Three Smartphone apps with the “Caller ID & Blocking” feature are collecting and integrating users’ phone address books into a publicly available database. Around 3 billion such numbers and identities are accessible, FactWire has discovered.
The database contains the numbers of Hong Kong’s Chief Executive Leung Chun-ying and Chief Secretary for Administration Carrie Lam Cheng Yuet-ngor. Also listed are local and mainland officials, legislators and personalities from the business, politics, media, entertainment sectors, as well as members of the public. Privacy Commissioner for Personal Data Stephen Wong Kai-yi would not comment on whether or not the apps were illegal.
Smartphone apps involved include CM Security, product of US-listed company Cheetah Mobile whose main holding company is Chinese software company Kingsoft Corporation Limited (3888); Truecaller, product of Swedish information technology company True Software Scandinavia AB; and Sync.ME, product of Israeli infotech company Sync.ME.LTD. All three apps are available to download for free in the smartphone app stores of the Android and iOS systems.
The “Reverse Look-up” feature of the three apps allows users to trace the name of the number holder. When a telephone number is input into each app, the app will run a search in the billions of identified numbers in its database to trace the name of the number holder. Each app displays the name even when the holder is not a registered user and has not authorised the app to make his or her personal information available for search.
FactWire downloaded the apps for testing purposes. Using mobile phone numbers held by LegCo members from last session and this session, at least 63 and 68 out of 71 members of the last LegCo session (including lawmaker Alvin Yeung Ngok-kiu who was elected in the New Territories East by-election on 28 February) had their names traced on Truecaller and CM Security respectively; the names of 68 lawmakers were traced with their mobile phone numbers.
For the lawmakers of the current LegCo session (including Sixtus “Baggio” Leung Chung-hang and Yau Wai-ching, who filed a court appeal on 17 November after the High Court ruling on 15 November to disqualify them as lawmakers), 64 and 65 out of 70 members were traceable on Truecaller and CM Security respectively; the names of 67 lawmakers were found in total.
In addition to the “Reverse Look-up” function, the Sync.ME search feature merged the mobile phone numbers with Facebook profiles belonging to lawmakers Raymond Chan Chi-chuen, Junius Ho Kwan-yiu, Eunice Yung Hoi-yan and Tanya Chan Suk-chong. Some information is locked and users need to pay to gain access. Charles Mok, lawmaker representing the Information Technology functional constituency, has his mobile phone number merged with his Facebook, Google and LinkedIn profiles.
Mobile phone search results of the Truecaller and CM Security combined together show the names of government officials including Chief Executive Leung Chun-ying, Chief Secretary for Administration Carrie Lam Cheng Yuet-ngor, former Secretary for Security Ambrose Lee Siu-kwong, former Police Commissioner Tang King-shing, Director of Broadcasting Leung Ka-wing, Executive Council member Anna Wu Hung-yuk, Aide-de-Camp of Chief Executive’s Office Lau Chi-tong and Information Coordinator Andrew Fung Wai-kwong.
Businesspeople including founder of Centaline Property Group Shih Wing-ching, SJM Holdings Limited (0880) Deputada Angela Leong On-kei, Convoy Financial Group (1019) Group CEO Daniel Chong Wai-chung and New World Development Company Limited Executive Director Leonie Ki Man-fung all have their mobile phone numbers stored in the app. Media industry executives such as Chief Editor of Apple Daily Chan Pui-man, Chief Marketing Officer of Next Mobile Limited Vincent Tsui Chun-man, known as Tsui Yuen, and now TV Executive Vice-President of News and Business Information Cheung Chi-kong are found as well. Showbusiness celebrities such as Alfred Cheung Kin-ting, Lin Xi, Elizabeth Wang Ming-chun, and Natalis Chan Pak-cheung, are also listed.
The names in the database are not in any fixed format, suggesting that they have been gleaned from users’ phone address books. Lawmakers Leung Kwok-hung and Raymond Chan Chi-chuen were listed as “Longhair” and “Slow Beat” respectively, while artist Natalis Chan Pak-cheung was “Brother Nat”. Some contacts are stored with their titles. The office telephone number of the Chief Executive was stored as “Chief Executive”; whereas Dai Da-jiang, Commissioner of the Economic Affairs Department of the Liaison Office of the Central People’s Government in the Hong Kong SAR, was recorded in simplified Chinese.
