China's state television broadcaster has urged mainland Chinese netizens to use doxxing site hkleaks.ru to expose Hong Kong protesters and reporters.
The hkleaks.ru site was set up to doxx Hong Kong protesters and reporters by publishing their personal information including photos, residential addresses, birth dates, telephone numbers and social media accounts. It also has an email for people to specifically report on Hong Kong protesters.
What is doxxing?
Doxxing is the practice of publishing someone's personal information without their permission, with the intention to threaten or intimidate. While some of this information may be readily available or easy to find such as a user's own photos posted on their public social media profiles or pages, the intention with doxxing is to harass and threaten the targeted person.
On 18 of September, the China Central Television (CCTV) published a video on its official Weibo account, in which it urged others to use the site to “take off the masks” of the Hong Kong ”rioters”.
The doxing website, was originally registered as hkleaks.org around the end of August and recently moved to a Russian hosting service upon complaint against privacy violations:
Doxxing site hkleaks. ru hosted on Russian domain, using a Russian email (Yandex) & Russian DDOS protection service (ddos-guard) posts personal details of protesters, activists. It recently added info of an HK01 employee & other Apple Daily staff, editorial and non-ed pic.twitter.com/pzwaCgyaUx
— Selina Cheng 鄭嘉如 (@selina_cheng) September 16, 2019
The site has thus far publicized more than 90 individuals’ personal data. The majority of the victims are pro-democracy lawmakers, student activists and journalists from Apple Daily and the Stand News. The site labelled them as ”pro-Hong Kong independence rioters”.
The site also encourages others to submit Hong Kong protesters’ personal information to the site administrator via a Russian email address.
It is illegal to publicize personal data according to local privacy law. So, the Hong Kong Privacy Commissioner could only submit a privacy violation complaint to the Russian domain registry and the hosting company as Russia is outside the authority's jurisdiction.
Meanwhile, details of the website have been systematically spread via mainland Chinese social media platforms. The video posted by the state-run CCTV on Weibo captured contents from the doxxing site and urged Chinese netizens ”to act”:
【转发!认清这些嘴脸!被摘下面罩香港暴徒名单】近日,有网友制作了一个名叫“香港解密”的网站,里面罗列了各种乱港分子和“港独”的名单。网站分成“毒果记者”“港独暴徒”“乱港头目”三类,并按照姓氏排列,方便大家看清楚这些丑恶嘴脸!摘下他们的面罩,一起行动!转!(听港一铜锣湾)
[Repost this! Take a close look at these ugly faces! Take down the mask of Hong Kong rioters] Recently, some netizens have created a “HKleaks” website which have a list of pro-Hong Kong independentists and chaos instigators. The website has three categories: “reporters from poisonous apple”, “pro-Hong Kong independent rioters”, “instigators of chaos in Hong Kong”. It also has a surname index to help the audience to take a closer look at these ugly faces. Take off their masks and let’s act. Repost this! (via WeChat channel: Hearsay from Causeway Bay)
The video was reposted by local media outlets, branches of Chinese Communist Youth League, local police’s weibo accounts and others. It then made its way to Hong Kong via WeChat and Weibo and spread on other social media applications such as WhatsApp.
Many speculated that Beijing has a role in the doxxing of protesters. One of the victims explained to a pro-democracy district councilor Chiu Chu Bong why he believed mainland Chinese police authorities are involved in the doxxing:
有榜上有名的和理非手足向本人透露,自己只是正常參與遊行,非知名社運人士,只擔任普通文職工作,卻被網頁指責為勇武派暴徒,參與多次非法集會,甚至公開個人資料,包括全名、出生日期、Facebook及地址。
早兩個月返大陸過關,被公安扣留5個鐘,期間公安沒收手機檢查,並觀看到相片,指佢參與非法遊行。公安更以USB手指盜取手機內的資料。
事主表示所參與的遊行,全部都有警方發出的不反對通知書。在公安要求填寫的口供紙,地址欄亦刻意寫錯兩處,但上述網頁同樣地照顯示出錯誤的地址。
所以,事主100%肯定係公安將香港人的個人資料洩露。
A peaceful protester told me he was just an ordinary citizen who had joined the protests. He is working as a clerk but was labelled as a “militant protester” who participated in various illegal demonstrations. The site has published his full name, birthday, facebook account and address. He was detained by the mainland Chinese police for 5 hours two month ago and they checked photos on his mobile phone accusing him of participating in illegal protests. The police downloaded information from his phone with an USB.
He defended that all the demonstrations had police permit. The police asked him to fill in a statement and he deliberately wrote a wrong address on the document. The wrong address appeared on the website. Hence he was 100% sure that the leak came from the police authorities.
Another victim told Apple Daily News that his photo on the website was the photo he used in his China travel card. Hence, he suspected that Chinese government-affiliated China Travel Service (Hong Kong) Limited is one of the sources of the leakage. A third source said that the address and phone number he used to apply for his China Travel Visa were published on the site.
While doxxing has also been used by some Hong Kong protesters to publicize information on pro-Beijing mobs who attacked the protesters and police officers who used excessive force during arrests, the related information would usually be quickly taken down from major platforms as they are against the local privacy law. On the other hand, the doxxing of protesters and journalists facilitated by China state run and party affiliated media outlets, could result in a massive political purge.
Hong Kong journalist association has issued a statement expressing concern about the personal safety of the doxxed individuals.
Meanwhile, internet activists are filing a complaint to the website hosting company demanding the takedown of the doxxing site.