China Intercepts WeChat Texts From U.S. And Abroad, Researchers Say

Updated on Sept. 19 at 10:23 a.m. ET

The popular Chinese messaging app WeChat is Zhou Fengsuo's most reliable communication link to China.

That's because he hasn't been back in over two decades. Zhou, a human rights activist, had been a university student in 1989, when the pro-democracy protests broke out in Beijing's Tiananmen Square. After a year in jail and another in political reeducation, he moved to the United States in 1995.

But WeChat often malfunctions. Zhou began noticing in January that his chat groups could not read his messages. "I realized this because I was expecting some feedback [on a post] but there was no feedback," Zhou tells NPR from his home in New Jersey.

Chinese cyberspace is one of the most surveilled and censored in the world. That includes WeChat. Owned by Tencent, one of China's biggest companies, the chat-meets-payment app has more than 1 billion monthly users in China and now serves users outside the country, too, although it does not divulge how many. Researchers say its use abroad has extended the global reach of China's surveillance and censorship methods.

As Chinese technology companies expand their footprint outside China, they are also sweeping up vast amounts of data from foreign users. Every day, millions of WeChat conversations held inside and outside China are flagged, collected and stored in a database connected to public security agencies in China, say cyber researchers.

"The intention of keeping people safe by building these systems goes out the window the moment you don't secure them at all," says Victor Gevers, the Dutch co-founder of the nonprofit GDI Foundation, an open-source data security collective.

Zhou is not the only one experiencing recent issues. NPR spoke to three other U.S. citizens who have been blocked from sending messages in WeChat groups or had their accounts frozen earlier this year, despite registering with U.S. phone numbers.

"It doesn't matter where the user is, as long as I send a message to more than three people, my message cannot be seen in any group," says Stephen, a Chinese American technology professional. He declined to share his full name because he fears his criticism could draw retaliation against himself or his family by the authorities in China, where he travels often and where most of his family lives.

Stephen is baffled that he was blocked. He doesn't consider himself political. "It isn't shocking that China has that kind of censorship," he says. "The shocking piece is that China is exporting that kind of censorship to other parts of the world."

According to the Citizen Lab, an Internet watchdog group at the University of Toronto, WeChat's parent company Tencent created an extraordinarily advanced censorship algorithm to automatically identify combinations of keywords in messages and online articles that it then blocks. The censorship occurs whenever a Chinese-registered WeChat account receives or sends a message with flagged phrases.

"Using this sort of technique, Tencent has the ability to more precisely target content," says Jeffrey Knockel, a postdoctoral fellow at the Citizen Lab.

Since 2013, Citizen Lab has been monitoring how WeChat filters keywords and found it often updates which words are flagged in response to current events.

"We suspect that humans have some control over adding things to the list [of filtered keywords], but it's an open question whether these automated methods can add by themselves to the list," Knockel says.

The Dutch researcher Gevers has studied Chinese social platforms as well and has exposed a large number of online vulnerabilities in their networks.

This March, Gevers found a Chinese database storing more than 1 billion WeChat conversations, including more than 3.7 billion messages, and tweeted out his findings. Each message had been tagged with a GPS location, and many included users' national identification numbers. Most of the messages were sent inside China, but more than 19 million of them had been sent from people outside the country, mostly from the U.S., Taiwan, South Korea and Australia.

He says the system resembles the global surveillance methods used by the U.S. National Security Agency.

For decades, the U.S. had unparalleled capabilities to monitor Internet traffic passing through servers within its borders. But Chinese tech companies like Tencent are now global, meaning this dragnet is believed to be sweeping up information about users from outside China.

"I think that really raises serious questions and challenges for users but also for regulators outside China," says Sarah Cook, a senior research analyst at Freedom House, an independent democracy watchdog.

Estimates of total WeChat accounts outside China are hard to come by, and the number is believed to be low — possibly in the tens of thousands — in the U.S. compared with popular networks like Facebook and its Messenger and WhatsApp platforms.

Cook points out that WeChat is used internationally not just by traveling Chinese citizens, but also by politicians in democracies communicating with Chinese constituents and dissident communities. "They're communicating with somebody else who's outside of China who has WeChat, but they're still for the most part often operating under the rules that are inside China," she says.

For some, the censorship came in stages. For example, a user could be temporarily blocked, as though to encourage better behavior. Sometimes a cat-and-mouse ensues between the censors and users.

Last February, David, a Chinese American doctor who does not want to use his last name for fear of backlash against his relatives still living in China, noticed his posts on WeChat's Moments — akin to a Facebook news feed — were not going through. Undeterred, he kept sharing politically charged articles.

Within days, he couldn't send messages to any group chat: "Although I was able to read the other people's messages, when I posted my message, nobody could see it. It was like I wasn't there," he says.

David then dialed back his sharing of news articles, limiting his conversations to trivial chitchat and music-sharing. His group chat function was quickly restored. Emboldened, he began sharing his political posts in group chats, only to find himself blocked again.

"Now I am very careful [on WeChat]. I feel like this censorship has affected both my psychology and my behavior," says David. He says he has abandoned his old account and created a new WeChat account to talk to loved ones in China. He lost thousands of contacts in the process. "This is just my main connection to my Chinese friends inside and outside of China."

Tencent, WeChat's owner headquartered in the southeastern city of Shenzhen, declined to comment.

Whether China's government can compel companies to hand over data access is a key question facing the country's major technology companies as they seek a larger share of world markets. For instance, telecommunications giant Huawei is trying to build a mobile network upgrade, known as 5G, around the world and says it would refuse Chinese government requests for data access. But legal experts say national security trumps privacy in China, even if companies put up a fight. U.S. officials allege that Huawei is controlled by the Chinese government, something the company and China's government have repeatedly denied.

"It's a bit of a red herring I think to argue about what the law says or does not say," says Donald Clarke, a George Washington University professor who specializes in Chinese law. Despite economic reforms, Clarke says, "China is essentially a Leninist state in which the government does not recognize any limits on its power."

Back in New Jersey, the activist Zhou says he will continue using WeChat in spite of its vulnerabilities. His work depends too much on it.

"I have to use it to communicate. I just have to know what's going on [in China]. But it is very dangerous," he concedes. "It's a natural choice. We have to use WeChat even though I know it's under surveillance all the time."

Editor's note: An earlier version of this article said Victor Gevers found certain word patterns on WeChat that were flagged and archived. NPR has learned that his analysis used a set of keywords created previously by the Citizen Lab at the University of Toronto. We have amended the story to report on the original research the Citizen Lab conducted.

Copyright 2019 NPR. To see more, visit https://www.npr.org.