April 16, 2025
Executive Summary
Recent procurement documents reveal that Meiya Pico, a Chinese state-owned digital forensics firm, will provide an offensive cyber operations training environment and digital forensic laboratory to the Tibet Police College in Lhasa. This development underscores the Chinese government’s strategic investment in advanced Public Security Bureau (PSB) training infrastructure in Tibet and highlights Meiya Pico’s integral role in meeting these specialized requirements.
The implementation of Meiya Pico’s offensive cyber training capabilities and digital forensics technology in this historically significant and culturally sensitive region demonstrates how such technologies are being integrated into China’s public security framework in Tibet. Lhasa, one of Tibet’s most sacred pilgrimage destinations despite the Dalai Lama’s absence since his escape in 1959, has evolved as a testing ground for surveillance technologies with potential global applications.
Over the past decade, Meiya Pico has become a cornerstone of China’s digital surveillance complex. From developing covert phone spyware apps and forensic hacking devices for police, to building big-data platforms that mine email communications, Meiya Pico’s technology has been deployed at the front lines of repression in Xinjiang and Tibet. The company was identified as presenting a significant risk to the national security of the U.S. in 2019 and placed on its Entity List alongside companies like iFlytek and SenseTime – citing involvement in human rights abuses against Uyghurs in Xinjiang.
The company’s gradual absorption into a state-owned enterprise, and close cooperation with security agencies like the Ministry of Public Security, illustrates how nominally independent cybersecurity brands in China can become powerful instruments of centralised authoritarian control. Investigations and leaks – from the exposure of Meiya’s MFSocket app that extracts data from people’s phones in 2019 to last year’s i-Soon files – have pulled back the curtain on this opaque collaboration, revealing an ecosystem of surveillance and spyware contractors working to bolster CCP rule at home, and influence abroad.
Meiya Pico is typical of this ecosystem in that it serves a dual role: enabling police surveillance on the home front in the PRC’s frontier regions, and the export of China’s digital repression model abroad. Whether through equipping PRC police in Tibet’s historic and cultural capital, Lhasa, with remote intrusion techniques or training foreign police forces, Meiya Pico exemplifies the global ambitions of China’s surveillance and security industry.
Digital forensics technology, training, and services as provided by Meiya Pico can play a role at both ends of a repression pipeline, facilitating the long shadow of transnational repression beyond the Belt and Road corridor – helping Beijing track, intimidate, and silence Tibetan dissent worldwide, from Lhasa to London. When Chinese police in Tibet seize a phone from someone suspected of sharing information with Dharamsala, given the reported withdrawal of Israel’s Cellebrite from the PRC market, they are likely to use Meiya Pico’s tools to exfiltrate and analyse that phone’s contents. Meanwhile, the training provided to the police in Lhasa in the new offensive security lab may be turned directly on exile networks.
This report examines how this pervasive securitisation of – and securitisation through – digital networks affects Tibetans’ psychological well-being and societal cohesion, and draws comparative parallels with similar tactics used against other diaspora groups.
The digital transnational repression wielded by the PRC against Tibetans is a complex challenge involving the intersection of technology, psychology, and geopolitics. Its impacts, from anxiety disorders to broken community ties, are severe, but can be alleviated by the implementation of robust cybersecurity protections, offering psychosocial support, and marshalling international condemnation and action. Policy steps outlined in this report will not only aid Tibetan people in reclaiming their agency and security, but will also serve as a blueprint to protect other diaspora communities facing similar digital assaults on their freedom and dignity.
