Encryption vs. Surveillance in Hong Kong

The 2020 Hong Kong national security law is an extension of the provisions which govern the over 1.4 billion citizens of China. Designed to combat the rising civil unrest in the city, the security law ensures that censorship and control of information within Hong Kong remain in the hands of the Chinese Communist Party (CCP).

As evidenced by the recent arrest and extradition of Next Digital’s Chairman, Jimmy Lai, the political landscape of Hong Kong is changing rapidly as media tycoons and activists alike are arrested for crimes of secession, subversion, and collusion with foreign forces.

As Hong Kong becomes accustomed to these new restrictions on its freedom of expression and access to information, the rise and use of end-to-end encryption technology have reached unprecedented levels. New market entrants and established foreign competitors, including Signal, WhatsApp, and Telegram, seek to obtain market share and encourage the freedom of information and unmonitored forms of communication.

In direct competition with firms promoting secure communications, competitive market rivals, such as Tencent, Alibaba, and Huawei are being backed by the government to replace fleeing foreign competitors in the local market. As the national security law encircles the region and its residents, a series of winners have begun to emerge in the battle of encryption vs. surveillance within the technology marketplace.

The rise of end-to-end encryption (E2EE), a technology used to secure messages and prevent third parties from monitoring conversations, has steadily grown within China’s technology landscape since the early 2000s.

Once used as a means of native communication to express uncensored freedom of speech, E2EE has evolved into cross-platform messaging services used to organize mass demonstrations and pro-democracy movements. In the wake of the national security law, citizens are relying more than ever on E2EE in order to maintain their anonymity while organizing events.

New market entrants are capitalizing on the recent political instability to provide free E2EE services which focus on privacy and security. Three of the most prominent, Signal, Telegram, and WhatsApp have significant user bases throughout the world, which as of 2020 are estimated at 10 million, 400 million, and 2 billion, respectively.

WhatsApp and Telegram have previously established market share in Hong Kong, but Signal has taken off due to more advanced security features. Unsurprisingly, these applications have grown exponential user bases in the past two years as the CCP introduced the 2019 Hong Kong extradition bill and 2020 national security law. Eight days after the controversial passing of the national security law, Signal became the most-downloaded app in Hong Kong on both Apple’s and Google’s mobile app stores.

As the need for E2EE services has grown, these service providers are sourcing public donations and leveraging government grants to expand their operations and provide free access to secure means of communication. In February 2020, Signal received a cash infusion of US$50 million from WhatsApp co-founder Brian Acton to improve app accessibility and introduce E2EE technology to the mainstream consumer.

Over the last three months, Signal has delivered on its promise of enhanced security features through the introduction of new innovative technologies, including self-destructing messages, encrypted stickers, and a system for group messaging which creates “anonymous credentials” that protect the identity of its members.

Most importantly, the encryption keys used to ensure the security of data are stored at endpoints by the user, preventing unauthorized users from accessing the information. This new technology has expanded Signal’s product offering and sparked innovation within the privacy industry. Although Signal, Telegram, and Whatsapp are non-profit organizations, these encryption-based services represent real winners in China’s evolving technology landscape.

Considering the current trend of politics and the need for safe and secure messaging services, E2EE business is experiencing significant user growth during a time of political and economic uncertainty. However, due to the wide and undefined scope of the Hong Kong national security law, this growth may be premature as China’s Great Firewall may increasingly infiltrate the local network infrastructure and block access to Apple’s and Google’s mobile app stores.

Hong Kongers have anticipated the CCP’s response and have attempted to circumvent the ruling party’s censorship primarily through the use of virtual private networks (VPNs), which mask the user’s internet protocol (IP) address and render online actions virtually untraceable. One platform, NordVPN, saw inquiries on its service increase by 120 times following the implementation of the security law.

As evidenced by the 2019 CIGI-IPSOS Global Survey, a comprehensive internet study released jointly with the United Nations Conference on Trade and Development (UNCTAD) and the Internet Society, internet privacy and security remains a significant concern for Hong Kongers as over 96% of citizens surveyed within the region were concerned about their online privacy.

Still, there exists a real possibility that the Chinese government will order the nation’s three state-run phone carriers to enforce a ban on VPNs for individuals and require companies to register their use of VPNs similar to 2017, as reported by Bloomberg. Time will tell what impact E2EE services will have on China’s technology landscape.

In spite of the security measures taken by Hong Kongers, including the widespread use of E2EE applications and VPN technology, the national security law is naturally inclined to push out foreign tech companies and institute mass surveillance over the region through an existing network of domestic corporations. Key provisions of the legislation, including the ability to take down online posts and threaten fines and imprisonment, have led to Google, Facebook, Twitter, WhatsApp, and

Telegram suspending all data requests from the Chinese government — Signal affirms that they never began giving data to authorities. This refusal to comply with government demands could play into the hands of the CCP as it seeks a potential mass exodus of foreign firms and the adoption of ruling party approved service providers, particularly Mainland firms that have readily answered the call for government data requests.

Tencent’s WeChat is the most likely state-backed platform to be utilized by the Chinese government as it introduces mass surveillance into Hong Kong. As published within Citizen Lab’s May 2020 WeChat Surveillance report, a comprehensive analysis of surveillance conducted over the most popular social app in China, WeChat is designed to surveil registered accounts and user messages by identifying blacklisted keywords (i.e. falun gong) and images (Pooh). If a user sends censored content in a message, the data is filtered through Tencent’s servers and does not reach its intended destination.

Further, this report found that WeChat users among non-Mainland China accounts, including Hong Kong and the United States, are subject to similar content surveillance and that politically sensitive data harvested from these non-Mainland accounts are used to train and build the WeChat’s censorship system. As WeChat is the second most-downloaded app in Hong Kong, there is a chance that censorship pushes out secure E2EE communications to an extent over time.

The movement of surveillance could extend well beyond the realm of social media into other digital activity. Alibaba, China’s largest cloud service provider, and Huawei, China’s largest smartphone producer with 41% of the domestic market, are readily compliant with CCP data pull requests and have vast access to the country’s data. These businesses represent winners as the bargaining power of buyers decreases due to the restrictions on foreign market entrants and the future possibility of China’s Great Firewall blocking access to VPN technology. Mass surveillance represents the way of the future for Hong Kongers as the national security law takes shape in the region.

Through the enactment of the 2020 national security law, the Chinese government has increased its control over censorship within Hong Kong and opened the doors for Chinese tech giants such as Tencent, Alibaba, and Huawei, to expand their market share in an economic environment in which few industry alternatives exist.

Armed with the competitive advantages of public ownership and state-wide support, these companies are experiencing short-term benefits while their long-term success is tied to the Chinese state and its ability to maneuver the political and economic obstacles erected by the unique nature of Hong Kong.

In response to the national security law’s restriction on information and the lack of alternative technology outside of the CCP’s control, Hong Kongers have turned toward E2EE technology through Signal, Telegram, and WhatsApp as a means of maintaining the pro-democratic movement in the region and protecting their data privacy.

In the short-term, Hong Kongers are supported in their efforts by the availability of these apps and access to VPN technology. If the Great Firewall of China fully encircles the HKSAR at a later time, the long-term viability of these applications is questionable. The future is uncertain and so too are the long-term effects of the 2020 national security law on Hong Kong.