Hacker News new | past | comments | ask | show | jobs | submit login
WeChat confirms it makes all private user data available to Chinese government (moneycontrol.com)
309 points by spyformeandyou on Sept 22, 2017 | hide | past | favorite | 110 comments



The Chinese government would not allow WeChat to exist if this weren’t the case. They already have a difficult job managing Tencent, which is arguably China’s second in command after the Party. You don’t get that big without some serious concessions.

I use WeChat every day, but I hesitate momentarily before writing anything negative about the Chinese Govt... just in case.

I suppose they’ve done their job.


Indeed. They don't need to restrict speech or monitor much, when they've convinced people to censor themselves. If I lived in an area that was repressive, I'd probably make sure I never said anything bad about the government.

One of the things I like about my country is that I can call my government out when they make bad choices and I can even organize a protest to show my displeasure.


As an Aussie, I don’t necessarily want to overthrow my government (what’s a circus without the clowns), but I do like the fact I can safely voice my displeasure if and when I feel it’s useful.

Having moved to Taiwan after spending many years in Beijing, the feeling of a weight being lifted off is palpable. I don’t miss those towering windowless soviet-style government building one bit.


I have traveled a great deal and seen some pretty oppressed people. I can live most anywhere and one of the reasons I choose to live here is because I am not oppressed here.

Like you, I have no desire to overthrow my government. I do like to complain about then, however.

As for living somewhere oppressive, I don't think I'd do well in a place where I was hopeless. I'd probably end up being a dead revolutionary, just because I would have wanted to feel hope.


We are so close to what Orwell envisioned with the spying TV set... :(


Here is the Amnesty International study mentioned in article - https://www.amnesty.org/en/latest/campaigns/2016/10/which-me... Also posted here https://news.ycombinator.com/item?id=15314670

Tencent WeChat QQ 0/100. Hopeless.


What about the Kik messenger that has a large investment from Tencent, the creator of WeChat?

https://en.m.wikipedia.org/wiki/Kik_Messenger

Company CEO Ted Livingston stated Kik's aspirations to become "the WeChat of the West" and said that attracting younger users was an important part of the company's strategy


It's very unlikely that the Chinese government can force Kik to share data through a minority investment from Tencent. Their power is limited to behind their great firewall.

I also find it inconceivable that Ted @ Kik would do this. Disclosure: I've known him for years




Some time ago, I wechat messaged a link to a domain I just registered. I had the Apache access log open by chance and could see that along with my friend visiting the link, there were numerous other devices accessing it. From the IP, I could tell they were mobile phones from the same city I was in and a big city nearby (in China).

Could be interesting to make a more "controlled experiment".


All links sent through Wx are crawled by a communist program looking for reactionary sentiments


Yes, I imagine they are. The devices visiting the link were mobile phones however (I remember seeing a Samsung phone specifically). Maybe the crawler is posing as random device models.


The police HAS direct access. The group chats in particular are monitored. One recent story is that a man criticized police for, doing random alcohol tests on car drivers. Got arrested along with the group chat admin


Wonder how their surveillance infrastructure works. Do they duplicate all data and pipe it into some government datacenter? Or do they have some surveillance boxes installed on-site that just scan the data for certain keywords (like the NSA supposedly often did it)? Maybe the latter seems more likely since filtering the data first makes the overhead more manageable.


> Do they duplicate all data and pipe it into some government datacenter

All chat content in clear text, friend timelines, group chats, are piped into a gov't blackbox in datacenter.

There are dozens of cases when a guy complains about parking tickets in his private timeline then got detained for 3-7 days.

Recent hot buzz is a guy in private group chat joked about a new guy's bin laden avatar "are we gunna join ISIS" then got 9 months jail time[1] for "soliciting terrorism".

(On a side note, the tabloid, GlobalTimes once reported that whether ISIS is a terrorism organization is questionable.[2])

[1]: http://news.163.com/17/0923/02/CV03O5BO00018AOP.html [2]: http://mil.huanqiu.com/observation/2014-09/5140363.html


Probably the same way Facebook makes data available to LEOs. There's a portal for that. They upload the warrant, they then get access to stuff.

WeChat simply skips the warrant checking and request scoping.


It is worse in that any random local official has full access. There was a huge scandal a while back where a Hainan local official was paid off to make negative comments go away for a bunch of private businesses.


In other words, due process


Facebook messenger chats are not available that way.


I bet direct access to internal tools and databases.


They don't duplicate it. They enforce duplication to others.


