Updated story at 1:40 pm EDT, July 19, 2023
A doxxing campaign that released the photos, full names and personal contact details of people who allegedly took part in Hong Kong's 2019 protest movement likely originated in China, new research has found.
The campaign took off around the height of the protests, in August 2019, and used websites and social media accounts branded "HKLEAKS" to exposed protesters, journalists and other people thought to be allied with the protests, according to a new report from The Citizen Lab at the University of Toronto.
It cited "several peculiar features of this operation, from the dodgy Russian-based hosting of its web domains, to the synergy with Chinese state media, to the suspicious sourcing of the data used for the doxxing.”
It concluded that Chinese government involvement was likely, despite claims that the doxxing – publicizing private information on the internet, usually with malicious intent – was being carried out by concerned "volunteers" fed up with the protesters.
"The majority of the evidence that we have identified is consistent with the hypothesis of a state-backed influence operation," said the report, titled "Beautiful Bauhinia."
Around 2,000 people were doxxed by the websites, which later also included pro-Beijing political news and commentary, the report said.
"The similarities in layout and language between HKLEAKS and the anonymous bounty campaign HongKongMob, which in turn closely resembled the example overtly set by the Hong Kong-based 803 Fund, could indicate an HK-based (artificial) campaign," it said in a reference to two other pro-China, anti-protest campaigns.
While sympathetic volunteers may have played a role, some of the information posted online was only available to the governments of either Hong Kong or mainland China, the report concluded.
‘Doxxing cards’
The websites and social media accounts posted distinctive, downloadable "doxxing cards" that prominently displayed people's photos, names, dates of birth, home addresses, social media profiles, phone numbers and other sensitive information, according to snapshots of the sites still visible on the Wayback Machine, or Internet Archive.
"As the website quickly went down – to date the cause remains unclear – it was immediately replaced with a stream of new websites hosted on domains that all used the same ‘hkleaks’ naming convention," the report said, adding that some of the source code for the sites contained pinyin spellings of Chinese words of a kind typically used in mainland China.
It said the HKLEAKS campaign was "designed to avoid attribution," using several identical websites registered in different locations around the world, all created around the same time, and lasted around two years from August 2019 to May 2021.
It said the Hong Kong government had issued a takedown request, but then said it couldn't enforce it due to the different locations of the offending websites.
"The Hong Kong authorities could claim that their hands were tied with regards to the privacy violations HKLEAKS was clearly engaging in," the report said.
While the city passed anti-doxxing legislation in 2022, the amended law sought to protect police and other public servants from doxxing by protesters, not the other way around.
‘Never bow to the cockroaches’
While thousands of protesters have been prosecuted on public order or "rioting" charges, police have largely avoided any accountability for their role in the violence, largely because they took measures to hide their identities when engaging in violent suppression of the protests, the report said.
"Starting in June 2019, police officers stopped wearing warrant cards on their uniforms and refused to produce them when requested, making it impossible to identify them individually," it said. "Some also began hiding their faces by applying a one-way-mirror privacy film to their helmets’ visors."
Some 1,400 complaints against police officers had been filed by December 2019, but none have been formally prosecuted, amid widespread criticism that the official complaints process is skewed against any real accountability.
The report added: "It is in this context that some protesters resorted to doxxing police officers."
A "solemn statement" on the original HKLeaks site claimed it was run by volunteers who only wanted the best for Hong Kong.
"We will never bow to the rioters and the cockroaches," it says, using a police slur for the protesters.
‘Label for life’
Former 2019 protester Fu Tong, who now lives in the democratic island of Taiwan, said his details had appeared on the HKLEAKS site.
"It was really stressful, having all of my personal details made public," Fu said. "I moved house several times as a result, and I had to rent an apartment anonymously."
"There was the possibility of being arrested by police and jailed, but also that thugs would attack me," he said.
Fu said some of his potential clients have refused to give him work after researching him online and seeing him described as a "rioter" on one of the sites.
"I have that label for life now," he said. "It did serious damage to my reputation."
Former pro-democracy lawmaker Ted Hui said he was doxxed by HKLEAKS too.
"I've been paying close attention to these websites since 2019," Hui said. "There's no way they could get that level of detailed personal information from the public domain."
"I've always thought there was government backing for this," he said. "The Chinese Communist Party ... employs a great many hackers."
Jaw-Nian Huang, an assistant professor at Taiwan's National Chengchi University's National Development Institute, who studies China's psychological warfare operations, said the HKLEAKS campaign bore the hallmarks of Chinese government involvement.
"It's pretty obvious that the Chinese government has the role of disseminator in an information and communications operation -- this is a typical sharp power tactic," Huang said.
"The personal information of some protesters has been exposed ... misinterpreted and labeled in an attempt to manipulate information and influence people's ... perception of dissidents or supporters of protest movements," he said.
"It seeks to weaken the legitimacy of such movements, while enhancing and consolidating the legitimacy of the Chinese Communist Party regime," Huang said, describing the HKLEAKS campaign as a form of " information warfare."
Translated by Luisetta Mudie. Edited by Malcolm Foster.
Updated to correct to The Citizen Lab instead of CitizenLab.