Are TikTok and WeChat a Threat to Privacy?

By Elizabeth Neil

US President Donald Trump issued executive orders on August 6 banning United States transactions with Chinese technology companies Tencent and ByteDance, who own the multi-purpose app WeChat and the widely popular video sharing platform TikTok, respectively.

The executive orders from the White House came after US Secretary of State Mike Pompeo announced an effort to tackle potential national security risks from China, as Pompeo named the two apps in particular as threats to the personal data of American citizens.

The United States have since ordered both apps be removed from mobile app stores run by Apple and Google as of September 20, however they are still available for download in Australia.

So we ask the question: should we be concerned about WeChat and TikTok?

Due to most international social media networks being banned from the Chinese market in the People’s Republic of China, Chinese social media companies have sought refuge by expanding their companies overseas.

Two such examples of this are Chinese company Tencent, who owns WeChat, and Beijing-based ByteDance; TikTok’s parent company.

WeChat is a super-app, combining the uses of social-media, instant messaging, financial services (similar to PayPal), travel, food delivery and ride-hailing to name a few. The app has 1.2 billion monthly users worldwide.

Meanwhile, TikTok is simply a video sharing platform which has amassed 800 million active users worldwide since its conception in September of 2016. Users of the app can share and post short videos sometimes set to specific audio or music – a similar premise to the popular app Vine, which was officially shut down in January of 2017 – and has sparked numerous trends including viral dance routines to popular songs.

Both apps have proven immensely popular with the international market, however, both apps have caused problems with their audiences – with WeChat users being subjected to surveillance, censorship and propaganda; and TikTok engaging in censorship of certain political and social topics.

However, the biggest issue for both applications is that of data collection and privacy concerns – the core of Mike Pompeo and the United States Government’s argument for abolishing the applications.

According to a report from the Australian Strategic Policy Institute (ASPI), both TikTok and WeChat users have cause for concern over privacy, as both applications face a range of issues regarding security and the privacy of their users.

For WeChat, the report states the biggest concern is the lack of encryption the app provides. Due to it’s functionality, the amount of personal information being stored on the app as well as device and platform data is at risk of being subject to third-party interception.

During an analysis conducted by the ASPI, it was discovered that the WeChat android app declared 72 permissions, which meant the app has the ability to perform actions such as recording audio, querying the phone location (GPS) and monitoring the user of the phone’s physical activity.

The report continues by explaining while these are required for functions offered by the app, several other permissions serve to uniquely identify the user – which given the lack of encryption, runs the risk of a third-party code within the app to misuse such permissions.

In an image shown in the report specific to users of the app in California, WeChat’s privacy policy goes so far as to detail the information they may collect and disclose.

The policy outlines the information collected and disclosed includes identifiers such as a name, phone number and mobile application user ID; Geolocation data such as information derived from GPS coordinates and Wi-Fi access points; internet and electronic network activity information such as the device model, network type and call history; biometric information such as voice prints and facial recognition data; and commercial information such as payment card information.

The report continues by explaining while messages on the app are secured with encryption, it does not secure messages between the sender and the receiver, meaning there are no restrictions for third party access to its content.

“With messaging apps, it’s reasonable for users to desire that their private conversations carried out on the app are indeed private,” the report says.

“With WeChat, based on the messaging architecture it’s built upon, as well as the well-documented censorship of the content of chat conversations, the confidentiality and integrity of communications sent over WeChat can’t be guaranteed.”

Furthermore, the report discusses an earlier study by the University of Toronto has discovered that WeChat manages different censorship systems for Chinese and international-based users.

The report states that content is censored for all users operating with a Chinese phone number on the People’s Republic of China-based version of the app, named Weixin, even if the user were to travel overseas or transfer to an international phone number.

“Theoretically, under this dual system only Chinese users who register with a Chinese number and therefore use the sister app Weixin are meant to be heavily censored, while less restrictive rules apply for overseas users who access the same ecosystem using WeChat,” according to the report.

“While the two versions of the app operate on different servers, in practice, WeChat users have increasingly had their messages censored and their accounts disabled.”

One example in the report is US-based activist Zhou Fengsuo, whose WeChat account had been temporarily suspended several times over the past seven years.

Zhou is also one of four WeChat users who are US citizens and registered on the app using US phone numbers, yet they are still blocked from sending certain messages in WeChat groups and have had their accounts temporarily suspended.

According to the report, posts of WeChat users abroad are systematically surveilled, and used to train WeChat’s political censorship system.

