Updated on Sept. 19 at 10:23 a.m. ET

The popular Chinese messaging app WeChat is Zhou Fengsuo's most reliable communication link to China.

That's because he hasn't been back in over two decades. Zhou, a human rights activist, had been a university student in 1989, when the pro-democracy protests broke out in Beijing's Tiananmen Square. After a year in jail and another in political reeducation, he moved to the United States in 1995.

But WeChat often malfunctions. Zhou began noticing in January that his chat groups could not read his messages. "I realized this because I was expecting some feedback [on a post] but there was no feedback," Zhou tells NPR from his home in New Jersey.

Chinese cyberspace is one of the most surveilled and censored in the world. That includes WeChat. Owned by Tencent, one of China's biggest companies, the chat-meets-payment app has more than 1 billion monthly users in China and now serves users outside the country, too, although it does not divulge how many. Researchers say its use abroad has extended the global reach of China's surveillance and censorship methods.

As Chinese technology companies expand their footprint outside China, they are also sweeping up vast amounts of data from foreign users. Every day, millions of WeChat conversations held inside and outside China are flagged, collected and stored in a database connected to public security agencies in China, say cyber researchers.

"The intention of keeping people safe by building these systems goes out the window the moment you don't secure them at all," says Victor Gevers, the Dutch co-founder of the nonprofit GDI Foundation, an open-source data security collective.

Zhou is not the only one experiencing recent issues. NPR spoke to three other U.S. citizens who have been blocked from sending messages in WeChat groups or had their accounts frozen earlier this year, despite registering with U.S. phone numbers.

"It doesn't matter where the user is, as long as I send a message to more than three people, my message cannot be seen in any group," says Stephen, a Chinese American technology professional. He declined to share his full name because he fears his criticism could draw retaliation against himself or his family by the authorities in China, where he travels often and where most of his family lives.

Stephen is baffled that he was blocked. He doesn't consider himself political. "It isn't shocking that China has that kind of censorship," he says. "The shocking piece is that China is exporting that kind of censorship to other parts of the world."

According to the Citizen Lab, an Internet watchdog group at the University of Toronto, WeChat's parent company Tencent created an extraordinarily advanced censorship algorithm to automatically identify combinations of keywords in messages and online articles that it then blocks. The censorship occurs whenever a Chinese-registered WeChat account receives or sends a message with flagged phrases.

"Using this sort of technique, Tencent has the ability to more precisely target content," says Jeffrey Knockel, a postdoctoral fellow at the Citizen Lab.

Since 2013, Citizen Lab has been monitoring how WeChat filters keywords and found it often updates which words are flagged in response to current events.

"We suspect that humans have some control over adding things to the list [of filtered keywords], but it's an open question whether these automated methods can add by themselves to the list," Knockel says.

From 3.784.309.399 messages, 3.698.798.784 were written in Chinese.

59.378.236 in English and 26.132.379 in another language. 98% of the Chinese messages had a GPS location in China. 68% of the English messages were sent in China. More than 19 million were sent from outside 🇨🇳 pic.twitter.com/Va8Lfk3dnw — 0xDUDE (@0xDUDE) April 22, 2019

The Dutch researcher Gevers has studied Chinese social platforms as well and has exposed a large number of online vulnerabilities in their networks.

This March, Gevers found a Chinese database storing more than 1 billion WeChat conversations, including more than 3.7 billion messages, and tweeted out his findings. Each message had been tagged with a GPS location, and many included users' national identification numbers. Most of the messages were sent inside China, but more than 19 million of them had been sent from people outside the country, mostly from the U.S., Taiwan, South Korea and Australia.

He says the system resembles the global surveillance methods used by the U.S. National Security Agency.

For decades, the U.S. had unparalleled capabilities to monitor Internet traffic passing through servers within its borders. But Chinese tech companies like Tencent are now global, meaning this dragnet is believed to be sweeping up information about users from outside China.

"I think that really raises serious questions and challenges for users but also for regulators outside China," says Sarah Cook, a senior research analyst at Freedom House, an independent democracy watchdog.

Estimates of total WeChat accounts outside China are hard to come by, and the number is believed to be low — possibly in the tens of thousands — in the U.S. compared with popular networks like Facebook and its Messenger and WhatsApp platforms.

Cook points out that WeChat is used internationally not just by traveling Chinese citizens, but also by politicians in democracies communicating with Chinese constituents and dissident communities. "They're communicating with somebody else who's outside of China who has WeChat, but they're still for the most part often operating under the rules that are inside China," she says.

For some, the censorship came in stages. For example, a user could be temporarily blocked, as though to encourage better behavior. Sometimes a cat-and-mouse ensues between the censors and users.

Last February, David, a Chinese American doctor who does not want to use his last name for fear of backlash against his relatives still living in China, noticed his posts on WeChat's Moments — akin to a Facebook news feed — were not going through. Undeterred, he kept sharing politically charged articles.

Within days, he couldn't send messages to any group chat: "Although I was able to read the other people's messages, when I posted my message, nobody could see it. It was like I wasn't there," he says.

David then dialed back his sharing of news articles, limiting his conversations to trivial chitchat and music-sharing. His group chat function was quickly restored. Emboldened, he began sharing his political posts in group chats, only to find himself blocked again.

"Now I am very careful [on WeChat]. I feel like this censorship has affected both my psychology and my behavior," says David. He says he has abandoned his old account and created a new WeChat account to talk to loved ones in China. He lost thousands of contacts in the process. "This is just my main connection to my Chinese friends inside and outside of China."