Is this surprising? I've known for a long time that WeChat chats and data could be read by the Chinese government, given that they censor the chats in real time and the close ties between Tencent and Beijing. I guess it's nice to be confirmed but it was already a given considering it's a Chinese company.


> given that they censor the chats in real time

I've never used WeChat, that's interesting to me. How does the real-time censorship work exactly? If I attempt to discuss the Tiananmen Square massacre, would that chat message be instantly 'deleted' after sent (in however much time it takes for them to screen the message that is), something akin to that?


I'd assume it's keyword based.


Ya, one major part of Chinese internet culture is making up new words to describe things whose normal words are harmonized (censored).


At this point I think one has to assume there are more advanced machine-learning-based crawlers out there too. ML is very good at picking up 'anomalies'.


It is necessary to remind this to the people who do not take this as obvious.


I had to install WeChat for work. What bothered me more was all the permissions it required to function. As I recall, it wanted access to my contacts, pictures, location. At each request, I tried saying no, and the app exited.

I assume the Chinese government got access to all my contacts, pictures, etc.

I really wish that apps were required to function in gracefully degraded modes when denied access to permissions they want. And I wish they had to explain each request.


> At each request, I tried saying no, and the app exited.

That's not true for the iOS version.


Governments like these should be destroyed, completely and immediately, forever.


They've anticipated that sentiment by, you know, holding all the guns, bombs and stuff.


By whom?


Looks like this isn't new, actually:

http://technode.com/2017/09/19/now-its-official-wechat-is-wa...

Apparently the mainland China version of the app lets you continue using it without providing certain info; this is now in its privacy policy (technode translation):

"Unless it’s required by relevant laws, your objection in providing this information will block the feature concerned, but will not influence the usage of other features."


This has been known for some time. Some of my best friends on WeChat are Chinese government officials.


This highlights why US-based companies, while not perfect, are far more preferable to Chinese companies for storing your personal data.


If you're American that is. If you're a foreigner US companies are not far from Chinese.


I'm glad we cleared the air on that. Now we can go back to using the service without all the stupid conspiracy theories that they do this. Surveillance is the norm in China. They do the same thing with IP from foreign firms [1].

1 - http://money.cnn.com/2017/08/14/news/economy/trump-china-tra...


Wait, so even correct conspiracy theories are stupid? Man, conspiracy theorists can't catch a break.


It's more akin to holding a conspiracy theory that Apple/Google/etc. exist primarily to make money.


Heh. I remember reading that some people feel that Confucius Institutes are really intended to try to project Chinese culture onto other countries. This would have been less stupid if doing that wasn't openly in the mission statement.


Lenovo is a Chinese company. I'm typing this from a Thinkpad. Would it also be the norm for Lenovo to collect/share information from my laptop with the Chinese government?


A company that's been caught multiple times installing spyware on laptops[1]? My bet would be on 'absolutely'

[1] http://thehackernews.com/2015/09/lenovo-laptop-virus.html


Isn't lenovo the one that got caught putting spyware in the bios?


Not really spyware in bios, more like acpi data, that when detected by windows, gets auto executed by windows


Possibly, I know the company I work at avoids Lenovo laptop because of that.


The US government will not use Lenovo. You can interpret that as a possibility.


Yeah why anyone who values their privacy uses Lenovo beats me. If it’s Chinese, it’s spying on you. Otherwise they wouldn’t be operating in China.


I can't recommend buying a Lenovo laptop.


Stupid conspiracy theories? Are they stupid if they're right?


They're stupid if they're just saying something everyone already knows. It'd be like saying "the US government assassinates civilians with unmanned airborne vehicles" or something.


It's borderline. Even if all the people in the know know it, it wasn't accepted as fact when it was't convenient. Or rather, politicians could pretend it wasn't real / a problem.


Well, perhaps stupid in that calling them conspiracy theories is a mark of ignornace, when they'd be better termed as uncontested and easily supported public facts, or something.


So to be clear, when someone calls an easily supported public fact a "conspiracy theory" to dismiss it, "stupid" should be applied to them, not to the so-called conspiracy theory.


The comment was tongue in cheek. Of course they do this.


> Surveillance is the norm in China.

And in the US. And in Europe. And in Russia. And...


No. Surveillance is far more pervasive in China. Equating the US law and Chinese law is not only incorrect, it is dangerous. The US largely surveils citizens of other countries for terror threats and espionage. China largely surveils its own citizens to suppress dissent. Conflating the two leads people to just shrig their shoulders if/when the US crosses the line.


