Hong Kong’s internet freedom fighters: Big Tech should reconsider what data they collect

Some of Hong Kong’s internet freedom fighters would rather see tech giants leave Hong Kong. Ultimately, the companies will have to comply with the Chinese national security law and leave millions of Hongkongers vulnerable to surveillance.

In Hong Kong, tensions over the Chinese national security law are rising. The pro-democracy activist and media tycoon Jimmy Lai was arrested along with 9 other activists on suspicions of breaches of the national security law. Apple Daily founder was released on bail, and according to the Guardian, received a hero’s welcome while Chinese state media labeled him “genuine traitor”.

“There will be a long fight ahead for Hong Kong's freedoms,” Mr. Lai told the BBC. With the national security law in place, the city’s internet freedom fighters are talking about “the fall of Hong Kong,” and some wish for Big Tech companies to leave Hong Kong rather than comply with the law.

The law authorizes mainland security agencies to operate in Hong Kong, threatens to impose penalties of up to life imprisonment for those accused of secession, subversion, terrorism, and collusion with foreign or external forces. Chinese authorities can request personal data from tech platforms for the sake of law enforcement.

“In the past, Hong Kong was the place where we would be able to fight for other people and their freedom of expression, now we are looking for others to help us out with this imminent barrier in front of us,” said Edmon Chung from DotAsia Organisation during the Rightscon 2020 summit.

Hong Kong before and after the national security law

Even before the law was enacted in Hong Kong, there were attempts to crack down on internet freedom, says Glacier Kwong from a non-governmental organization called Keyboard Frontline.

Last October, the government applied for an injunction against speech that incites violence.

“This is speech that encourages people to go to the protests. This injunction targeted mainly online platforms. They have been threatening to shut down the internet,” Glacier Kwong said during Rightscon 2020.

Hong Kong had The Personal Data (Privacy) Ordinance long before the national security law was enacted, but even then, Glacier Kwong reckons, it was outdated and did not provide enough protection.

Police can enter premises without a warrant, they can restrict movement, but worst of all, they can intercept communication without asking for approval, they can require a platform to hand over a user's data and all the data they have,

said Glacier Kwong.

“The police had really enormous power that did not have equivalent checks and balances, when, for example, they can unlock users’ phones, stop and search you in the streets, and they can crack your phone open,” said Glacier Kwong.

Now, police in Hong Kong have even more power: “Police can enter premises without a warrant, they can restrict movement, but worst of all, they can intercept communication without asking for approval, they can require a platform to hand over a user's data and all the data they have.”

This creates a problem of self-censorship. To avoid getting in trouble, Hongkongers have been erasing their own posts online, deleting politically sensitive content from their social media accounts.

“People have been unliking political activists’ pages to avoid trouble. The scariest part is the fear that this law generates. People stop speaking up. And then you realize that those people around you are not talking about the things they used to,” said Glacier Kwong.

Will social media companies leave Kong Kong?

She also argues that the law has an extraterritorial effect. Government officials now are allowed to request online platforms to remove information, and failing to do so can result in legal penalties, including imprisonment.

“The law can require platforms to remove news about Hong Kong and China. Technically, they can do it outside Hong Kong and China as well. I’m not sure how they do that, but they claim to have the power to do so. It basically means that they can control whatever the citizens of Hong Kong can see and cannot see, and therefore control what we think,” said Glacier Kwong.

This is not unprecedented. Previously, police had taken over Telegram channels that provided audiences with information about the movement. “This will only worsen,” believes Kwong.

Tech companies are now suspending the government's requests for data, but that is not a permanent solution. Social media companies are taking the time to review their internal policies and see how they can handle this type of request.

“Ultimately, they will have to comply if they want to continue their services in Hong Kong and if they want to maintain their market share,” said Keyboard Frontline spokesperson.

She would prefer for social media companies to leave Hong Kong and thus push for a greater change. But she doesn't believe it will happen. Even now, reckons Kwong, Big Tech companies are creating different classes of citizens.

“Apple has different versions of the App Store. You can’t find Telegram or Signal on the Chinese version of the store. (...) They are directly involved in human rights violations because they are enabling the Chinese government to suppress freedom of speech,” said Glacier Kwong.

What are the options for Big Tech?

“The bigger effect right now is the chilling effect. That’s pretty certain and we are already seeing it,” said Edmon Chung, member of DotAsia Organisation. As the national security law was frauded in secrecy, he reckons, it is important to guard against abuse.

CyberNews has already written how the increasing encroachment of mainland China on Hong Kong in the last few years has given those tech companies cause for concern. The law does provide a couple of defense rules, though.

One is end-to-end encryption. Social media platforms, such as Signal and Protonmail, are arguing that they simply can’t provide any users’ data to local law enforcement, as data is encrypted and therefore not readable.

Also, companies must reconsider what data they want to collect.

“In the past 10 or 15 years, most of these platforms have been operating with this motto about data - the more the merrier. You get the data, and then figure out how to use it,” said Mr. Chung.

Now the companies have to think over if they want to keep sensitive data, such as interpersonal messages.

“We need to think through what kind of data we want to keep about users. What kind of data is essential to the business? If communications data is not the kind of data you want, maybe encryption is the way to go. Even if the government asks for information, you can give access to it, but it’s encrypted, and therefore impossible to read” said Mr. Chung.

There’s one more condition on which companies can refuse to disclose private data. If there’s a risk of substantial harm or loss to a third party, a company can refuse that particular request. 

In the past, Hong Kong was the place where we would be able to fight for other people and their freedom of expression, now we are looking for others to help us out with this imminent barrier in front of us,

said Mr. Chung.

Mr. Chung emphasized that serving users is at the core of tech companies.

“There was an incident with Yahoo - it released certain information about a user in mainland China, and the person was arrested. It caused an uproar from the international community. Hopefully, platforms such as Google and Facebook will not make that mistake today. Ultimately, serving the user is important,” said Mr. Chung.

The law states that safeguarding human rights is a priority. But Mr. Chung believes that it has to be closely monitored.

“Not standing up to that, I think, is not an option. Now is the time to set the precedent. The more we can hold that line, the better or, at least, the longer we can enjoy the freedoms. In the past, Hong Kong was the place where we would be able to fight for other people and their freedom of expression, now we are looking for others to help us out with this imminent barrier in front of us,” said Mr. Chung.