Former ByteDance executive alleges Chinese officials used “god credential” to circumvent user data protection.
Taipei, Taiwan – The Chinese Communist Party (CCP) has access to user data collected by TikTok owner ByteDance through a “god reference” it used to track and monitor Hong Kong activists and protesters in 2018, a former ByteDance executive claimed in a court case.
In a lawsuit, Yintao “Roger” Yu, a former chief of engineering at ByteDance in the United States, said a special committee in Beijing had a back door to firewalls set up by ByteDance to protect user data and used this access to spy on users in Hong Kong.
“Device IDs of protesters, supporters and civil rights activists were tracked, in addition to their network information, SIM card identifiers and IP addresses,” Yu said in the filing filed this week in a San Francisco court.
“This information was used to determine both the identity and location of the users. The TikTok app stores all users’ direct messages, their search history, the content viewed by the users, and the duration. From the logs I saw that the committee had access to the unique user data, locations and communications of the protesters, civil rights activists and supporters.”
Yu said the existence of the “god reference” is well known to ByteDance executives and directly contradicts the promises they have made to lawmakers in the US and other countries who are debating whether or not to ban TikTok due to national security concerns, the filing said.
Yu’s claims, which are part of a wrongful dismissal lawsuit against ByteDance, follow a lawsuit in May in which the former executive alleged that the backdoor “allows certain high-ranking individuals to access user data regardless of where the data resides, even if hosted by a American company with servers in the US”.
Yu said he also witnessed ByteDance using TikTok to advance the CCP’s political agenda, including promoting content “expressing hatred against Japan” and demoting content that showed support for the Umbrella Movement protests in Hong Kong, the filing said.
ByteDance also allegedly scraped data on its website and those of competitors like Instagram and Snapchat without permission, according to the filing.
Yu is suing ByteDance for allegedly firing him for raising concerns about illegal conduct at the company, violation of whistleblower protections and discrimination related to his disability-related medical leave.
ByteDance, which is headquartered in Beijing, denied the lawsuit’s allegations on Wednesday.
“It is curious that Mr. Yu has never made these allegations in the five years since his employment with Flipagram was terminated in July 2018. His actions are clearly intended to gain media attention,” a spokesperson said in a statement to Al Jazeera.
“We intend to vigorously oppose what we believe to be baseless claims and allegations in this complaint. Mr. Yu worked for ByteDance Inc for less than a year. and his employment ended in July 2018. During his brief time with the company, he worked on an app called Flipagram, which was discontinued years ago for business reasons.