Netizen Report: China's New Cybersecurity Law Hardcodes Surveillance Practices Into Law (And Technology)

Downtown Shanghai. Photos released to public domain.

Downtown Shanghai. Photos released to public domain.

Global Voices Advocacy's Netizen Report offers an international snapshot of challenges, victories, and emerging trends in Internet rights around the world.

China's new cybersecurity law will ban Internet users from publishing information that damages “national honor”, “disturbs economic or social order” or is aimed at “overthrowing the socialist system”. It will codify previously scattered Internet regulations and practices of unique government agencies, and elevate the powers held by the country's Cyberspace Administration, the leading government body making and enforcing policy for the Internet.

The law requires Internet companies to verify users’ identities and to store users’ “personal information and other important business data” in China, effectively making anonymity illegal. The legislation has drawn criticism for its infringement on users’ rights to freedom of expression, privacy and anonymity, and for placing stringent requirements on businesses operating in the country.

In what appears to be one example of the cybercrime law in action, security firm Kryptowire recently identified several models of Android mobile devices that have pre-installed permanent software (firmware) that collects sensitive personal data, including text messages, geolocations, contact lists, and call logs and transmits them to a third-party server in Shanghai, creating backdoor access to user data for law enforcement and other authorities.

Without users’ consent, the code can bypass Android's permission model. This could allow anyone interested in a mobile user's data — from government officials to malicious hackers — to execute remote commands with system privileges and even reprogram the devices.

In addition to the surveillance of private data as required by law, Chinese Android phone users regularly download Android apps from unofficial third party app markets since Google left China in 2010. These Android markets are flooded with apps containing malware that can steal and manipulate personal data.

The company that developed the firmware, ADUPS, said the software was designed to help phone manufacturers “identify junk texts” and “improve mobile phone experience”. The devices were sold by the US-based online retailers Amazon and BestBuy, among others.

Meanwhile, reports that Facebook has developed software allowing it to suppress posts from users’ feeds based on their geographic area also drew criticism this week. The company is reportedly developing the tool to hand over to a China-based third party in order to fulfill the necessary requirements to operate in the country. The New York Times said of the reports, “the project illustrates the extent to which Facebook may be willing to compromise one of its core mission statements, ‘to make the world more open and connected,’ to gain access to a market of 1.4 billion Chinese people. The implications of the cybersecurity law for Facebook's existence in China remain to be seen.

The Gambia shuts down Internet for historic election

On the eve of elections, which were preceded by a fierce campaign, authorities have shut down the Internet and some telephone networks, according to a local journalist. Independent candidate Adama Barrow, backed by a coalition of at least seven political parties, along with Mamma Kandeh of the newly formed Gambia Democratic Congress (GDC), are challenging Jammeh in what analysts say is the most crucial vote in more than two decades. Kemo Cham, a Gambian journalist living in exile, posted on Facebook about the shutdown:

Clearly he has lost, even before the votes are cast. Yaya jammeh is reported to have declared a state of emergency, shutting down the internet, international calls and even electricity supply, just hours before Gambians vote. He knows he will lose in a free and fair elections.

Human rights advocate and website founder arrested in China

The founder of a Chinese citizen news site was detained after police searched his home. Huang Qi is the third well-known rights defender in China to disappear or be detained in a fortnight, after the disappearances of lawyer Jiang Tianyong and citizen journalist Liu Feiyue, who activists believe to be in police custody.

Police in Sichuan burst into the home of the 64 Tianwang founder, searching it and detaining Huang on Monday night, a local activist told US-backed Radio Free Asia (RFA). They had a search warrant, she said.

Tianwang is an independent news site that posts articles and information about human rights incidents in China, including detentions by police, forced demolitions, petitioner activism and demonstrations. It recently received the 2016 Reporters Without Borders Press Freedom Prize. Nine citizen journalists who have contributed to the site are currently detained, and five are on bail, according to Tianwang.

Bahraini activist charged with ‘inciting hatred’ over protest tweets

Bahraini human rights defender Hussain Radhi was charged with “inciting hatred against the regime, threatening civil peace and publishing false news” for several tweets and retweets intended to document protests in Bahraini villages and their suppression by police. Radhi has denied the charges brought against him.

Lebanese PM bans political photographer

Photojournalist Hussein Baydoun was recently banned from the home of Lebanese Prime Minister Saad Hariri, where formal meetings and events frequently take place. Baydoun, who works with The New Arab and as an independent photographer, is well known for  photos  documenting political protests in Lebanon, among them the 2015 ‘you stink’ protests against government corruption were featured in numerous outlets.

Brazilian court rules against ‘Right to Be Forgotten’

Brazil's Superior Court of Justice (STJ) decided unanimously that the “right to be forgotten” cannot be imposed upon Google or other search engines, reasoning that this would give search engines too much responsibility, effectively making them into digital censors. The decision goes against that of the European Court of Justice which decided in 2014 that search engines do bear responsibility for de-indexing search results when an individual could successfully claim a right to have “old or irrelevant” information about them removed from search engine results. The rule has been hotly disputed in the EU and elsewhere, particularly in cases where public figures have sought to have information removed from search results, in what appears to be an effort to improve their public image.

New Research


Subscribe to the Netizen Report by email


Afef Abrougui, Ellery Roberts Biddle, Oiwan Lam, Weiping Li, Elizabeth Rivera, Taisa Sganzerla and Sarah Myers West contributed to this report.

1 comment

Join the conversation

Authors, please log in »


  • All comments are reviewed by a moderator. Do not submit your comment more than once or it may be identified as spam.
  • Please treat others with respect. Comments containing hate speech, obscenity, and personal attacks will not be approved.