If that's the case, it's worth noting (since it's often lost here, on reddit and in the news) that is app is only required at border checkpoints in Xinjiang. Putting Xinjiang on your itinerary would likely result in your visa being refused anyway. If you are traveling to China for business or pleasure, you won't need to worry about this.
Source: Was in Shenzhen within the past month. Normal customs/border control practices. Nobody asked for personal devices. Only surveillance that was obvious was biometric checkpoint at customs, and some sort of face scan (?) at the subway queue.
A friend was in China on business recently and the local corporate It department told him they were installing government required monitoring software so that he could vpn back to the US office. This might have been a misunderstanding as that guy isn't very technical, have you heard of this?
I'm not sure and I don't want to misspeak. I know that my company does not do such a thing, and my phone when roaming (Project Fi) bypasses the GFW. However, I do know there are specific different IT infra requirements when connecting from China but none that are gov-monitoring related. It may be a misunderstanding, or it may be a procedure that your friends' IT was following that we aren't.
That being said, foreigners accessing the normal WWW is really not a major concern if you think about it.
Right. There's no enforcement of visa itineraries so long as your first one has valid flights & hotel. After that, you get 10 years of multiple entry with no required itineraries. I just brought it up as a point, that Xinjiang is not a place you would normally be going. People seem to assume that Xinjiang is just a normal crossing into China that has heightened security. That's not the case at all. You would never accidentally end up there on a trip to China.
Most of that area is covered by mountains or desert, and there are only about 22 million people living there. The economy also isn't terribly developed (although IIRC it's the fastest-growing among all Chinese provinces) and it's not exactly popular as a tourist destination.
That doesn't mean there's no reason to ever visit, just that there aren't very many more reasons than for e.g. visiting the neighboring Kazakhstan. Most people crossing the border and getting subjected to the surveillance are probably ethnic Kazakhs living on either side, visiting relatives on the other.
In this specific case a single entry visa was used. The visa paper in the passports doesn’t show the itinerary stated in the visa application. Also all itinerarys and the flight tickets were made with either booking.com and immediately cancelled or with a fake flight ticket generator. Worked like a charm..
That Motherboard article also links to a repository with the APK: https://github.com/motherboardgithub/bxaq