests. first, ipvm supplied a hikvision camera to put inside broadcasting house. we have a camera installed in a bbc studio in london, and we are going to hack it remotely using a back door that hikvision built into its own products. panorama couldn't install the camera on a bbc network for security reasons, so it was put on a test network with no firewall and little protection. as a one—off experiment, conor and john have agreed to play the role of hackers. they start by locating the camera inside broadcasting house, then attack its security. so all we need to do is plug in the ip address of the target

and copy and paste a string of 13 characters to the end of the address of the device we want to get into. hacking a computer system without permission is a criminal offence, so not all of the details are being shown. having gained access, conor now times how long it takes to get control of the camera. ready, set, go. ok, i'm getting the user list. the only user on this device is "admin". i'm going to set the password to 12345ipvm. and i've set the password. we're done. 11 seconds. we have access to that camera now. so here, if we zoom in tight on the keyboard, we can see the keys that he's pressing to put his password in for his laptop.

so now, two things have happened. i own that device now, i can do whatever i want with it. i can disable it or i can use it to watch what's going on at the bbc. the second thing is that the bbc no longer has control of that device. zoomed in, i can see his phone screen. so we now have a username and password for the bbc network... right. ..and we have the passcode to a bbc employee's phone from this camera. correct. and this is akin to a locksmith giving you a key to your home... yeah. ..and then secretly making a master key for all of the locks in that community. that's effectively what hikvision engineers did. hikvision says its... ..and were not deliberately programmed with this flaw. the camera panorama tested contained a vulnerability that was first discovered in 2017.

hikvision pointed out it released a firmware update to address it almost immediately and says this demonstration was not representative of devices operating today. the test camera had not received the firmware update. ipvm research suggests many other cameras around the world have also not been updated. these are cameras in people's homes, in their businesses, on streets, inside their offices. there are more than 100,000 cameras online that are still vulnerable, that haven't had their software updated. test number two. can the hackers crack dahua's cameras? in their us facility, they're going to try to infiltrate the software controlling them. if they can, they could take charge of an entire network of surveillance cameras. we're getting unauthorised route

access to the server. so now, if i open up the client for dahua dss... there we go, we're in. and we have full access to this system now. now they're inside the system, they can use it to eavesdrop. what a lot of people don't realise about these cameras is that a large majority of them have microphones. now, often they're turned off by the user, but when we hack into the system like this, we can turn that microphone back on and listen in. so it's as simple as clicking "audio". yeah. now we're wiretapping them. what's the zoom ratio? up to 25 zoom ratio. really? this is a very easy to exploit wiretap. yeah. dahua says when it was made aware of the vulnerability late last year, it... ..and quickly fixed the problem

through firmware updates. hikvision and dahua cameras are used to monitor many police and government buildings. in a single afternoon, panorama found hikvision cameras outside the department for international trade, the department of health, the health security agency, defra, and an army reserve centre. the uk surveillance camera commissioner says there are so many of them, they're like digital asbestos. we have a previous generation that has installed this equipment largely on the basis that it was cheap and got thejob done. we have now realised it has serious and inherent risks, so what do we do about it? do you trust hikvision and dahua? not one bit. chinese—made surveillance cameras have been found surprisingly close to home. i walked into the home office lobby.

as i was there standing at the desk waiting for my id to get checked, you know, as i do, given myjob, i've looked around to see what kind of cameras they were using. conor had been invited to a meeting with civil servants in 2021 to discuss surveillance technology. i immediately spotted a camera on the ceiling which i knew to actually be manufactured by dahua. it never occurred to me that by going to a meeting at the home office, i'd actually be able to say, you know, not only are these two critical vulnerabilities, in fact, they can be used on the cameras you have in your lobby. with the gallop of technology, i we are finding ourselves exposed to things that didn't happen in the past. perhaps in the old days you might've said if you were bugging someone, you had to break in late at night and plant a bug. these days, the target's putting it in for you. the government says it takes...

..and has a... that includes removing chinese—owned cameras from sensitive sites. security experts fear the threat could be even greater than just watching and listening. the cameras could be used as a trojan horse to play havoc with computer networks and spark civil disruption. if you look at all our critical national infrastructure, all things that keep us going — so access to, you know, transport, fresh water, fresh food, power — all those things rely very heavily on remote surveillance. so if you have an ability to interfere with that, you can create mayhem — cheaply and remotely. we've all seen the italian job in our youth where you bring the whole of turin to a halt through the traffic light system. shouting in italian,

horns bee might've been fiction then, it wouldn't be now. that's a very potent weapon that you have. why would we put that in the hands of another state? hikvision says it's an independent company and isn't a threat to uk national security, it has never conducted espionage—related activities for any government, nor will it, and that its products are compliant with uk laws and regulations. dahua says it's not state—backed and its equipment could not interfere with the uk's critical infrastructure. a fox news alert now... it's not a bird, it's not a plane... there is a suspected l chinese spy balloon... chinese spy balloon hovering over the... ..it's a chinese spy balloon. from eyes on the street to the eye in the sky, china's now been accused of using a giant balloon to spy on america.

