The claims are part of a lawsuit filed in California by Yintao Yu. Yu was the top engineer for Byte Dance’s US office in California between 2017 and 2018. He says that during the crackdown on protests in Hong Kong, the CCP accessed TikTok’s user information in an attempt to identify people.

The filing says that when Yu was at the company, TikTok stored all users’ direct messages, search histories and content viewed by users.

In his filing, Yu says that at ByteDance, members of a Communist Party committee inside the company had access to a “superuser” credential, also known as a “god credential,” to view all data collected by ByteDance. Additionally, ByteDance maintained a “backdoor channel” for China’s Communist Party to access U.S. user data, the suit says.

For the Hong Kong users, Yu said in the filing that he saw the logs that showed the committee accessed the user data of protesters, civil rights activists and their supporters, including users who had been identified from prior protests. The filing also said the committee monitored Hong Kong users who uploaded protest-related content on TikTok.

Yu also claims that Byte Dance was scraping content from other social media sites and posting it on TikTok to gain more engagement. The Journal reports it has seen a 2017 email discussed one specific scraping operation which gathered content from about 2 million Instagram creators.

Yu claims that when he raised concerns about this behavior he was fired. But a spokesperson for Byte Dance rejected his claims, calling them “baseless” and pointed out that Yu hadn’t raised any of these allegations in the five years since he left the company. Yu’s attorney said he had decided to come forward now to counter some of the claims being made by TikTok Chief Executive Shou Zi Chew.

TikTok has spent months trying to win over lawmakers and figures in the media and to avoid a possible ban in the US. TikTok’s core message is that Chinese engineers have no access (or will have no access) to the personal data of US users of the app. But there have been stories going back two years now that indicate Chinese engineers do in fact have access to anything they want to see. And if the Chinese engineers have that access then the CCP is only one step removed. It is black letter law in China that the government can request data from any Chinese company and the company has to hand it over. In fact, China treats its biggest companies as outside entities that exist to do whatever China’s intelligence community needs done.

In the final years of the Obama administration, national security officials had directed U.S. spy agencies to step up their intelligence collection on the relationship between the Chinese state and China’s private industrial behemoths. By the advent of the Trump era, this effort had borne fruit, with the U.S. intelligence community piecing together voluminous evidence on coordination—including back-and-forth data transfers—between ostensibly private Chinese companies and that country’s intelligence services, according to current and former U.S. officials. There was evidence of close public-private cooperation occurring on “a daily basis,” according to a former Trump-era national security official. “Those commercial entities are the commercial wing of the party,” the source said. “They of course cooperate with intelligence services to achieve the party’s goals.”…

In what amounts to intelligence tasking, China’s spy services order private Chinese companies with big-data analytics capabilities to “condition”—that is, work up or process—massive sets of information, including from hacks like the massive breach of the U.S. Office of Personnel Management (OPM), that have intelligence value, according to current and former officials. This data then promptly flows back to Chinese state entities, they say.

Given the cozy relationship between the government and big businesses, it would be pretty unusual to find that Byte Dance, a company with tens of millions of foreign users, had somehow been overlooked. Far more likely is that China is quietly collecting data on anyone it finds of interest and hoping its PR efforts in America allow that collection to continue.