"Breaching Trust," China’s TOM-Skype platform
Our OpenNet Initiative (ONI) colleagues at the Citizen Lab have released a major investigate report, Breaching Trust: An analysis of surveillance and security practices on China’s TOM-Skype platform, by Nart Villeneuve (Psiphon Fellow, Citizen Lab, Munk Centre for International Studies, University of Toronto), with a foreword by ONI Principal Investigators Ron Diebert and Rafal Rohozinski.
Nart Villeneuve provides an overview of the findings on his blog
(he's answering questions on a subsequent post):
Our investigation reveals troubling security and privacy breaches affecting TOM-Skype—the Chinese version of the popular voice and text chat software Skype. It also raises troubling questions regarding how these practices are related to the Government of China’s censorship and surveillance policies.
The questionable security practices of TOM-Online led to the disclosure of millions of records containing personal information regarding mobile phone accounts, SMS messages, and the usage of TOM-Skype. However, this disclosure also confirms that TOM-Skype is censoring and logging text chat messages that contain specific, sensitive keywords and may be engaged in more targeted surveillance.
These findings raise key questions. To what extent do TOM Online and Skype cooperate with the Chinese government in monitoring the communications of activists and dissidents as well as ordinary citizens? On what legal basis is TOM-Skype capturing and logging this volume and detail of personal user data and communication, and who has access to it?
Major Findings
• The full text chat messages of TOM-Skype users, along with Skype users who have
communicated with TOM-Skype users, are regularly scanned for sensitive keywords, and
if present, the resulting data are uploaded and stored on servers in China.• These text messages, along with millions of records containing personal information, are
stored on insecure publicly-accessible web servers together with the encryption key required to
decrypt the data.• The captured messages contain specific keywords relating to sensitive political topics such
as Taiwan independence, the Falun Gong, and political opposition to the Communist Party
of China.• Our analysis suggests that the surveillance is not solely keyword-driven. Many of the
captured messages contain words that are too common for extensive logging, suggesting
that there may be criteria, such as specific usernames, that determine whether messages are
captured by the system.
The New York Times has covered Breaching Trust in a story by John Markoff.
Congratulations to Nart and Ron, Rafal, and team on this extraordinary report!