Chinese Communist Party members used a “god credential” at TikTok parent ByteDance Inc. to examine the personal data of civil rights activists and protesters in Hong Kong, and identify and track them down, a former company executive said in a court filing.
Yintao “Roger” Yu, a former head of engineering in the US for ByteDance, described a special committee of the Chinese government installed at the company’s Beijing offices that he said monitored all data on the platform, including that of users in the US, according to the filing.
“This was a backdoor to any barrier ByteDance had supposedly installed to protect data from the Chinese Communist Party’s surveillance,” according to the filing in state court in San Francisco. The party’s “superuser credential,” also known as a “god credential,” was “commonly discussed between employees at various levels of the company, including senior executives,” Yu said.
The company also worked with the CCP to promote propaganda, Yu said.
“Yu observed that ByteDance demoted content that expressed support for the protests in Hong Kong (“Umbrella Revolution”), while it promoted content that expressed criticisms of the protests in Hong Kong,” Yu said.
ByteDance representatives didn’t immediately respond to a request for comment. The company has previously called Yu’s allegations “baseless,” and said it will vigorously fight the suit.
Read More: Fired ByteDance Exec Says China Exerted ‘Supreme’ Data Control
Yu added the surveillance claims this week to his May lawsuit which alleges he was fired in retaliation for his complaints to ByteDance supervisors about illegal conduct at the company. Yu says he saw the “god credential” used in 2018, the same year he was terminated, to monitor Hong Kong activists identified in previous protests. The filing was first reported by the Wall Street Journal.
TikTok faces growing pressure, and potential bans, from state and federal officials in the US following reports that the company has stored personal financial information of American users on servers in China that employees there can access.
Yu said in his filing that the TikTok app stores users’ direct messages, search histories, what they view and for how long.
In a signed declaration in his most recent filing, Yu said he anticipates his lawsuit will attract the attention of US and state lawmakers, requiring “a certain level of coordination” of legal actions. The filings don’t explain what such coordination means in any detail.
ByteDance users who uploaded content of protests in Hong Kong were also monitored by Chinese officials and “external investigators,” according to the filing. Device identifiers of activists were tracked, as well as their network information, SIM card identifications, and IP addresses, Yu said, adding that he saw from ByteDance logs that committee members examined unique user data, locations, and communications.
The case is Yu v. ByteDance Inc., CGC-23-606246, California Superior Court, San Francisco County.