Muting Zoom, The Wire China, Aug. 6, 2023.

2023年9月9日 15:36

Chinese interference in the video conferencing company's operations is a stark lesson that governments need to get involved in countering Beijing's influence.

On the evening of June 8, 2020, four days after the 31st anniversary of the Tiananmen Square Massacre, I received a message from Zhou Fengsuo, a student leader during the 1989 pro-democracy movement who now lives in New Jersey.

“Hi, Bethany, our Zoom account was closed with no explanation,” he wrote. “We have emailed Zoom asking for the reason, but we haven’t received a response.”

He wasn’t the only one affected. Numerous other Chinese pro-democracy activists in both the U.S. and Hong Kong had seen their accounts closed and their virtual Tiananmen memorials disrupted, with no response from the video conferencing company.

Zhou and I had known each other for several years through his work in the Chinese pro-democracy movement and the reporting I had done on human rights issues in China. He is gentle and soft-spoken, but he has a will of iron. After the June 4 massacre and subsequent crackdowns crushed the movement, he was thrown in prison for a year and then released but kept under close surveillance for several years. The Chinese government permitted him to leave China in the mid-1990s, when he came to the U.S. and attended graduate school. He has long served as a leader of the Chinese dissident community abroad, and in 2007, he founded Humanitarian China, a nonprofit organization dedicated to helping political prisoners in China.

The Chinese Communist Party has sought to stamp out the memory of the Tiananmen pro-democracy movement through a smothering veil of censorship. Tiananmen survivors such as Zhou work to counteract this by holding annual vigils to keep the spirit of the movement alive and to honor the memory of those who were murdered.

Despite the Covid-19 pandemic, 2020 was no different. Humanitarian China, together with several other Chinese pro-democracy organizations, did what millions of others had done amid the lockdowns and quarantines. They moved their event to Zoom.

The pandemic was an extraordinary windfall for Zoom, whose videoconferencing services quickly became part of this shared experience. Zoom was founded in 2011, in San Jose, California, by a China-born engineer named Eric Yuan who moved to the U.S. to work for Cisco’s Webex and became a naturalized American citizen in 2007. At the end of 2019, the U.S. company had ten million daily users. By April 2020, that number had soared to more than 300 million. In its April 30 filings, Zoom posted revenues of over $328 million — a 169 percent increase from the year before.

But Zoom’s good fortune represented a major opportunity to other organizations as well: China’s security agencies. That’s because, while Zoom is a U.S. company, one particular feature sets it apart from Cisco’s Webex, Google Meet, and similar services from other companies. More than 700 of its employees (most of its research and development team) are based in China.

Zhou’s message to me that day set into motion a chain of events that would culminate in a groundbreaking Department of Justice investigation proving that several worst-case scenarios about the reach of China’s security state into U.S. businesses had already become reality — and in an indictment in which the DOJ broadcast for the first time that it would no longer tolerate Chinese government harassment of dissidents on U.S. soil.

…there is no market-based solution to the problem of Chinese government coercion of U.S. businesses with operations on Chinese soil.

The case involving Zoom demonstrates there is no market-based solution to the problem of Chinese government coercion of U.S. businesses with operations on Chinese soil. Democratic societies cannot look to companies to fix this. The only alternative is one of government action.

——————

Zhou Fengsuo’s Zoom troubles began on May 15. That day, he and a group of other Chinese dissidents, mostly based around the East Coast, held their first planning meeting for the upcoming June 4 Tiananmen Square Massacre memorial, hosted through the personal Zoom account of Zhu Rikun, a well-known Chinese independent filmmaker.

The group had evaluated several options for a videoconferencing platform, eventually choosing Zoom. Google Meet was blocked in China, but Zoom wasn’t, and it was easy to use. People in China could simply scan a QR to get into the meeting without creating an account, thus limiting their manual input of personal information and reducing their online traceability.

Zhou had known using Zoom wasn’t without risk; the company had significant operations in China. In recent years, the Chinese government had begun exercising growing political control over businesses’ decisions, demonstrating to executives and entrepreneurs that working closely with authorities was the key to success in the Chinese market — while rejecting government demands to censor information and hand over data could result in fines or even being blocked outright from the Chinese market. Zhou believed, however, that sufficient precautions could still allow the meetings to go off without a hitch.

But the dissidents had problems almost immediately. As they tried to start their first planning meeting, Zhu found he couldn’t dial in. He and the other organizers immediately realized something was wrong.

Zhou decided to open a new Zoom account specifically for the purpose of hosting the upcoming June memorial. “We paid the highest premium available. It was pretty expensive, in the hundreds just for one month. Knowing we might encounter some problem, we wanted to have the highest account,” he said.

Finally, on May 31, the group held the first-ever virtual Tiananmen Square Massacre vigil. It lasted from 9 to 11:30 a.m. Eastern time. The online format also made it the first global commemoration. People in Taiwan, Hong Kong, mainland China, the U.S., and other countries spoke about their memories of the event and its lasting legacy.

“After the conference, I was actually quite content,” Zhou told me. “Even though I knew that people in China were paying a very high price for this — there were people arrested — we were able to let them speak out. If there is such a platform that could penetrate the firewall and really connect people freely, how great would that be? So, I was hopeful.”

This feeling of hopefulness was not to last. On June 5, Zhou tried to log back on to the paid Zoom account to start making plans for an upcoming event in July on Chinese human rights lawyers; but he was unable to and soon realized the account had been shut down.

——————

As Zhou Fengsuo and other activists were preparing their first-ever online Tiananmen memorial, Julien Jin was hard at work thousands of miles away. The 39-year-old Chinese citizen was a Zoom employee serving as a “security technical leader” based in the company’s offices at a technology park in Hangzhou, Zhejiang Province.

Jin’s official job responsibilities included liaising with China’s law enforcement and security services, including the Ministry of Public Security [MPS] and the Ministry of State Security [MSS], the political security and intelligence arm of the Chinese government. Jin’s role had been created in late 2019, after the Chinese government blocked Zoom’s access to the Chinese market. Access was restored only after the company agreed to proactively supervise and report “illegal” content within the Chinese market, granted Chinese security authorities special access to its China-based systems, and agreed to migrate the data of one million “Chinese users” from U.S. servers to servers in China.

But Jin’s actual activities went beyond what Zoom had authorized him to do.

The dramatic increase in the number of Zoom users in the early months of the pandemic coincided with increasingly stringent controls over the company’s internal workings, and with demands from Chinese security agencies to immediately block any activities on the teleconferencing platform, anywhere in the world, that authorities deemed illegal.

Starting in April 2020, as the U.S. was in the early weeks of its first major lockdown, Jin began to subvert internal company protocols to freeze user accounts and shut down meetings, even beyond China’s borders, that crossed Beijing’s red lines, U.S. government documents allege. The MSS began tasking Jin to proactively target specific groups based abroad. In a message that month, Jin told one U.S.-based Zoom employee that the “[MSS] asked me to track down a bad organization overseas.”

The Chinese government and its security services were aware that their attempts to use Zoom for political censorship would be unpopular if they became public. The Shanghai branch of the MSS came to Zoom’s offices in Hangzhou and requested that Jin and others sign a nondisclosure agreement. As he explained to another employee, “What the MSS is asking for are mostly politics related, therefore they request that we cannot disclose it otherwise it will greatly impact our country’s reputation.”

Jin targeted several different users during this time. As Zhou and other dissidents began planning and hosting Tiananmen memorials, Jin was following their every move. In early June, Jin asked U.S.-based Zoom employees to send him the name, email address, user ID, and account number of the Zoom account used to hold Zhou’s May 31 planning meeting. The Zoom employees readily complied, and the account was closed.

Jin also targeted a separate online memorial hosted on June 4 by another Tiananmen leader and survivor, Wang Dan. This time, to disrupt Wang’s meeting, Jin hadn’t simply asked Zoom employees to shut it down. Rather, he and a group of people — whom the FBI referred to in court filings as “co-conspirators” — allegedly created a set of dummy email accounts, which they used to email false complaints about the meeting to an official Zoom complaint in-box.

It was clear that these specific complaints had been chosen not because they made narrative sense but because they ran the gamut of serious violations of Zoom’s user guidelines.

The complaints were accompanied by manufactured evidence that was almost laughably fake. One email claimed that the meeting was inciting “terrorism and violence.” According to U.S. court documents, the email included screenshots of fabricated profiles for people who were supposedly participants in the Zoom meeting. One profile was listed as belonging to someone named “Kate Steve,” who had uploaded photos to their Zoom account featuring imagery affiliated with the Basque separatist group Euskadi Ta Askatasuna, which was founded in 1959 and designated a terrorist group after numerous bombings and assassinations; the group accepted a cease-fire in 2010 and voluntarily dissolved in 2018. Another Zoom profile featured a photo of someone in a mask holding a flag that resembled the Islamic State’s; yet another showed people holding guns while standing with Muslim clerics.

More emailed complaints rolled in, with screenshots of Zoom accounts that were supposedly participating in the June 4 meeting. One image featured a card dealer; another showed two naked women; and several others showed more militant Islamic content. Several emails alleged that the meeting was inciting “racial conflicts.” Anyone doing the slightest bit of due diligence on these complaints would likely have found it odd to see Basque separatists, Islamic State supporters, pornographers, gamblers, and racists joining a Zoom call about a massacre by the Chinese government that had happened more than thirty years before. It was clear that these specific complaints had been chosen not because they made narrative sense but because they ran the gamut of serious violations of Zoom’s user guidelines.

Zoom acted quickly on the complaints. Wang’s June 4 memorial was shut down partway through.

——————

For a while, it seemed that Jin and China’s security state had won. Tiananmen memorials and subsequent meetings had been shut down, accounts outside China had been closed, and Zoom wasn’t responding to emails from the Chinese activists who had been affected. After I published an article for Axios about the shutdowns, there had been a media storm, and some members of Congress had sent a letter to Zoom demanding accountability. But nothing substantive had really happened. Zoom’s profits and user base continued to grow.

Then, on August 10, 2020, Zhou Fengsuo’s cell phone rang. It was FBI Special Agent Joseph Hugdahl, who, after introducing himself, asked Zhou if he would be able to meet him in a few days’ time.

Hugdahl and his FBI colleagues had been busy for a while. In June, amid the media outcry, Zoom had received a grand jury subpoena from the U.S. Attorney’s Office for the Eastern District of New York. The next month, Zoom’s offices in San Francisco received subpoenas from both the U.S. Attorney’s Office for the Northern District of California and the U.S. Securities and Exchange Commission. Agents interviewed Wang Dan in Maryland and others in the U.S. who had been affected by the account suspensions and meeting shutdowns.

As the investigation deepened, the FBI scrutinized thousands of emails, text messages, and other communications from dozens of Zoom employees, U.S. court documents show. Agents examined IP addresses, noted time stamps on emails sent to generic Zoom in-boxes, and compared them with communications to and from Julien Jin.

On November 18, 2020, Hugdahl filed a 47-page indictment against Zoom employee Julien Jin. A month later, the Department of Justice unsealed the indictment and charged Jin with conspiracy to commit interstate harassment and unlawful conspiracy to transfer a means of identification.

——————

Every government in the world is facing the new and growing challenge of digital governance and national security in the internet age. It’s no surprise that the Chinese government has also sought to beef up its cybersecurity and internet governance laws. Some of these measures address universal concerns of digital governance, privacy, and rights, such as China’s push to prevent private actors from illegally obtaining and abusing internet user data.

But Beijing’s approach goes farther than what democracies have so far pursued and, in some ways, is fundamentally different. Chinese government regulators require electronic service communications providers operating within China’s borders to monitor live communications, to block content deemed politically sensitive or illegal, to suspend accounts transmitting such content, and to hand over any related data and personal information upon request by a Chinese law enforcement or national security agency. The Cybersecurity Law that took effect in June 2017 required companies to store data for Chinese users on servers in China, strengthening Chinese state control over this information.

Several broader lessons can be drawn from Zoom’s experience in China. First, by establishing a relationship with China’s MSS and cybersecurity authorities, any U.S. or foreign company is putting its operations and reputation at risk, even if, on paper, the relationship has clearly delineated boundaries. Julien Jin was a Zoom employee who was formally appointed by the company itself to be the liaison between Zoom and the Chinese government.

But the secretive and ever-expanding demands of China’s security police turned him from a Zoom employee first and foremost into a de facto embedded government agent in the company, with access to its systems and an unofficial ability to draw on company relationships to secretly expand his limited access. Jin’s initial role wasn’t a secret. According to U.S. government documents, even Zoom CEO Eric Yuan had direct knowledge of it and was in direct communication with Jin about the role.

The second lesson is that the Chinese government will take everything it can until clear boundaries are drawn — and even then, those boundaries must be defended against encroachment. When Chinese security officials asked Jin to transfer the Zoom user data of numerous U.S.-based individuals, this action was already illegal under U.S. law. Jin’s actions to disrupt Zoom meetings held outside China violated the company’s terms of service, but he was still able to accomplish what he wanted. It was media coverage and a sweeping FBI investigation that finally got Zoom to fire him.

Beijing has articulated a vision of “internet sovereignty,” a model that supports its right to remove any content from the internet within China’s borders. This articulation of internet sovereignty is primarily defensive, a communication to the democratic world that its freewheeling information ecosystem isn’t welcome in China.

The Zoom case, however, demonstrates that Chinese security authorities don’t view themselves as bound by the concept of internet sovereignty to act only within China’s digital borders. Rather, it was the forceful intervention of U.S. federal law enforcement that stopped the local MPS bureau and MSS bureau from using a Zoom employee to extend their reach into the United States’ digital borders.

Through consistent application of law, coercion, and rewards, [the CCP] has forcibly changed the market experience to incentivize profit-seeking organizations to do whatever it says.

Third, journalism and civil society action increasingly will only have efficacy in halting the Chinese Communist Party’s expanding authoritarianism to the extent to which those efforts result in U.S. government action. In the face of extremely compelling incentives (in the form of market access and profits) simply to ride out U.S. media storms related to China — and with the risk of a media counter-storm in China and state-fanned boycotts by Chinese consumers should the U.S. company do something to “hurt the feelings of the Chinese people”— U.S. companies have become less likely to reject Chinese government demands in response to popular scrutiny in the U.S. alone.

In the long run, the Chinese Communist Party aims to slowly change the values that make such behavior considered beyond the pale. Beijing wants the world to accept its jurisdiction over ethnic Chinese living outside China. It wants the world to accept that criticizing Chinese government behavior is always a violation of China’s sovereignty and, thus, a form of meddling in its domestic affairs. And, gradually, it wants its demands to be normalized on a global scale — for it to be widely known and accepted as an unavoidable reality that any action or activity outside China that the Chinese government strongly opposes will come at a high price — whereas preemptively halting these activities and accommodating the CCP’s demands will reap rewards in the form of company profits or other incentives.

It is popular to blame Zoom, Apple, Google, and LinkedIn for implementing Chinese government repression, or to view them as complicit. But this is a mistake. These companies are simply behaving according to the rule that U.S. society has laid out over the past several decades: maximize profit wherever you can without breaking laws.

But the Chinese Communist Party has learned how to game the old system. Through consistent application of law, coercion, and rewards, it has forcibly changed the market experience to incentivize profit-seeking organizations to do whatever it says. If we continue to place blame at the feet of corporations, rather than examining the political ideas that have put corporations on a moral pedestal, we will simply be perpetuating the vulnerabilities and blind spots that the CCP has learned to exploit. All markets are shaped by government regulations; as any student of economic history knows, maintaining truly free markets requires a strong government hand.

No U.S. company can withstand China’s security state on its own. Only the U.S. government has the ability to defend the rights of U.S. companies and the freedoms of American citizens on U.S. soil and to provide the tools to allow U.S. companies to defend these rights. The U.S. must communicate clearly both to companies and to the Chinese government what is legal and what is illegal under U.S. law — and then impose consistent consequences when those laws are broken.