>for terror threats and espionage

Well, officially this, but for many other reasons as well:

https://en.wikipedia.org/wiki/Parallel_construction


I'd say the main difference is that if the US wants to screw you, they'll dig up convoluted laws and imprison you with bureaucracy. The Chinese just say "fuck you, you're in prison because I say so". I still prefer the US way, because of the higher barrier to entry.


There are downsides to the US way too, like having huge numbers of Americans who refuse to believe that their government would ever do anything like that, and if they do, the citizen must have deserved it.


..As opposed to the even larger number of Chinese who just accept that their government is the way to go and also believe you deserve it equally, if not more?


Uh... citation needed?

A lot of Chinese I know might support their government because they are working to further Chinese interests. But I generally don't hear them trying to export their system of government.

Americans on the other hand...


You should read more chinese media. There are articles talking about how India and African countries would benefit from Chinese-style government and economic system. This is totally just finger wagging, however.


This is how Trump got everything he wanted and a judge never said no? Wait, no, that's not right. Who is this singular US power-unchecked person you are referring to?


Something something FISA something Manafort something something downvotes.


To give some more examples: traveling over roads, train, air you need to ID yourself in China. The same for having a mobile phone connection. In European Union, you barely get checked and you have anonymous sim cards.


To travel over road, train, air in the US you also must ID yourself. To get a mobile phone you have to ID yourself (and sign in-person for the package if a phone is delivered to you) in the US.


> To travel over road, train, air in the US you also must ID yourself.

No you don't. If I drive a car, I have to have license and show that if asked by the police but that is a requirement of driving. If I am a passenger, I don't have to have an ID. I can take an airplane flight without an ID, that has been shown time and time again. Taking the train and ID'ing yourself might be condition of being able to use a train, not law.

If I am out and about, I don't have to show the military my ID, I don't have to show security guards my ID and if I am not accused of a crime, I don't have to show the police my ID. Try that in China.

> To get a mobile phone you have to ID yourself (and sign in-person for the package if a phone is delivered to you) in the US.

Not true. I bought a T-Mobile SIM card with cash and activated it at home and I could have put anything into the address information. I have never once shown my ID when dealing with my T-Mobile account. Try doing that in China.


> I bought a T-Mobile SIM card with cash and activated it at home and I could have put anything into the address information. I have never once shown my ID when dealing with my T-Mobile account. Try doing that in China.

That's not hard to do in China (well, your SIM card would be China Mobile or China Unicom, not T-Mobile), unless they've made some drastic changes in the last couple of years. But since I've seen the claim that you had to provide ID to buy a SIM card made at times where I knew it was currently false, I strongly suspect it's still false.


I think they made the changes. I once had such an "over the counter" sim card but later changed to a monthly contract with my passport. But I remember seeing on the expat magazines "last chance to keep your SIM card active". At one point you had to provide ID or they just turned off the service.


Correct. I signed up with China Unicom last week, was required to use my passport, and was only allowed a single SIM card. Anonymity is nearly impossible.


We've all got anecdotes, so here's mine. I was asked for ID each time I wanted to modify my AT&T account with a rep, and as such I produced one in the form of driver's license. At a major city hotel late at night, I produced my ID to a security guard who otherwise would not let me in with just my room key. At an airport security check, being over 18, I produced a government-approved ID to board the flight.

Maybe there are ways around all this, just like how in China, I bought a monthly subscription (not just pre-paid) China Unicom SIM at an official outlet using cash with no ID, and took many train and bus rides with just a ticket in hand.


I don't know when you did this, but you can't buy a ticket on a train (not subway) in China without providing identification in any city someone would recognize (Beijing, Shanghai, Shenzhen, Xiamen, Chongqing, etc.). As a foreigner, if you exit any of those cities in a car, you must notify the authorities (which is a pain when the Factory is just outside... but the manufacturer will let you know before they let you stay).

This has been largely true for the last 10 years. The same is true for any bus that crosses provincial boundaries. That includes every major Chinese train station (excluding HK/TW) in every city most people can name. If someone else bought you a ticket, they put a fake (probably western) ID on it or they did a favor of using your ID without telling you (that's why they ask for your Passport#). Even the standard electronic purchase stalls only print out a ticket if you provide a China ID, or in a small number of cases a Passport. Everywhere else you have to stand in line to provide ID to the ticketing agent.