The “Reverse Look-up” feature of CM Security is only available for local use, yet the feature is not restricted for local use for Truecaller and Sync.ME. Emeritus vice-chancellor of Oxford University Sir Colin Renshaw Lucas, former President of Fudan University Wang Sheng-hong and Cai Chi-meng, researcher at the Chinese Association of Hong Kong and Macao Studies are in the Truecaller database.
Truecaller has a database of over 3 billion telephone numbers, while Sync.ME has collected information of over one billion contacts and their social network profiles including Google, Facebook and LinkedIn. CM Security collects users’ phone address books through WhatsCall, another app developed by Cheetah Mobile. CM Security has hundreds of millions of identified numbers in its database.
Sync.ME CEO and co-founder Ken Vinner told FactWire that the app’s data is “a collection of publicly available phone data, data from third party companies and crowdsourced user data”. Its terms of service also requires that users have gained their contacts’ consent before sharing their personal information with Sync.ME.
Choy Ki: Users may have violated Principle 3 of the Personal Data (Privacy Ordinance)
According to the Six Data Protection Principles of the Personal Data (Privacy) Ordinance, Principle 3 (use of personal data) states that personal data must be used for the purpose for which the data is collected or for a directly related purpose, unless voluntary and explicit consent with a new purpose is obtained from the data subject.
Legal consultant Craig Choy Ki said that WhatsCall, Truecaller and Sync.ME did state the purpose for collection in their privacy policies. However, if users of these smartphone apps (data user) share information of their friends (data subject) with these companies into the databases without their consent, this differs from the original purpose of collecting telephone numbers for contact use, and thus qualifies as a new purpose. Choy stated that “this may have violated Principle 3 although citizens may not have intended to act against the law”.
Citizens could request to remove personal information
Choy reminded users that Truecaller was under the data protection rules of the European Union and Sweden. If users found that their personal information was on the Truecaller database without their consent, they had the right to ask the company to delete it, he said.
Truecaller and Sync.ME allow users to delist their numbers and opt-out of making contact information available for search in the databases. The companies claim they will process such requests within 24 hours. FactWire asked Cheetah Mobile to provide information on their procedures for removing personal information. They replied that the company is “currently in the silent period before the earnings release” and declined responding at the moment.
FactWire consulted the Office of the Privacy Commissioner for Personal Data (PCPD) on the legitimacy of the “Reverse Look-up” feature and the collection of users’ phone address books in apps. Privacy Commissioner for Personal Data Stephen Wong Kai-yi said that if there was sufficient reason to believe that the app operations violated the Personal Data (Privacy) Ordinance, the PCPD could begin an investigation.
FactWire asked Kingsoft, Cheetah Mobile, Truecaller and Sync.ME about the location of their servers and whether the companies provided personal data to the Government upon request from law enforcement organisations.
Sync.ME told FactWire that its server was located in the United States. The company did not provide users’ personal data to the Government and law enforcement organisations, it said.
CM Security and WhatsCall were developed by Cheetah Mobile (NYSE:CMCM), listed company at the New York Stock Exchange, in which Hong Kong-listed company Kingsoft Corporation Limited (3888) holds a 47% stake. In the first half of 2016, Cheetah Mobile generated 1.598 billion yuan from mobile phone businesses, 74% of total revenue, while Kingsoft generated 2 billion yuan from Cheetah Mobile. WhatsCall has recorded over 10 million downloads, 1 million users worldwide and a collection of hundreds of millions of telephone numbers since its launch in December 2015.
Lei Jun, Kingsoft and Cheetah Mobile’s Chairman of Board of Directors, is also a co-founder of Chinese electronics company Xiaomi. The Xiaomi Security Centre app, currently default on Xiaomi smartphones and also provided by Cheetah Mobile, is equipped with virus-scanning, virus protection and “Caller ID & Blocking” features. In late August, Truecaller announced a deal with Chinese company Huawei. They will be preloaded with the new Truecaller app starting with the Honor 8 Android smartphone model. The additional feature will be available to customers on Huawei mobile phones in America, the Middle East, North Africa, Southeast Asia and India by the end of September 2016.