china's decision to fly a surveillance balloon over the continental united states is both unacceptable and irresponsible. why haven't we shot this balloon out of the sky? there's lots of questions, i but the commander—in—chief is awfully quiet. president biden was forced to act. they're shooting it. that was like a missile that came out of that plane. oh, my god, they shot it down. ever since the balloon was shot out of the sky, intelligence agencies have been scrambling to get to the bottom of what it was doing and where it had been. enter corey jaskolski, founder of a revolutionary artificial intelligence company. he used his ai programme to do what no human could —

sift through millions of satellite images to locate the balloon. looking for something that's maybe a0 metres across and we're looking for that in millions and millions and millions of square kilometres of earth's surface. after processing a vast amount of satellite data, the ai programme shed new light on the location of the balloon before it was shot down. so you see the bright side of the balloon and then you see the dark side of the balloon. just like you see the dark side of the moon. from here, corey tracked the balloon back to the most likely launch site — hainan island in the south china sea. looks like on the day of the launch there was cloud cover. and if i were going to launch a balloon, i would've chosen a cloudy day to do that in order to minimise the chance of detection. china claimed the balloon was a civilian airship used

for scientific research such as meteorology. the balloon that we saw was not a weather balloon. it's far larger with a lot more complexity. in terms of the payload package, it's very large. you know, it's been compared to multiple school buses. the balloon is suspected to have been gathering what's known as signals intelligence. if you're trying to pick up cellphone transmissions or understand communication patterns, then i could theoretically see where the balloon could be a useful platform for that. the balloon appeared to be equipped to do just that. according to the us state department, it had multiple antennas, likely capable of collecting and geolocating communications. corey's research shows that at one point the spy balloon was only around 80 miles from an air force base in montana which houses nuclear missiles. i am sitting in my driveway and this

thing is up in the sky. _ it's been there, stationary, . for about the last 35 minutes. the chinese embassy says this was an isolated event. but working with corey, panorama has uncovered evidence about more spy balloons. first, corey found four satellite images of a balloon and was then able to plot its route across northern japan from china in early september 2021. this one did not launch from hainan, it launched from more interior china, just south of mongolia. japan is a key american ally. there are more american forces stationed here than in any other foreign country. it is strongly presumed that the balloons were reconnaissance balloons flown by china. the ministry of defence ofjapan

is taking all precautions to monitor the situation on a daily basis. japan says if more balloons are discovered in its airspace, it may shoot them down. for protecting lives and the property of people in the territory ofjapan, it is possible to respond to that situation with the use of weapons. since then, panorama has been searching social media and press reports across east asia for sightings of unexplained objects in the sky. we gave these photographs, taken by taiwan's weather service in september 2021 over the capital taipei, to corey. he then cross—referenced them with satellite imagery. we were able to take wind models and calculate from that sighting where the balloon might've been previously and where it was going because of the wind. and within 90 seconds, we found the balloon off the coast of taiwan. the taiwanese government has told

panorama it believes it was a weather balloon. but corey says that's unlikely. so i suspect, just based on the diameter of the balloon and the fact that the operating altitude looks similar, that looks an awful lot like the balloon that flew over the united states, overjapan. taiwan is fearful of china's military ambitions. the democratically—governed island has, according to xijinping, always been part of china. last year, the chinese military rehearsed a full—scale attack. china has fired multiple ballistic missiles during a set of military exercises in the air and the sea encircling taiwan. president biden has said the us would defend taiwan if china attacked. there are fears of a confrontation in the south china sea. there have been two near misses since may. news reader: the chinese fighter 'et came dangerously close d to an american surveillance plane.

the two ships missing each other by only 150 yards. . i think that a crisis is now a matter of when, not if. the chinese embassy says... and it always acts... ..and respects... it says it rejects... all major nations have intelligence operations that use modern technology... ..but some fear where these spy games may lead. china is a long—term threat to us. its intention to become, by the middle of the 215t century, the dominant superpower, to depose america, and to change the world and its government systems

and values in a way that better suits its interests is indeed a threat to our way of life. whether by balloons, overseas police stations, or advanced surveillance technology, today the chinese government has the tools to watch the world like never before. given the pace of advancement, you know, where will we be in ten years or 20 years in terms of the capabilities of these devices? that is what keeps me up at night the most. these technologies can do a lot for our security and to improve society, but if they are mismanaged, it could be a disaster for free society and democracy.

live from london. this is bbc news. more than 1,000 arrests in france following a fourth night of violence. night of violence. officials say a state of emergency officials say a state of emergency cannot be ruled out. cannot be ruled out. iam iam i am live in paris, where the i am live in paris, where the funeral of 17—year—old nahel, who funeral of 17—year—old nahel, who death sparked the unrest, is now death sparked the unrest, is now under way. under way. energy bills fall in britain energy bills fall in britain as a new price cap comes into force. as a new price cap comes into force. and in a galaxy far, far away, the million milejourney scientists hope will shed light on the dark side of the universe.