All patrons of a hotel must provide an ID (even if you are a non-paying guest) to check in. If it is a foreign ID, they must photocopy it and provide it to the authorities (including your visa information). If you stay at an AirBnB, you must check in at the local Police Station with your Passport/Visa. Not doing so is a crime punishable by imprisonment and revocation of your visa!


That isn't the same thing, and your anecdotes don't really mean anything; the parent's anecdotes act as a counterexample, which is all that is necessary to prove that ID isn't necessary, even if it's generally or often used.

AT&T is requiring you to show ID as a security measure, not because the US gov't requires it. You're talking about them using your ID for authentication, to protect you from someone impersonating you to make unwanted changes to your account. This does not preclude you from being able to walk into an AT&T (or T-Mobile) store and get an activated SIM card with cash and without showing ID.

Ditto for the hotel security guard check. If they had required your ID at check-in for any purpose other than authenticating you against their reservation record, then that would be a problem. If you could walk into the hotel without a reservation and pay for a room with cash without flashing ID, then the parent's point stands. (And even if you couldn't, this may just be a particular hotel's policy, which is fine. The point being made is that the government is not requiring this. There are plenty of hotels in the US that are perfectly happy with anonymous money.)

As for flights, there's definitely more government involved with ID'ing you, but you can absolutely fly without ID. You just need to go through extra security screening, which is a pain, but works just fine.

My experience in China is over a decade old, so I won't comment on that.


Proving identity to an AT&T rep or a hotel security guard in order to validate authorization to access your account or room is not the same thing as the government demanding your identity in order to go from place to place.

Yes, they both involve proving your identity but that is where the similarity ends.


> We've all got anecdotes, so here's mine. I was asked for ID each time I wanted to modify my AT&T account with a rep, and as such I produced one in the form of driver's license.

This is a security precaution to edit your account. It's a good thing and this is also not part of a condition of setting up the account.

> At a major city hotel late at night, I produced my ID to a security guard who otherwise would not let me in with just my room key.

Same thing as above. You have to show ID as part of security for the Hotel and it is not required by law.

> At an airport security check, being over 18, I produced a government-approved ID to board the flight.

You don't have to produce ID to fly. Again, this has been shown time and time again.


>To get a mobile phone you have to ID yourself (and sign in-person for the package if a phone is delivered to you) in the US.

You can buy a prepaid phone and minutes with cash in the US. I bought an Android phone and a minutes with a prepaid card just a month ago (with a credit card, but if I could have used cash), and activated it without giving any personal information.


You can buy and load data/minutes on SIM cards in the US with cash without an ID. I've had cell phones delivered from many different vendors without requiring signing for the package upon delivery, plus pre-paid phones are available for purchase with cash all over the place without the need to hand over personal information.

I can ride the light rail all over my city through buying a pass with cash. I can ride in the car between all 48 contiguous states without needing an ID. Going through TSA checkpoints or leaving/entering the country are the only forms of travel which require an ID or filing a form essentially equivalent to an ID.


I bought a phone in the USA with cash, no id required. It seemed to be the norm.

As in, I was fully expecting to at least show a credit card or passport, but there was never any hint of that at all.


@mullen how do you fly from California to NY without an ID? How do you get past TSA?



(replying to sibling comment)

> Well that is an exception to the rule rather than the norm.

It is? I've literally never given my ID on SFBART or Amtrak, what modes of travel besides being the driver of a car have you had to have a form of state or national ID?


I think you misread the meaning of my comment, see https://news.ycombinator.com/item?id=15318245


Amtrak may require ID upon demand:

https://www.amtrak.com/passenger-identification


Well that is an exception to the rule rather than the norm.

In China, you can also get temporary ID from train stations and airports if you misplaced it.

It is really funny for me to see comments like this used to show US being better than China, when all I see is the act of shooting yourself in the foot - "We don't need ID to travel, because we can exploit the exception made for losing or misplacing ID."

If you really want to compare the ability to exploit the system, I doubt US citizens can beat Chinese citizens.


> Well that is an exception to the rule rather than the norm.

It's a little disingenuous to compare the US and China in this way. In the US, air travel is literally the only form of transportation where an ID is (by convention) required. It is absolutely the norm when you are traveling in the US by car (as a passenger), bus, or train that you never show any form of ID, ever.

> In China, you can also get temporary ID from train stations and airports if you misplaced it.

I think it's telling that it's even possible to get a temp ID in China from so many places if you've misplaced yours. That tells me that having your ID at all times in China is a necessity, and not having it can cause you problems. In the US, if you lose your ID, it's annoying, but it's not a big deal to be without an ID for a while.

