Chinese Dating App Exposes Profiles and Private Data of Millions of Users

These are only my opinions, and not the representation of Saintel Daily, LLC.

A Chinese dating app exposed the profiles and private data of over 5.3 million users this week. This breach has possibly been going on since June 2018. The app, Rela, reportedly vanished from app stores in 2017, however it did return a year later. The information that was discovered included personal information on millions of users from a server that lacked a password. It included users nicknames, dates of birth, height and weight, ethnicity and sexual preferences and interests. That particular server also left over 20 million status updates exposed.

Where this gets interesting is the fact that Rela is a dating app for lesbian and queer women. China decriminalized “hooliganism” in 1997, which has been assumed to include homosexuality, but the law was never explicit on this particular point. In 2001, the Chinese Psychiatric Association deemed that same-sex attraction wasn’t a mental illness. And in 2019, the Chinese government agreed to the United Nations Human Rights Council recommendations on LGBTQ+ rights, and even noted that China has a “vibrant LGBT+ scene”. However, according to Reuters, no domestic laws prohibit discrimination against LGBTQ+ people and the government often launches crackdowns on gay rights.

Which leads me to believe that maybe there was more to this than just an innocent data breach. And by innocent, I simply mean that it wasn’t intended. But was it? Authorities in China shut down one dating app that catered to gay and bisexual men (Zank) in 2017 because it allegedly violated anti-pornography laws through the use of its live-streaming feature.

A number of other Chinese apps catering to the LGBTQ+ community are currently online, but we know attitudes towards gay rights are certainly warming. In 2018, the social media giant Sina Weibo was forced to go back on a massive purge of gay content, after backlash from users. What you might find interesting is that the state-run Beijing News provided “substantial funding” to gay dating app Blued in 2017, although Foreign Policy noted that government tolerance has limits: Authorities remain quite suspicious of organized gay rights movements, which they view as potentially disloyal to the Communist Party of China.

Is this another “innocent” security breach, or was there more to it than meets the eye? I am not suggesting that the security breach in itself is innocent, but there is the possibility that this happened on purpose. And if it did, then the breach wasn’t innocent. In general, breaches happen because someone makes a mistake. They don’t typically happen because someone wants the information of those specific people leaked.

What we don’t know is if it was done intentionally. We have seen this before, closer to home when millions of Grindr users had their information exposed. In that case, it included HIV statuses. I’d like to believe that this wasn’t done intentionally, but I’m not sure that it wasn’t. I’d also like to think that everyone could be their own selves. Maybe that’s not the case in China, but I have hope for a more accepting world. With this becoming more of an issue, I think it might be time for China to officially decriminalize homosexuality as well.