China spied on Hong Kong activists using TikTok, lawsuit claims

Taipei, Taiwan – China’s Communist Party (CCP) can access user data collected by TikTok owner ByteDance through a “god credential” that it used to monitor and track Hong Kong activists and protesters in 2018, a former ByteDance executive has claimed in a lawsuit.

In a court filing, Yintao “Roger” Yu, a former head of engineering at ByteDance in the United States, said that a special committee in Beijing had a backdoor to firewalls erected by ByteDance to protect user data and used this access to spy on users in Hong Kong.

“Protesters’, supporters’, and civil rights activists’ device identifiers were tracked in addition to their network information, SIM card identifications, and IP addresses,” Yu said in the filing lodged this week in a San Francisco court.

“This information was used to determine both the users’ identity and locations. The TikTok app stores all the users’ direct messages, their search histories, the content viewed by the users, and duration. From the logs, I saw that the Committee accessed the protestors’, civil rights activists’, and supporters’ unique user data, locations, and communications.”

Yu said the existence of the “god credential” is well known among ByteDance executives and directly contradicts promises they have made to legislators in the US and other countries who are debating whether to ban TikTok over national security concerns, according to the filing.

Yu’s claims, which are part of a wrongful dismissal suit against ByteDance, follow a court filing in May in which the former executive alleged that the backdoor “allows certain high level persons to access user data, no matter where the data is located, even if hosted by a US company with servers located in the US”.

Yu said he also witnessed ByteDance using TikTok to further the CCP’s political agenda, including promoting content “that expressed hatred for Japan” and demoting content that expressed support for Hong Kong’s Umbrella Movement democracy protests, according to the filing.

ByteDance is also alleged to have scraped data on its website and those of competitors like Instagram and Snapchat without permission, according to the filing.

Yu is suing ByteDance for allegedly firing him for raising concerns about illegal conduct at the company, in violation of whistleblower protections, and discrimination to do with his disability-related medical leave.

ByteDance, which has its headquarters in Beijing, on Wednesday denied the suit’s claims.

“It’s curious that Mr. Yu has never raised these allegations in the five years since his employment for Flipagram was terminated in July 2018. His actions are clearly intended to garner media attention,” a spokesperson said in a statement to Al Jazeera.

“We plan to vigorously oppose what we believe are baseless claims and allegations in this complaint. Mr. Yu worked for ByteDance Inc. for less than a year and his employment ended in July 2018. During his brief time at the company, he worked on an app called Flipagram, which was discontinued years ago for business reasons.”