In the face of mounting pressure on personal freedom, Chinese internet users appear to be trying more actively to push back against tightening digital surveillance from Beijing.
On both Chinese and foreign websites, discussions, tips and software hacks to combat the government’s grip over cyberspace have picked up in recent months. The advice represents a rare wave of resistance to the government’s use of intrusive surveillance tools to gather data on its citizens, and comes as a number of recent media reports have reignited the fears of many that they could face repercussions for seeking out content deemed “sensitive” by the ruling Communist party.
People in China are already aware that their online communications, even messages sent in private chats, are subject to monitoring and censorship. But recently, there has been a string of events that have left many worried that surveillance is becoming even more intrusive. There’s been coverage about phone-monitoring apps being installed on citizens’ devices, along with widely shared reports of police in Beijing conducting checks on people’s mobile phones, as well as accounts from some Chinese Twitter users on being questioned (link in Chinese) by the police for accessing the banned social network in China.
There was suspicion, in the case of checking phones, that police were searching for information related to the recent protests in Hong Kong, where hundreds of thousands of people took to the streets to protest against a controversial extradition law. The anxiety reached such heights that the Beijing police issued a statement to explain they were only checking IDs (link in Chinese) as part of routine police patrols.
The explanation did little to reassure internet users. Twitter user RF Parsley, who says he is a foreigner living in the Chinese capital, said he personally saw such checks take place. “I was surprised to see them asking for phones, and then, once they had them, asking for passwords and scrolling through,” he told Quartz. And a Beijing-based Chinese Twitter user, who didn’t want to be identified, said a colleague had his phone checked by police in Beijing recently. The police checked his photo albums and what apps he had on his phone, the user said.
Few of these police phone checks have been proven. But the increasing attention ordinary Chinese citizens are paying to Beijing’s digital surveillance also reflects a growing sense of fear about the measures the government is using to spy on people, Muyi Xiao, a Chinese journalist based in the US, told Quartz. “In a period of panic, discussions about how to protect one’s digital footprint in China tend to happen much more than usual,” she said. “I think more people will consider protecting themselves from surveillance after such discussions, but the process will be very gradual and the number of people involved will not be large.”
China’s heavy online censorship and blanket monitoring of its citizens in daily life, using tools such as a social credit system that assesses people based on their behaviors, and a vast network of surveillance cameras, have made any discussion about sensitive topics like this both dangerous and to an extent, unnecessary. As long as the economy is still expanding, to sacrifice some personal rights, including freedom of expression, seems still tolerable, say observers.
Hacking the malware that spies on your phone
Police installing spying software on phones during checks have been reported by Twitter users as early as 2017. Xiao drew attention to one of the apps—MFSocket—that users found on their phones after visits to police stations. Reports were especially common among people in the Xinjiang region, whose Muslim-majority populations has been subject to a far greater level of policing in recent years than other parts of China.
Once installed on Android or Apple phones, the spyware can extract a range of data including calendar events, messages, contacts, location, image and audio files, among others, according to recent research from French cybersecurity expert Baptiste Robert. His report claims the tool is developed by Meiya Peico, a Chinese digital forensics firm that makes a variety of products to extract phone data, according to Reuters. Meiya Peico wasn’t immediately available to comment on its work.
Some citizens are trying to push back against the spyware. In June, a developer going by the handle “HiedaNaKanin” put the “Fuck MFSocket” code repository on developer community site Github, describing it as an Android application that could help to hide some of the data (in Chinese) like contacts, messages, and location, from phones being checked by the spy app.
MFSocket is not the only app in use in China to suck data off people’s phones. In July, an investigation by The New York Times and The Guardian reported that authorities in Xinjiang have been installing software called Fengcai to gather personal data from the phones of foreign travellers who entered the region from bordering Kyrgyzstan.
But it’s worth noting, Xiao says, that because she was unable to get in touch with people who reported having their phones installed with MFSocket outside of Xinjiang, it’s not clear whether some of them have been involved in legal cases that would give the police the right to extract data from their phones, according to China’s laws. Unlike in the US, where the police would need to obtain a warrant and go through lengthy legal process before they can search people’s phones, Chinese officers can do so without getting extra permission (link in Chinese), as long as the person whose phone is being checked is deemed as a suspect or involved in a criminal case.
Carry two phones
While anti-spy software may be effective in staving off the prying eyes of the Chinese government, not everyone knows how to install it. But there are also some more practical and simple measures that citizens are using.
HiedaNaKan, the developer of the anti-MF Socket software, says (link in Chinese) that “the best way [to protect your data privacy] is still to physically separate your devices.”
One of the most widely shared tips so far is to carry two phones, with one dedicated for police checks and one for accessing “sensitive” apps such as Twitter.
Most major foreign websites including Facebook, Google, YouTube, and Twitter, are banned in China and can only be accessed using a virtual private network (VPN) to bypass the government’s internet firewall. The insular nature of China’s internet has effectively turned it into a walled garden that has its own cyber ecosystem, consisting of mostly Chinese tech giants such as Alibaba, Tencent, and Baidu, replacing and replicating many services developed by Western companies banned from operating in China. Using a VPN has become increasingly dangerous in recent years, as Beijing is tightening its control of the web. In some cases, people were fined or even jailed (link in Chinese) for selling or using VPNs.
“Prepare to take a spare mobile phone every day for check-ups,” tweeted Michael Anti, a Chinese journalist and political blogger recently.
On Pincong, an online Chinese community famous for its outspoken users who use a VPN to access the site and discuss controversial topics, such as when the ruling Communist party might be overthrown, other strategies for beating digital surveillance are also shared.
Tips include avoiding using China-based email addresses to register for websites like Twitter or YouTube, as it appears to be much easier for police to obtain personal data from Chinese companies than from Western companies like Google, as well as avoid using domestic mobile phone keyboard apps, which have also been suspected of monitoring users (link in Chinese).
Others suggest (link in Chinese) using Apple’s iPhone over Android phones produced in China, which some believe have given backdoors to the government to monitor the phone’s owners. Another tip is to be sure to use different user names for different web services.
Beyond all this, some argue the safest strategy for now for people in China is to stay quiet in real life.
“Don’t leak your political views or tendencies to people around you recklessly. Being reported to the authorities is not a low probability event these days,” Pincong user Jia Zhu Ye Hua recently wrote.