“As Citizen Lab demonstrated in May 2020 … The platforms do this by ‘screening images and documents shared by accounts registered outside China after they’re sent, then add the digital signature—or “hash”—of any files deemed sensitive to a blacklist.

“Those files then cannot be sent or received by China-registered users.’”

On top of this, WeChat users have also been subject to concerns over the spread of Chinese propaganda.

According to a Sydney Morning Herald article from January 2019, security experts had warned of propaganda being spread through WeChat in the lead-up to the country’s federal election.

“The International Cyber Policy Institute – part of the Australian Strategic Policy Institute – has warned WeChat’s 1.5 million monthly Australian users could be exposed to disinformation, censorship and propaganda on the closely regulated Chinese messaging service,” writes journalist Max Koslowski.

The article continues by explaining how the app also censors its users.

“Using complex algorithms, WeChat – one of the few all-in-one Chinese social media apps allowed through the country’s strict firewall – blocks keywords and images that it deems profane or politically sensitive.”

As for TikTok, the ASPI report discusses the app’s history with data processing in China – a fact the company has even admitted to.

“The extent to which TikTok user data was sent to the PRC is the subject of a class-action lawsuit, brought by a California college student in December 2019 that alleges that TikTok ‘vacuumed up and transferred to servers in China vast quantities of private and personally-identifiable user data’,” the report states.

The report continues by explaining the issue of ByteDance (the platform’s parent company) engineers obtaining access to Tik Tok data, a complicated issue partly due to China’s national security laws and the use of intelligence work.

However, in TikTok’s privacy statement, it is stated that TikTok user data may be shared “with a parent, subsidiary, or other affiliate of our corporate group.” Despite the fact the company has since made an effort to distance themselves from China, research done by the ASPI revealed TikTok had references to domains and IP’s (Internet Protocols) in China, present in both update version 15 and 16 of the app, but has since been removed for update version 17.

Because of this, traffic on the app is rerouted to servers in Singapore and the US. But, both are hosted networks with parent companies in China – which, in line with TikTok’s privacy statement, user data may be shared with.

Similar to WeChat, TikTok have also been accused of censoring political and social topics, most notably to do with the Black Lives Matter movement which has gained significant momentum in 2020.

Despite the apps unparalleled popularity, TikTok have been the centre of controversy regarding censorship issues. One of the most notable incidents of this is the censorship of posts and videos tagged with #BlackLivesMatter and #GeorgeFloyd, however these were dismissed by TikTok as a technical glitch issue and not a deliberate act.

Conversely, the Australian Strategic Policy Institute reached out to Tik Tok on September 6 and 7 in an attempt to receive a comment from the company on the shadowbanning of posts using particular hashtags.

The hashtags in question surrounded topics of police brutality (#acab, all cops are bastards) during the George Floyd protests across America, LGBTQ+ (hashtags using the word ‘gay’ in different languages and the word for transgender in Arabic) and the Monarchy of Thailand.

A representative for Tik Tok responded, explaining the shadowbans were due to inappropriate association with the app and the relevancy to local laws.

“As part of our localised approach to moderation, some terms that the ASPI provided were partially restricted due to relevant local laws.

“Other terms were restricted because they were primarily used when looking for pornographic content, while the Thai phrases the ASPI supplied are either readily found when searched or do not appear to be hashtags that any TikTok users have added to their posts.”

The spokesperson concluded by expressing TikTok’s support for the LGBTQ+ community and its creators on the platform, as well as their pride for the popularity of LGBTQ+ content.

In a situation eerily similar to George Orwell’s novel dedicated to totalitarianism, 1984, it seems there may be a genuine threat to privacy and censorship from these applications. But, does this mean Australia be concerned?

An ABC article posted August 2 by foreign affairs reporter Stephanie Dziedzic says Prime Minister Scott Morrison announced the Federal Government’s investigations into TikTok, including directing intelligence agencies to unearth whether or not the app poses any real threat to this country.

In addition, the article continues by explaining the Department of Home Affairs conducting their own investigation, as to what steps the Government can take regarding the risks the app imposes on Australian citizens.

Furthermore, the Department of Home Affairs are also inspecting WeChat, reportedly used by 2 million Australians.

According to the article, Prime Minister Scott Morrison said in July that if the investigations warrant any further action against the app, it will be made public knowledge immediately.

To date, the Prime Minister has not announced TikTok nor WeChat as a threat to national security.