Tencent, WeChat's owner headquartered in the southeastern city of Shenzhen, declined to comment.

Whether China's government can compel companies to hand over data access is a key question facing the country's major technology companies as they seek a larger share of world markets. For instance, telecommunications giant Huawei is trying to build a mobile network upgrade, known as 5G, around the world and says it would refuse Chinese government requests for data access. But legal experts say national security trumps privacy in China, even if companies put up a fight. U.S. officials allege that Huawei is controlled by the Chinese government, something the company and China's government have repeatedly denied.

"It's a bit of a red herring I think to argue about what the law says or does not say," says Donald Clarke, a George Washington University professor who specializes in Chinese law. Despite economic reforms, Clarke says, "China is essentially a Leninist state in which the government does not recognize any limits on its power."

Back in New Jersey, the activist Zhou says he will continue using WeChat in spite of its vulnerabilities. His work depends too much on it.

"I have to use it to communicate. I just have to know what's going on [in China]. But it is very dangerous," he concedes. "It's a natural choice. We have to use WeChat even though I know it's under surveillance all the time."

Editor's note: An earlier version of this article said Victor Gevers found certain word patterns on WeChat that were flagged and archived. NPR has learned that his analysis used a set of keywords created previously by the Citizen Lab at the University of Toronto. We have amended the story to report on the original research the Citizen Lab conducted.



Copyright 2019 NPR. To see more, visit https://www.npr.org.

ARI SHAPIRO, HOST:

Who is spying on us, and how? We're trying to answer those questions in this month's All Tech Considered.

(SOUNDBITE OF ULRICH SCHNAUSS' "NOTHING HAPPENS IN JUNE")

SHAPIRO: It's well known that China screens its citizens' social media accounts and personal messages. Now people outside China say the same thing is happening to them. NPR's Emily Feng reports.

EMILY FENG, BYLINE: Activist Zhou Fengsuo was a student leader in the 1989 pro-democracy protests in Beijing's Tiananmen Square. When the protests were crushed, Zhou went to prison, then political reeducation, before moving to the U.S. in 1995. Today, he lives in a quiet Puerto Rican New Jersey neighborhood, and China's most popular social media app, WeChat, is his main link back to China. He's in constant communication with hundreds of people in China, advocating for political prisoners.

ZHOU FENGSUO: I have so many groups. It's probably less than a hundred but more than 50.

FENG: But in January, he noticed something strange. People weren't responding to his WeChat messages.

ZHOU: I probably realized because I was expecting some feedback and there was no feedback.

FENG: It was then he realized his messages were being censored so no one ever saw them. China routinely uses WeChat to censor Chinese Internet users, but now people outside China are also getting caught up. Dutch cyber researcher Victor Gevers thinks he knows why. He scans the Internet for vulnerabilities, and sometimes he finds odd things, shocking things, like a Chinese database containing 3.7 billion WeChat conversations collected on a single day. Some 19 million of the messages were sent by people outside of China. Some messages then were censored. Other bits of the database made Gevers wonder exactly what was going on.

VICTOR GEVERS: Why are there persons identified there with their ID number? Why is this database being built like that? Why are these messages being flagged?

FENG: Here's how it worked. Gevers told me anyone using WeChat to send sensitive phrases would have their entire conversation scraped into this public security database no matter where they were in the world - phrases like Tiananmen, Xi Jinping. If the user is in China, the database automatically alerts the nearest Chinese police station. Tencent, WeChat's owner, declined to comment. And the database was completely unprotected, meaning anyone online could change its contents.

Gevers is still trying to figure out why WeChat archived these specific messages.

GEVERS: Who builds a mass surveillance system that is open to the Internet and you can enter without any username or password and change the data? That's horrible.

FENG: For years, cybersecurity outfit Citizen Lab at the University of Toronto has tracked how WeChat uses keyword algorithms to automatically identify sensitive phrases the app then censors. Here's Jeffrey Knockel, a postdoctoral fellow at the lab.

JEFFREY KNOCKEL: Chat filtering on WeChat applies to anyone who has created a WeChat account using a mainland Chinese phone number. This means that even if you move to another country and switch your WeChat account's phone number to that of that country, the censorship will still apply to you.

FENG: But Chinese tech companies like Tencent, WeChat's owners, now have millions of international users, expanding who China can surveil. Sarah Cook is an analyst at nonprofit Freedom House. She points out WeChat is used abroad not just by Chinese tourists but also politicians in democracies communicating with Chinese constituents and dissidents.

SARAH COOK: Maybe they're communicating with somebody else who's outside of China who has reached out, but they're still, for the most part, operating under the rules that are inside China.

FENG: And those rules are leaving American WeChat users confused and scared about why they were blocked.

DAVID: Although I was able to read the other people's messages, when I posted my message and nobody can see it - like I'm not there.

FENG: That's David, a doctor who has lived in the U.S. for almost three decades. He doesn't want to use his full name because his family still lives in China. Like Zhou Fengsuo, his WeChat group messaging was blocked as well, then reinstated when, he says, he stopped sharing political articles. He self-censors now.

DAVID: This censorship has just affected me psychologically and my behavior - both.

FENG: Back in New Jersey, the activist Zhou Fengsuo is not giving up on WeChat. He says his activist work depends too much on the app.

ZHOU: I have to use it. I just have to know what's going on.

FENG: Even if, he adds, doing so can be very dangerous.

Emily Feng, NPR News, Beijing.

(SOUNDBITE OF MUSIC) Transcript provided by NPR, Copyright NPR.