Article Details

Do you trust Xi with your 'private' browsing data? Apple, Google stores still offer China-based VPNs, report says. Some trace back to an outfit under US export controls for alleged PLA links. Both Apple's and Google's online stores offer free virtual private network (VPN) apps owned by Chinese companies, according to researchers at the Tech Transparency Project, and they don't make this fact readily known to people downloading the apps. Neither company requires all app developers in their respective stores to explicitly state where they are based, so forcing only VPN-makers to do so would provoke a lot of blowback. However, that's a big problem for users of these VPNs, as it means the Chinese government could theoretically access communications flowing through them. Chinese law can force any China-based company to assist national intelligence agencies and share customer data with Beijing.  In April, TTP published its initial VPN report that found 20 of last year's top 100 free VPNs in the US Apple App Store showed evidence of Chinese ownership. Five of these had ties to Qihoo 360, a Chinese cybersecurity firm that has been placed on the US Commerce Department's Entity List under export-control restrictions over concerns about its alleged links to China's People's Liberation Army. Of the five, three were eventually pulled, but two (Turbo VPN and VPN Proxy Master) remained available in the US Apple App Store as of early May, according to TTP's second report, published this week. It identified 11 other Chinese-owned VPN apps as well. This new report also looked at Google Play Store's VPNs, and found that it offered four Qihoo 360-connected apps (Turbo VPN, VPN Proxy Master, Snap VPN, and Signal Secure VPN) plus seven other Chinese-owned VPNs listed in TTP's earlier research. These are the Chinese-owned apps that TTP uncovered on each company's app store as of May 8.  On the Apple App Store: These 11 VPN apps are available on the Google Play Store: Apple's guidelines do require that any apps offering VPN services "may not sell, use, or disclose to third parties any data for any purpose." But it's difficult to imagine that an app developer based in China would honor Apple's rules over President Xi Jinping's. Google doesn't appear to have specific policies for VPNs, but it does require apps to be "transparent" about how they handle user data. Neither Apple nor Google responded to The Register's questions about the apps, or their policies related to data disclosure and app developers' provenance, by press time.