With hacks and cameras, Beijing’s electronic dragnet closes on Hong Kong

Paul Mozur, The New York Times

Posted at Aug 26 2020 09:40 AM

With hacks and cameras, Beijing’s electronic dragnet closes on Hong Kong 1
Agnes Chow is arrested at her home in Hong Kong, Aug. 10, 2020. Chow said she was surprised when strange men appeared near her house, openly filming her with their smartphones. “I’m a bit scared,” she wrote in a Facebook post a day before her arrest. Lam Yik Fei, The New York Times 

To get onto his Facebook account, police used Tony Chung’s body.

When officers swarmed him at a Hong Kong shopping mall last month, they pulled him into a stairwell and pinned his head in front of his phone — an attempt to trigger the facial recognition system. Later, at his home, officers forced his finger onto a separate phone. Then they demanded passwords.

“They said, ‘Do you know with the national security law, we have all the rights to unlock your phones and get your passwords?’” Chung recalled.

Emboldened by that new law, Hong Kong security forces are turning to harsher tactics as they close a digital dragnet on activists, pro-democracy politicians and media leaders. Their approaches — which in the past month have included installing a camera outside the home of a prominent politician and breaking into the Facebook account of another — bear marked similarities to those long used by the fearsome domestic security forces in mainland China.

Not accustomed to such pressures, Hong Kong lawmakers and activists, and the US companies that own the most popular internet services there, have struggled to respond. Pro-democracy politicians have issued instructions to supporters on how to secure digital devices. Many have flocked to encrypted chat apps like Signal and changed their names on social media.

Dogged by the global reach of the law, even people from Hong Kong living far away from the city worry. One Facebook discussion group of Hong Kongers living in Australia closed off public access after a user claimed to have reported discussions to Hong Kong authorities for potentially violating the law.

Major internet companies like Facebook and Twitter have temporarily cut off data sharing with local police. Others have gone further, devising more permanent solutions. In July, Yahoo changed its terms of service so that users in Hong Kong are protected under US law, not local rules. It also cut access for employees in Hong Kong to user data to protect them from the law, according to two people familiar with the matter.

A Google spokeswoman said in a statement that the company had not produced data for Hong Kong authorities since the national security law was enacted, and that authorities could seek information for criminal investigations through US diplomatic channels. That means the company is effectively treating data requests in the city the way it does those from mainland China.

Long known as a financial hub, Hong Kong is now emerging as a land of internet fault lines, a place where China’s harsh techno-authoritarian rule collides with the open internet in a society and economy governed by rules that protect digital rights.

“With China’s rising influence and power, it’s not safe for technology companies to put their servers in China or Hong Kong now,” said a prominent activist, Joshua Wong. “It’s important for them to help support Hong Kong’s citizens and society with digital security.”

The first coordinated sting under the new security law made Chung an example of an offense new to Hong Kong but common in mainland China: an internet crime. Police accused him of writing a post calling for Hong Kong independence on the Facebook page of a newly formed political party and demanded he delete it. He denied writing it.

Enforcing internet laws meant gathering digital evidence, and police pushed hard to gain access to Chung’s accounts. Though less than fully prepared for the arrest, Chung said, he was able to foil officers at each turn. In the stairwell when police forced his head in front of his phone, he closed his eyes and scrunched his face, rendering useless his iPhone’s facial recognition software. He had long since disabled the fingerprint unlock on his other phone. For passwords, he told police that he had forgotten them.

Even so, a few hours after he was detained, his friends noticed that his Facebook account was active, appearing as if he were online and using it. Chung believes that the security forces broke in, although he said he was not sure how. When he was released and tried to sign back in, Facebook had frozen his account over a suspicious login.

Hong Kong police declined to comment on recent tactics and cases. A Facebook spokeswoman declined to comment. A spokeswoman for Verizon Media, which owns Yahoo, said it was “assessing potential impacts” of the law on its operations in Hong Kong.

There are also concerns that Hong Kong police are adopting invasive surveillance techniques commonly used by China’s secret police force.

Agnes Chow, a prominent activist and politician, is no stranger to police attention. Weeks before she was arrested this month, she released a YouTube video punctuated with animations designed to teach Hong Kongers the basics of cybersecurity. She dispensed tips like how to enable two-factor authentication and how to maintain a “public toilet phone” where users can download apps they do not trust — like, she pointed out, those from mainland China.

Yet she was surprised when strange men appeared near her house, apparently keeping watch in shifts and openly filming her with their smartphones.

“I’m a bit scared,” she wrote in a Facebook post a day before her arrest that included a photo of the men.

A statement released after her arrest said an infrared surveillance camera had also appeared next to her doorstep in the weeks before her arrest and was removed after she was pulled in by police. In China, putting a camera outside the door of dissidents is a common trick of the secret police.

If the surveillance caught Chow off guard, her response also showed how Hong Kong activists are successfully adapting to aggressive police tactics. Shortly after she was arrested, her personal Facebook account was suspended. An assistant posted on her public page to explain that the account, with the help of Facebook, had been disabled to protect it.

The company allows people to appoint other legal administrators to an account. That person can then coordinate with Facebook to shut the account to protect the data in the event of an arrest.

Other police tactics have been more subtle and more challenging to address.

Hours after media mogul Jimmy Lai was arrested, an employee at his company, Next Digital, received a message from someone posing as a part of tech support. Using the names of his employees, the message asked for login details to Lai’s Twitter account in order to set up a new iPhone for Lai.

Schooled from years of cyberattacks, the recipient of the message flagged it as suspicious. Mark Simon, an executive at Next Digital, said the company believed it was an attempt by Hong Kong police to get the login information for Lai’s account. The tactic has added to a new level of paranoia that has made day-to-day operations more difficult, according to Simon.

“The problem is this slows everything down, because now everyone is double checking: ‘Did you send this message? Did you send that?’ It never stops; it just never, ever stops,” he said.

Calling new police tactics “more aggressive,” Simon said it had become difficult for Lai to hold on to a phone because of the spate of arrests.

“I think they have four of his phones now,” he said. “They take his phone every damn time. Teenage rock stars throwing fits don’t go through as many phones as Jimmy does, thanks to the Hong Kong police.”

Simon added that people in Hong Kong were quickly adapting to the new information security environment. With the police now able to tap phones without a warrant, many citizens have switched entirely to encrypted chat apps. Many, he said, go further, setting the apps to auto-delete messages and even eschewing taking paper notes in meetings.

“I just don’t want to come off this is the end of the world; it’s not. This is just a nuisance that we have to live with every day,” Simon said. “In China this is normal stuff. In Hong Kong they’re learning how to operate.”

c.2020 The New York Times Company