Source: Wired

It’s Tuesday, April 9, 2019. Wearing a lime-green jacket, the activist Rushan Abbas stands out from a crowd of grey and black suits as she gives testimony before the US Senate. As Abbas, 50, reads aloud from a printout of her speech, only the volume and a slight shudder in her voice convey her anger.

Over her six minutes before the committee, Abbas excoriates China for its treatment of its Uighur Muslim minority. She cites reports from the country’s western Xinjiang region, detailing an extensive network of “re-education” camps, where it’s suspected one million people are currently detained. In August 2018 a United Nations representative accused Beijing of treating its Uighur minority as “enemies of the state” on ethnic and religious grounds.

For Abbas, this is personal: her older sister, Gulshan, is among the detainees. “What the Chinese government is doing is evil – a crime against humanity,” she says to the room.

Two days later, Abbas is at Washington airport, waiting for a flight. Between her full-time job and her activism, she hasn’t had a moment to check her website, CampaignForUyghurs.org, until now. She opens it on her iPhone. The page loads slower than usual. When it does, the site is a jumble of images, videos and adverts. It’s been hacked.

“The website was completely destroyed,” Abbas says. She would later learn the site was infected with malware 24 hours after her Senate testimony. All its files were deleted and it would take a month to get back online. To Abbas, this was digital retribution for speaking out on the Uighur crisis. She has one suspect: the Chinese government. “Beijing is extending its oppression with its black tentacles to the Uighur living abroad,” she says.

As China’s treatment of Uighur gains global attention, Uighur activists living abroad are experiencing an escalation in digital attacks. In May 2019, when the Germany-based World Uighur Congress partook in a human rights conference in Washington, DC, its team tallied 1,255 attacks on its website.

“China uses a variety of tools to go after its enemies online, from organised harassment campaigns, to massive DDoS attacks and sophisticated – and less sophisticated – phishing and hacking,” says James Griffiths, author of The Great Firewall of China. “The Tibetan and Uighur diasporas have reported being constantly targeted by hackers, with even non-political members of the community having their email and other accounts hacked so they can be used to go after more sensitive targets.”

Social media has inevitably become a battleground, where activists are harassed by trolls and bots. Activist Tahir Imin started receiving abuse on Facebook after he set up The Uighur Times, a website detailing human rights abuses in Xinjiang. Empty Facebook profiles commented on his posts, saying he did not spend enough time with his late father; that he does not love his young child or his wife, who are still in China; that he is a drunkard and a bad Muslim. “They want to upset me, to distract my attention, to make me think Uighur hate me, to make me give up on fighting for my people,” he says.

As the trolls appeared to know intimate details about his father, for example, Imin believes they were backed by the Chinese government. Of course, that’s hard to verify. “It’s unclear how much these are encouraged by officials and how much they are simply nationalist trolls acting alone,” says Griffiths.

A 2017 study out of Indiana University Bloomington linked Chinese trolls hounding Taiwanese politicians on Facebook to a troll army called Diba. “Diba, a sort of Chinese 4Chan, has become notorious in recent years for ‘expeditions’ across the Great Firewall to target Beijing’s critics overseas,” Griffiths says. “Diba posters essentially spam their targets into submission.”

For Greg Fay of the Uighur Human Rights Project (UHRP), China’s attacks are becoming more personal. “When I started working here in 2012, it was common for organisations to be targeted, but now individuals are targeted too,” he says.

Sometimes, Uighur exiles receive threats via their family members still living in China. Adil Çinar, who lives in the Netherlands, was contacted by his parents on WeChat in January. The message said the police had visited them in their Xinjiang home, saying they would be spared arrest if they persuaded Adil to write an article defaming a Uighur rights activist Dolkun Isa. Adil told his parents he couldn’t lie about Dolkun, who was a childhood friend. “I will not be afraid of the Chinese government anymore, even if they threaten to harm my parents,” he says.

Something similar happened to Alim (not his real name), who also works for the World Uighur Congress. In June, his brother – who is detained in a re-education camp – contacted him on WeChat, asking him to cooperate with the Chinese authorities. Alim deleted WeChat from his phone: he can’t tell whether the message was actually from his brother, or from authorities impersonating him, but it was hard to read. “My two brothers and my sister are in the camp. I feel like, if I didn’t work for the Uighur Congress, maybe they would be released. It’s a very difficult feeling,” he says.

Staff at small, under-resourced human rights organisations are often grateful for any expert assistance keeping them secure online. The UHRP has received free support from Project Shield, an anti-DDoS service, offered by Alphabet subsidiary Jigsaw to human rights websites.

The organisation is also regularly approached by firms and researchers offering their services pro-bono – but it is generally wary of cyber-researchers asking for sensitive details, such as their emails. “The Chinese government is constantly looking for new ways to get information from Uighur diaspora. When we are approached by cyber security experts, we don’t always know what their motives are,” Fay says. Those suspicions have led to a laborious vetting process for anyone they wanted to work with – calling references and trying to get a sense of the person or firm’s reputation.

Access Now is one of the few non-profits that has a dedicated team providing activists with tailored help via its Digital Security Helpline. Access Now lawyer Peter Micek, says this service usually handles around 150 requests each month from at-risk individuals and organisations who are trying to protect themselves from state-sponsored attacks.

Micek won’t go into details about the helpline, saying that adversaries out there are looking for any opportunity to attack. “It often only takes a few data points for an entity to be able to identify and even locate the helpline constituents,” he says.

“There are strategies and tools that you can implement to stay safe, so we put helpline clients in touch with a technologist who can understand their specific context,” Micek says. “Depending on their needs, we can get them to encrypt their communications – start messaging through apps like Signal or emailing through overlays of encryption, like with PGP.”

“[Civil society is] not receiving adequate support from governments and companies in the form of laws and regulations, funding, and policies that account for marginalised and vulnerable communities online,” he adds.

Tactics differ, but state-sponsored digital threats have the same aim: sowing doubt in an activist’s mind and making them ask whether their activism is worth the risk. For Rushan Abbas, there is no question. “When I saw the attack on my website, I knew my messaging is right,” she says. “I shall continue.”