American 2018 Olympic silver medalist Chris Mazdzer is worried about being hacked as he heads into the Beijing Winter Olympics next month. Like everyone there, he's required to use China's My 2022 health-monitoring app despite fears about encryption problems.
"It's very possible there's apps on my phone where I'm sure there's ways to hack in there," the luger told VOA. "I feel that I have nothing to hide or worry about on my phone, so I'm kind of blissfully going into this kind of just like, 'All right, I have to download this in order to compete.'"
My 2022 uses voice audio and file transfer encryption that "can be trivially sidestepped," according to the University of Toronto's Citizen Lab website. Encryption normally protects data, such as passwords, sent in transit and can prevent outsiders from hacking into an account holder's data.
As host of the February 4-20 Winter Games, Beijing expects about 2,800 athletes plus their delegations and a small group of spectators to converge in a COVID-19-free Olympic bubble.
The app collects sensitive medical information, but it's not clear who can see it, according to The Citizen Lab, which studies internet security. Health customs forms, which include passport details, demographic data, and medical and travel history, are also vulnerable. Server responses can also be "spoofed" — or appear to be from a known, trusted source — the lab adds, allowing an attacker to display fake instructions to users.
My 2022 also includes a censorship keyword list that targets politically sensitive topics such as Xinjiang and Tibet, the lab found.
Scholars and activists who follow China say it's hard to confirm whether the app will be used in any coordinated collection of private data. The International Olympic Committee, however, has told some media outlets that the app is free of "critical vulnerabilities."
Data collection, political views
Some experts wonder whether Beijing has an unspoken motive for using the app, especially as China prizes the use of artificial intelligence, or AI, a technology that includes facial recognition and works best with massive reserves of data.
"Data now are very important, and particularly for China. China is racing the AI race, and in the AI race, data are like the oil of the 21st century, and if you get a lot of data, you are ahead of your opponent, so, of course, China needs data," said Alexander Vuving, professor at the Daniel K. Inouye Asia-Pacific Center for Security Studies, in Hawaii.
International attendees must download the app before leaving for China and submit their health status reports every day — part of the Chinese government's plan for a zero-COVID Olympics.
Ma Rui, founder of the San Francisco-based consultancy Tech Buzz China, called The Citizen Lab's findings of app programming "reasonable." She said My 2022, as described by the lab, has "vulnerabilities commonly found in Chinese apps."
Chinese leaders could use the app to squelch any political discussion that goes against their views, some analysts say, though Sino-Western tensions have cooled under U.S. President Joe Biden.
"It's not like during the Trump administration, where the height of distrust was so high anything could be misinterpreted," said Eduardo Araral, associate professor at the National University of Singapore's public policy school.
Common practice?
China already uses people's devices inside the country to check for anything politically sensitive, said Pema Doma, campaigns director at Students for a Free Tibet, an advocacy group in the United States. Chinese leaders frown on discussion about whether the southwestern region of Tibet should be independent, per the hopes of some Tibetans.
China's practice leaves people feeling "a big vulnerability" as they use their phones, Doma said.
"Inside Tibet, the monitoring of phones and tracking app usage have actually even been used to persecute Tibetans that communicate or read certain teachings leaders or send money to family in certain countries," she said.
'You have to download the app'
But Mazdzer is writing off the app as a necessity to get into the Games.
"The truth is, like, my goal is to get to Beijing and to compete, and I know that I'm going to have to do certain things in order to get there," Mazdzer said.
My 2022 is designed to keep Games-related personnel "safe within the closed loop environment," the IOC says. The app itself can be downloaded by anyone. Its free cartoon-enhanced content includes a weather portal and introductions to the sports that form this year's Winter Games.
Carolyn Presutti contributed to this report.
