环门039,升级以免失联 | 环通003 | 私有 | 互通


Telegram channels used to doxx and report Hong Kong protesters to Chinese authorities


Channels are collecting and submitting personally identifiable information of Hong Kong protesters to China’s Ministry of State Security




Sep 26

(资料来源:@karankanishk via 维基共享资源)

(Source: @KaranKanishk via Wikimedia Commons)


A pro-China Telegram channel is identifying Hong Kong’s pro-democracy protesters and rioters with an aim to build a database of them and submitting their information to China’s Ministry of State Security Reporting Platform.


In an environment where anonymity is possible and often desirable, exposing sufficient information to identify a person — or even the threat of it — is a frequent tactic to silence or intimidate the person being exposed. This phenomenon of exposing otherwise anonymous people’s personally identifiable information (PII), “doxxing,” is a darker manifestation of open-source research.


Once a person has been doxxed, they often experience a significant amount of online and, frequently, real-life harassment. Combining the tactic with a referral to a national government — especially one with a reputation for mass surveillance and societal control — for punitive action is an elevation in anti-democratic behavior.


Doxxing is becoming a potent weapon for both sides — pro-democracy and pro-China — of the ongoing protests in Hong Kong.


Doxxing on public channels

抗议者被人肉搜索的主要电报频道之一是「好孩子特輯(逃犯條例)」,或者用英文标注为「Yeeseelostandfound」。当 DFRLab 开始分析时,该频道的名称是「父母搵仔女(逃犯條例)」,并在分析过程中更新了它的名称。

One of the primary Telegram channels through which protesters are doxxed is 好孩子特輯(逃犯條例 (“Good Kids [Fugitive Offenders Ordinance]”) or, alternatively, “Yeeseelostandfound” as it labelled itself in English. When the DFRLab started its analysis, the channel’s name was “父母搵仔女(逃犯條例)” (“Parents and children [Fugitive Offenders Ordinance]”) and updated its name during the course of the analysis.


The administrator for the channel, in particular, appears to play a primary role in its activities. They either crowdsource the work by posting a photo and asking for help in identifying the person or people in the photo, which they request to receive privately (i.e., not in channel). Or they simply post an after-submission notice, putting forth the PII and a photo for somebody they say has been submitted to the Chinese government.

一条消息(上图)要求订阅者举报「引起骚乱」的抗议者 第二条信息(下)来自管理员,证实一名抗议者已经通过报告门户网站向中国国家安全部报告。英文名用红色高亮显示。(资料来源:yeeseelostandfound / archive,top;yeeseelostandfound / archive,bottom)

A message (top) requesting subscribers to report protesters who have “caused riots.” The second message (bottom), from the administrator, confirms that a protester had been reported to China’s Ministry of State Security through its reporting portal. The English name is highlighted in red. (Source: Yeeseelostandfound/archive, top; Yeeseelostandfound/archive, bottom)


The channel also posts information about pro-democracy participants whose pictures have been lifted from private — usually pro-democracy — channels or that have been posted as a part of media reports.

该频道的截图显示,用户使用一名抗议者的社交媒体账户收集了该抗议者的信息。(来源:yeeelostandfound / archive,左;yeeelostandfound / archive right)

Screenshots from the channel indicate that the user collected information of a protester using her social media accounts. (Source: Yeeseelostandfound/archive, left; Yeeseelostandfound/archive right)

该频道还声称,它从 Instagram 和 Facebook 等社交平台上剪下人们的个人身份信息。

The channel also claimed that it scrapes PII of people from social platforms such as Instagram and Facebook.


Facebook pages of protesters matched with their images from the protests. The photos are purposefully obscured. (Source: DFRLab)


As stated in one of the messages, the channel claims that it is building an e-book or a physical book of personal information of protesters.

管理员声明信息将以电子书或实体书的形式出版以纪念这项工作的截图。(来源:yeeselostandfound / archive)

Screenshot of the message where the admin stated that the information would be published in the form of an e-book or physical book to commemorate the work. (Source: Yeeseelostandfound/archive)

但这并不是唯一一个关注抗议者的频道,因为 DFRLab 发现了另一个对抗议者人肉搜索的频道,并给他们贴上了「蟑螂」的标签 反对亲民主抗议活动的人们用这个词来指示抗议者。

But this is not the only channel that keeps an eye on protesters, as the DFRLab discovered another channel that doxxes protesters and labels them as “cockroaches.” People who oppose the pro-democracy protests have adopted the term to refer to protesters.


Screenshots of the Telegram channel, HongKong_nes, stitched together. The red boxes in the images uses the term “cockroach” to refer to the person featured. (Source: HongKong_nes)


This Telegram channel slowly growing and has gained a few thousand followers in the past few days, even though the channel activity has subsided over the past few days.

图表显示该频道再次活跃时订阅用户的增长情况。它最近的一篇人肉搜索文章出现在9月22日。(来源:DFRLab via tgstat. com)

Chart showing the channel’s subscriber growth as it became active again. Its most recent doxing post appeared on September 22. (Source: DFRLab via tgstat.com)


Users have reported these channels to Telegram and expressed their frustrations regarding the doxing attempts by pro-China channels.


