Chinese police target U.S.-based woman who signed a critical Change.org petition

Change.org says it hasn’t detected any leaks, so how did state security police know a user’s email address?
By Mia Ping-chieh Chen for RFA Mandarin
2023.03.06
Chinese police target U.S.-based woman who signed a critical Change.org petition Chinese state security police appeared to know the email address she had used to sign the petition already, as well as other email addresses she had used, Ning Ning said.
Credit: Reuters photo illustration

Chinese state security police recently targeted a U.S.-based Chinese national after she signed a petition critical of Communist Party leader Xi Jinping on Change.org, raising questions over how they managed to get hold of her personal details, Radio Free Asia has learned.

A U.S.-based Chinese woman who gave only the nickname Ning Ning said she had recently received a late-night phone call from her father back in China, asking her to confirm whether a signature on a Change.org petition was hers.

“The state security police had come visiting, and my dad was repeating the [text on the petition] website back to me, asking me if it was me who signed,” Ning Ning said.

“They knew it was me because I had to fill out some personal details [for the petition],” she said.

Ning Ning’s revelations come as governments around the world scramble to assess the degree to which Beijing has managed to infiltrate and exert influence on foreign soil, particularly through the use of overseas police “service stations,” which have been shut down in a number of locations worldwide in recent months.

Video call from state security

State security police also wanted Ning Ning to provide all of the registration details she gave to Change.org, and to accept a video call from them, so they could see her logging onto the website, she said.

The state security police appeared to know the email address she had used to sign the petition already, as well as other email addresses she had previously used there, Ning Ning said.

“They knew my account details and asked me to share my screen with them, and they also searched for my accounts on other social media,” she said. “They then asked me if the accounts were mine or not, and what sort of things I had posted there.”

ENG_CHN_Change.orgHarassment_03062023.2.jpg
Change.org currently hosts more than 9,000 petitions containing the keyword “China” in English, according to a brief search of the site. Credit: RFA screenshot

Ning said she was being targeted because the petition she signed contained wording critical of ruling Chinese Communist Party leader Xi Jinping, which elevated the matter to “a major national security incident,” according to the state security police she spoke to.

Repeated calls to the local police department in the district where Ning Ning’s family lives rang unanswered during office hours on March 3.

Change.org currently hosts more than 9,000 petitions containing the keyword “China” in English, the majority of which have to do with animal protection issues, according to a brief search of the site.

It is entirely possible to withhold a person's real name on the site, and only have a nickname displayed publicly, raising questions about how Chinese state security police were able to access private information on users of Change.org.

“It’s pretty scary, as if the state security police can see in real time who is logging onto that website with what email address,” Ning Ning said. “How can they know about these email addresses?”

A spokesperson for Change.org, which is blocked by China's Great Firewall of internet censorship, said the company’s cybersecurity team had recently reviewed the data privacy and information security agreements relating to people who sign international petitions and found no signs of leaks or system vulnerabilities.

Former Sina Weibo censor Liu Lipeng said China-based hackers could have targeted Change.org, or police could have somehow gotten their hands on leaked data from the site, however.

“The fact that the Chinese authorities were able to go straight to her family and ask them to get her to take something down tells us clearly that they saw her email address,” Liu said. “The police have already made it totally clear that this was a leak from Change.org.”

“But how did they then link her email to her real name?” he said. “That is still an open question.”

“But the fact that they knew the email address shows that this is definitely something leaked from that website.”

Translated by Luisetta Mudie. Edited by Matt Reed.

POST A COMMENT

Add your comment by filling out the form below in plain text. Comments are approved by a moderator and can be edited in accordance with RFAs Terms of Use. Comments will not appear in real time. RFA is not responsible for the content of the postings. Please, be respectful of others' point of view and stick to the facts.