Introduction

WeChat is an instant messaging, social media, and mobile payment app.  Travellers should know that WeChat is an insecure application and that third parties can monitor its use. However, it is recognized that using WeChat for personal communication and payment services can be a reasonable way to operate and work in China effectively.  This session outlines security concerns with WeChat and recommendations for its use.

Applicability

This article applies to staff travelling to China for work purposes.

Details

Overall Guidance

Travellers to China may need to communicate in real-time and pay for goods and services as part of their daily activities.  When following this guidance, staff can use WeChat to communicate non-sensitive information and purchase goods in China. Please contact Logistics and Business Services via the Staff Service Center for more guidance on the financial aspects of your trip, including PCard limits and legitimate expenses.

However the underlying assumption informing all support and guidance when travelling to China is that there is no completely secure method of receiving or transmitting information and that foreign entities may monitor ALL such activities.  Therefore caution should be applied per the Government of Canada's guidelines HERE and HERE for travel to China.

IST recommends that you do not access any sensitive information while in China.  The definition of 'sensitive' data can be found on page 2, point 12 of the Institutional Data Management and Governance Procedure.  This does not include using Google apps to create, amend, store, or access information if done so through one of the recommended connection methods (e.g., a university-approved VPN).

Using WeChat

Travellers should know that WeChat is an insecure application and that 3rd parties can monitor its use.  However, it is recognized that using WeChat for personal communication and payment services is the only reasonable way to operate and work in China effectively.  This section outlines security concerns with WeChat and recommendations for its use.

General WeChat Privacy and Security Concerns and Usage Guidelines

1. Recommendations for general WeChat Users (From Privacy in the WeChat Ecosystem Explained):
   1. Avoid features delineated as "Weixin services" if possible. Many core "Weixin" services (such as Search and Channels) perform more tracking than core "WeChat" services, and by using "Weixin" services, your data is shared with an entity operating in Shenzhen, China.
   2. Disable access to your phone's microphone, camera, contacts, and location information.
   3. Apply regular security and operating system updates.  Many new security features on modern versions of Android are working to enforce permission boundaries and limit certain types of identifiers available to the application.  We recommend regularly updating for immediate access to additional security features. 
2. The WeChat app (WeChat for Windows) collects more information from the user's smartphone/computer than Web WeChat (web/browser version); therefore, the web browser version is recommended by IST.
3. Pay attention to the WeChat permission settings. Limit them to only those necessary for the app to function correctly.
4. Use a strong password, and do not reuse passwords across apps/accounts.  Reset passwords when you return home.  Be sure to use a separate one for WeChat. This way, if one account gets compromised, it won't affect your other accounts.  Tips for selecting a strong password.
5. Consider having a dedicated device for WeChat communication.
6. Update all applications before leaving for China.
7. Know that communications are not encrypted.
8. Assume all conversations are monitored, and data collected may be shared with the Chinese government under its National Security laws.
9. Be cautious and do not share sensitive information on WeChat.  Try to discuss these things in person. Be aware of your communication so as not to put other individuals at risk.
10. Using "mini programs" within WeChat (e.g. Express 100, WiFi One Connect, MetroSearch, or DianPing) is not recommended. Limit use to the chat feature.

IST recommends that any device on which WeChat is used should be configured to restrict WeChat access as much as is practical.  The default should be to block access to the microphone, camera, contacts, and location information.

Frequently Asked Questions about Privacy and Security

How do I restrict access to your phone's microphone, camera, contacts, and location information?

• To review or restrict access to my phone's microphone, camera, contacts, and location information using WeChat v8.0.16 or above:
  • To restrict access: Go to the Me tab > My Information & Authorizations > System Permissions.  
  • To review access: You may view system features that WeChat currently has your  authorization to use and change those authorizations by tapping Go to System Settings
• For users using WeChat v8.0.15 or below, you will have access to review and restrict access via your phone's system settings. Note: The setting path varies for different devices. See HERE for details.
  • Android: Go to your device Settings > Apps & notifications > App permissions > Camera/Location/Microphone/Phone > Enable or disable WeChat from these permissions
  • iOS: Go to your device Settings > WeChat > Enable or disable.  Locations/Contacts/Microphone/Camera

Who can add me as a WeChat contact?

• If you have not enabled any privacy settings, anyone can add you as a contact if they have your WeChat ID, mobile phone number and email address if you've linked it with your WeChat account.
• You can disable anyone from finding you through your WeChat ID, phone numbers, and email in Me > Privacy > Methods for Friending Me.  For more information, click HERE.

What personal data does WeChat store, and how does it use my data?

• Privacy Protection Summary and Privacy Policy

Further Information

For more information on the privacy and security of WeChat, please see the following:

• Privacy in the WeChat Ecosystem Explained
• Should We Chat? Privacy in the WeChat Ecosystem