Chinese Communist Party members used a “god credential” at TikTok parent ByteDance Inc. to examine the personal data of civil rights activists and protesters in Hong Kong, and identify and track them down, a former company executive said in a court filing.
Yintao “Roger” Yu, a former head of engineering in the US for ByteDance, described a special committee of the Chinese government installed at the company’s Beijing offices that he said monitored all data on the platform, including that of users in the US, according to the filing.
“This was a backdoor to any barrier ByteDance had supposedly installed to protect data from the Chinese Communist Party’s surveillance,” according to the filing in state court in San Francisco. The party’s “superuser credential,” also known as a “god credential,” was “commonly discussed between employees at various levels of the company, including senior executives,” Yu said.
The company also worked with the CCP to promote propaganda, Yu said.
“Yu observed that ByteDance demoted content that expressed support for the protests in Hong Kong (“Umbrella Revolution”), while it promoted content that expressed criticisms of the protests in Hong Kong,” Yu said.
ByteDance said Yu worked for the company for less than a year and was assigned to an app called Flipagram that was discontinued. The company said in an emailed statement it will vigorously fight his suit, which it said is baseless.
“It’s curious that Mr. Yu has never raised these allegations in the five years since his employment for Flipagram was terminated,” ByteDance said. “His actions are clearly intended to garner media attention.”
Read More: Fired ByteDance Exec Says China Exerted ‘Supreme’ Data Control
Yu added the surveillance claims this week to his May lawsuit which alleges he was fired in retaliation for his complaints to ByteDance supervisors about illegal conduct at the company. Yu alleges his bosses were dismissive when he voiced concern that ByteDance was stealing copyrighted content from other platforms including Instagram and Snapchat, as well as fabricating users to exaggerate its metrics.
Yu says he saw the “god credential” used in 2018 to monitor Hong Kong activists identified in previous protests. The filing was first reported by the Wall Street Journal.
TikTok faces growing pressure, and potential bans, from state and federal officials in the US following reports that the company has stored personal financial information of American users on servers in China that employees there can access.
Yu said in his filing that the TikTok app stores users’ direct messages, search histories, what they view and for how long.
In a signed declaration in his most recent filing, Yu said he anticipates his lawsuit will attract the attention of US and state lawmakers, requiring “a certain level of coordination” of legal actions. The filings don’t explain what such coordination means in any detail.
ByteDance users who uploaded content of protests in Hong Kong were also monitored by Chinese officials and “external investigators,” according to the filing. Device identifiers of activists were tracked, as well as their network information, SIM card identifications, and IP addresses, Yu said, adding that he saw from ByteDance logs that committee members examined unique user data, locations, and communications.
The case is Yu v. ByteDance Inc., CGC-23-606246, California Superior Court, San Francisco County.
(Updates with allegations about illegal conduct at company in eighth paragraph. A previous version of the story corrected the spelling of Hong Kong.)