Reporting information to China


As claimed by the channel, the members of the channel are expected to share personal information of protesters and report it on China’s Ministry of State Security Reporting Platform.

该网站可以从中国境外连接,但可能需要通过 VPN 重新路由。(来源:12339。新闻网 / 档案馆)

The website can be connected to from outside of China, though it might require re-routing via VPN. (Source: 12339.gov.cn/archive)

网站:12339.gov.cn,是一个报告包括间谍活动在内的国家安全犯罪,以及提交「国家安全行为」其他线索的平台 该网站声称对信息来源保密。在网站上报告事件的同时,一份列表以弹出形式出现,指示应报告什么内容,其中一些内容甚至可能被解释为包括和平示威。

The website, 12339.gov.cn, is a platform for reporting crimes of national security, including espionage, and for submitting other clues on “national security behaviors.” The website claims to keep the source of the information confidential. While reporting an incident on the website, a list appears in pop-up form with instructions on what should be reported, some of which could be interpreted to include even peaceful demonstrations.


In particular, the second criterium in the list states that a person can be submitted for intent to “[o]rganize, plan, or implement the secession of the country and undermine national unity; provoke to disunite the country and undermine the state unity; in collusion with institutions, organizations, or individuals outside the territory to organize, plan, or implement the secession of the country and undermining national unity, to provoke to disunite the country and to undermine the state unity.”

通过门户网站向中国政府提交信息的各种标准,包括国家统一的第二个标准。(来源:12339。新闻网 / 档案馆)

The various criteria for whose information can be submitted to the Chinese government via its web portal, including the second criterium regarding country unity. (Source: 12339.gov.cn/archive)

为中国国家安全报告门户网站收集抗议者信息的言论也出现在几个 Facebook 页面上。

The same rhetoric of gathering information on protesters for China’s national security reporting portal was found on several Facebook pages.

Facebook 页面上也有相同的信息,关于谁应该在中国的国家安全报告平台上进行报道。(资料来源:facebook / the Reality of China,左上;facebook / mjs Rapid Response Group,右上;facebook / salute tohkpolice,下)

Facebook pages carrying the same messages regarding who to report on China’s national security reporting platform. (Source: Facebook/The Reality of China, top left; Facebook/MJS Rapid Response Group, top right; Facebook/SalutetoHKPolice, bottom)


Channels broadcasting information on the Hong Kong police

与此同时,对应的电报频道 DadFindboy 正在对反抗议者的警察进行人肉搜索。这个频道似乎比支持中国的频道实施了更为复杂的人肉搜索政策,因为这个频道汇编的信息量非常详细,包括父亲或母亲的姓名等家庭关系。

Meanwhile, a counterpart Telegram channel called DadFindboy is doxxing police officers who acted against the protesters. The channel seems to implement more sophisticated doxxing than pro-Chinese ones, as the amount of information compiled by this channel is highly detailed, including family relations such as a father or mother’s name.

一名香港警察在电报频道「Dadfindboy」披露了他的警徽号码和身份 DFRLab 已经从图片中删除了个人身份信息。(来源:Dadfindboy)

A Hong Kong police officer was revealed with his badge number and identity in the Telegram channel “Dadfindboy.” The DFRLab has redacted PII from the image. (Source: Dadfindboy)

两张 Dadfindboy 的屏幕截图,人肉搜索了香港警察。DFRLab 已经从图片中删除了个人身份信息。(来源:Dadfindboy 左;Dadfindboy 右)

Two screenshots from Dadfindboy that doxxed Hong Kong police officers. The DFRLab has redacted PII from the image. (Source: Dadfindboy left; Dadfindboy right)




The Hong Kong protests have revealed how Telegram channels could become a significant doxing mechanism. Telegram channels are preferred as they safeguard the privacy of individuals in the channel while they simultaneously carry out these malicious attacks. There have been attempts to report channels like these, but the channels remain active and continue to report information to their subscribers, and to the Chinese authorities.


As of now, it is not clear what the outcomes may be from the information passed to the mainland, but it sets out an important discussion that Chinese national security and the government’s online reporting platform is being misused for forwarding information of Hong Kong nationals who support the pro-democratic movement.


Though there are efforts on both sides of the political spectrum — pro-China and pro-democracy — to doxx protest participants and police officers, respectively, the pro-democracy demonstrators are under greater threat. The balance of power between the Telegram channels greatly favors those that are pro-China, as the outcome of their efforts could potentially lead to intervention by the Chinese state in enforcing punitive actions. This last threat is felt particularly acutely by the protesters, as the protests originally arose because the Hong Kong government put forward a bill that would have allowed for extradition to mainland China of anybody arrested in the territory.


2019-09-30 08:12  c1079018  精选

(2019年9月26日,机译)美国智库大西洋理事会(Atlantic Council)数字取证研究实验室发布的报告显示,几个电报群正在人肉搜索香港示威者,并把他们的个人信息举报给大陆国安。



lixiaoxiao  2020-06-07 21:55  v200615


安卓版 https://x.co/ogatea | 苹果版 https://x.co/odisk | 电脑版 https://x.co/ogatew | 大陆网页版 https://x.co/ogate