> If you really want to compare the ability to exploit the system, I doubt US citizens can beat Chinese citizens.

Ultimately you want to not have to exploit the system. In that it's just not necessary, because the system is fair, or at least there are efficient legal remedies when it's unfair. Obviously neither the US nor China have such great systems, but, again, I find it telling that the need to exploit the system is so great in China that it's so commonplace and everyone is so good at it. So I find your statement about that kinda sad, not a good thing.


It is expensive, but you don't need ID when you charter. The TSA isn't even involved. Usually, there isn't even any security at all.

Obviously, this is only true if you stay in the country.


I agree with your points, but I don't think you are replying to the points that I made directly. I was specifically referring to the TSA rule on verifying identity without ID and its intention, not on car, trains, or how prevalent the requirement of ID is in China. My point is, in terms of ID requirements for air travel, there is not much difference between the two country.

Then again, I am totally used to people getting angry when I say China is not necessarily worse than US in some aspect regardless of right or wrong.

If you really want to be genuine, try to read my comments with a fresh state of mind and see what I am trying to convey.

Edit: maybe you also interpreted my comment wrongly? https://news.ycombinator.com/item?id=15318245


Yes, I did, my apologies. I did indeed think you were talking about all forms of travel.


Ah, now I understand why the downvotes. I mean "not having ID and going through identity verification process" is considered an exception by TSA when boarding the plane, not a norm.

I didn't mean to say "not requiring an ID" is an exception to all forms of travel in the US. So please stop downvoting me if you understand what I mean.



> The US largely surveils citizens of other countries for terror threats and espionage.

You're kidding, of course.


There's a massive cultural shift though, at lease from where I stand (Europe). US kinda like the idea of free speech. China doesn't. I had chat with Chinese people that went all anxious after they started to emit the slightest critic about their country. USA are probably tapping into everything since 20 years but so far it didn't turn into a way to shut off or kill people.


> I had chat with Chinese people that went all anxious after they started to emit the slightest critic about their country.

They are wrong, but it's a common misbelief. China government wants to censor posts that initialize collective action, not criticism. See this quantitive study from Harvard[0].

[0]: https://gking.harvard.edu/publications/how-censorship-china-...


China likes to aggressively censor pretty much everything that even remotely criticizes the party or its history.

"A Chinese star TV anchor is facing "severe punishment" over jokes he made about Mao Zedong, state media report. A video of Bi Fujian singing a parody song at a private banquet and insulting the former Chinese leader in strong language was posted online in April."

http://www.bbc.com/news/world-asia-china-33844095


Allow me some thin paranoia, if people start criticizing, they're halfway through organizing collective action.


I would say not equating Chinese and US surveillance is rather dangerous. Not the extent but the capability and willingness (and track record?), clearly exhibited by instances that they can and they will. They both surveil their own citizens and of course citizens of other country's. Or maybe because USA is better at it? Doing it and getting away with it most of the time?

Besides "largely" the keyword here as an artificial differentiation only leads to some kind of general denial (by its own citizens) that works in the favour of USA's surveillance machinery.


My issue with this is that, in the US, PRISM was shut down--whereas in China that would never happen. The US by no means has a perfect or even necessarily good track record, but the people in charge are still accountable to the public and that makes a world of difference.


Sigh... yes, but the difference between systems that do E2E encryption and WeChat is pretty dramatic.

It's not clear the government of any country can freely read your Signal or iMessage messages they way China can read your WeChat messages.


Oh they are totally not in the same league.


As if the issue was black and white rather than various shades of grey. China definitely is of a shade much darker than the USA.


Unrelated: why would you call something that is confirmed to be true a conspiracy theory?

Holocaust denial is a conspiracy theory. Mass survilance is a fact of life.


Surveillance is everywhere. Go ask Edward Snowden about PRISM program by NSA


Whaaaat? What a perspective. Are you... from China, perhaps? 🇨🇳 Privacy is a wonderful thing. I’m so glad it’s a value people still fight for in the West.


Nationalistic comments, which this and your previous comment smack of, are not welcome on HN. Please don't post like this here.


[flagged]


Someone call Jerry Seinfeld and see if he needs new material.


Minor lol


People downvoted. It seems they thought I was mocking @parent but I wasn't. It was a compliment. Anyways.


Link is broken.


I thought that it was talking about WeeChat (the irc client) for a moment.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: