Despite the Risks: Guest Post from Tibetan Action Institute
Blog Post
Aug. 5, 2013
The increased connectivity afforded by the spread of cheaper smartphones and 3G networks has also enabled governments to conduct greater digital surveillance. For targeted communities, communicating insecurely can be extremely risky. In this blog post, the second in our series on community technology, Lobsang Gyatso Sither of Tibet Action Institute talks about the problematic adoption of WeChat. This easy-to-use Chinese application has become wildly popular despite the risk of Chinese surveillance. Gyatso Sither participated in the Open Technology Institute’s first international Commotion Wireless workshop in June, with over a dozen community technologists from across India and Nepal.
Lobsang Gyatso Sither of Tibet Action Institute installing a router on a rooftop during the Commotion Workshop in Dharamshala, India, June 2013.
When I look back at this past year, I think about the rise of the usage of smartphones and the impact it has on the day to day life of Tibetans. The availability of 3G networks allows almost every Tibetan to connect to the Internet via their phone. However, with this rise comes the risk associated with being online constantly. Previously, when we were using our laptops, we were not connected to the Internet all the time, keeping us free from surveillance at times. Ironically, by increasing our access to the communications methods of the Internet, we have increased the opportunities for surveillance of our communications.
The availability of “all-powerful” apps like WeChat has changed the way we communicate. Most Tibetans online use WeChat as it serves as a means to communicate with Tibetans both outside and inside Tibet. It also serves as a discussion forum -- be it entertainment or politics. It has become the norm for Tibetans inside Tibet to share all kinds of information -- including sensitive information -- via WeChat. Looking at this app from a communications point of view, it has helped Tibetans to connect and communicate with ease.
However, let’s look at the security of WeChat. First and foremost, all its data are stored in servers in China and as such are under the purview of the Chinese government. Secondly, it doesn't provide traffic-level encryption and sends all traffic as clear text. The number of permissions we give WeChat allows it almost unrestricted access to all information on our phone, which has resulted in a number of arrests inside Tibet and even some prosecutions for information shared over WeChat.
Does this mean that we don't have alternatives? The answer is that we do. There are a number of apps including Gibberbot, Chatsecure, Redphone, Ostel, and Yakchat, which not only provide traffic-level encryption but also support end-to-end encryption. So the question arises, even after knowing all the security issues, why is there a lack of adoption of secure apps? This is not something that is only seen in the Tibetan community, but the risks faced by Tibetans are much greater than for others.
In our community, Tibetans inside Tibet -- due to lack of knowledge of other options -- started using WeChat as a means to communicate, which in turn resulted in the adoption of WeChat as the default communication tool for most Tibetans in Exile as well. Is this adoption a lack of knowledge in terms of understanding the security risks associated with it by the Tibetans in Exile? Based on my experience, the answer unfortunately is “No.”
Even with the knowledge of the risks, many Tibetans in Exile are still using WeChat. There are a few reasons for this. One is that since their contacts inside Tibet are still using it, this is sometimes their only means of communication. In trainings that I conduct, people say it is hard to explain and understand the security issues, so they take the easy way out, and keep using WeChat. Second, because of the steeper learning curve of more secure tools, and the extra attention to these tools form authorities, there is a greater risk posed if users do not use the tools correctly. For example, trying to use OTR without understanding it fully could result in harm if it is not setup properly and the user communicates sensitive information. Additionally, some Tibetans in Exile say that they don't have contacts inside Tibet, so they have no risk -- often not understanding that they are connected to others who might have such contacts.
Secure apps will always have a steeper slope of adoption whether due to challenges of usability or the lack of features. However, in my experience, I believe that it is not a matter of using the most secure apps, but finding a middle ground in communication which may not be 100% secure, but also is not 100% open to surveillance.
Tibetans may continue to use WeChat, but after understanding the risks involved, many are gradually taking various precautions when using it -- whether it is the use of the voice-only feature, speaking in codes, or having a totally separate phone for their WeChat accounts. This is an important step in the right direction -- this compromise both allows communication and improves security.
This may not be the ideal solution, but if you can’t communicate what is the point of having so much access? Next steps would be increasing user knowledge in terms of best practices while communicating and understanding risks. With this knowledge, Tibetans can reduce the risks of using a tool like WeChat. At least, through communication, more information can be shared and at a certain point, we can change the habits of various users and hopefully increase use of more secure forms of communication.