Terrifying! Real-time Monitoring of All Actions! X Activity API Raises Concerns Among Overseas Dissidents

X's recently released X Activity API (XAA) appears to be a real-time activity subscription interface for developers. According to X's official documentation, developers can subscribe to specific users' activity events, such as profile changes, username changes, location updates, and more, and receive push notifications through HTTP streams or webhooks. X claims that event matching can be sent to developers with "sub-second latency".

This feature's core change is that it allows developers to add target accounts to a subscription list, and once their public information changes, the system automatically pushes updates. XAA self-service accounts can subscribe to up to 1,000 targets, enterprise accounts can reach 50,000, and Partner-level accounts can reach 1,000,000.

From a commercial perspective, this can be used for customer service, brand monitoring, and social media operations. However, from a security perspective, it can also be used by authoritarian countries, intelligence agencies, and network armies to establish "real-time monitoring lists for dissidents".

Notably, XAA currently supports public events such as profile changes, username changes, location updates, and website links, while private events require user OAuth authorization. This means that the Chinese Communist Party (CCP) can monitor overseas dissidents without necessarily breaching X's system, as long as the target account is public and can be subscribed to through the API. For example, a dissident modifying their profile, deleting sensitive information, changing their name, updating their location, or joining a specific organization link can be continuously collected, archived, and compared.

Furthermore, XAA is not an isolated tool. It can be combined with existing keyword search, account graphs, follow relationships, space listening, and OSINT databases to form a system for overseas anti-Communist profiles: who changed their profile description, who suddenly changed their profile picture, who participated in a specific space, who started interacting with someone, and who adjusted their personal information before or after a specific event. These signals may seem small individually, but when combined in a long-term database, they can become political risk assessments, identity recognition, relationship chain analysis, and repatriation risk evaluations.

This matches the CCP's existing cross-border repression model. The FBI defines cross-border repression as foreign governments' transnational harassment, intimidation, monitoring, threats, and coercion of expatriates or dissidents, including online harassment, spreading false information, threatening in-country relatives, and network attacks. The US Department of Justice has also prosecuted Chinese public security personnel for using fake social media accounts to harass and intimidate Chinese dissidents in the US, attempting to suppress their speech on US platforms.

Therefore, XAA's problem is not that it is "designed for the CCP," but that it turns social media activity into a scalable, automated, and real-time subscription system. For ordinary developers, this is an efficiency tool; for authoritarian countries, it is a monitoring tool.

X's official documentation does differentiate between public and private events. Public events do not require target user authorization because this information is already visible to all X users; private events require user OAuth authorization, specific permission scopes, and explicit consent. This means XAA is not designed to allow anyone to directly read someone's private messages. However, for dissidents, public information can still expose many risks.

The real issue is that overseas anti-Communist groups have long believed that "as long as they don't reveal their real name, don't post location, and don't make their private messages public, they are safe." But in the age of automated monitoring, risks often come from long-term behavior trajectories, not single instances of leakage.

Conclusion

XAA is a technology-neutral developer tool, but it has a clear dual-purpose on the political security level. It can help normal developers track social media activity, but it can also help the CCP and its network establish real-time monitoring systems for overseas dissidents.

Overseas Chinese dissident groups need to be aware that publicly visible account information, such as profile changes, profile pictures, links, locations, space activities, and follow changes, are not just "personal data," but are political data that can be continuously subscribed to, recorded, and analyzed by machines.