U.S. Think Tank: Temu is a CCP Spyware Disguised as an E-commerce Platform

Image of the Pinduoduo app. (Tang Shiyun / Dajiyuan)

October 28, 2024– According to a report from a U.S. think tank, the Chinese cross-border e-commerce platform Temu poses significant risks, potentially posing a threat on par with TikTok. Experts warn that Temu may be a CCP spyware tool for espionage and cyberwarfare disguised as an e-commerce site.

For the past few years, many U.S. officials and experts have been warning that the CCP is using TikTok to spread misinformation and manipulate public opinion in the U.S. Amidst these concerns, President Biden signed a law in April requiring ByteDance, the CCP-controlled parent company, to divest TikTok or face a U.S. ban.

However, some experts argue that while this legislation addresses TikTok’s threats, lawmakers need to adopt broader policies to ensure that American citizens are not affected by malicious CCP activities.

On October 24, the Washington-based Center for Strategic and International Studies (CSIS) released a report (PDF). Experts at CSIS wrote in the report: “Temu is essentially spyware disguised as an e-commerce website to gather information.”

The report states that Temu claims consumers can “shop like a billionaire,” offering the allure of “fast fashion” but hiding significant security risks.

CSIS states that Temu’s coding is designed as a “digital parasite,” making it extremely difficult for users to remove, “turning users' phones and devices into hosts that feed on users’ data.”

When installed, Temu requests more access permissions than necessary. This means it can “monitor all user activity, modify settings, and is nearly impossible to remove.”

CSIS warns that Temu has links to CCP departments involved in data regulation and propaganda, potentially making Temu a “highly potent surveillance tool” and a possible node for distributed denial-of-service (DDoS) attacks.

The Dark Shadow Behind Temu’s Rapid Growth

Temu launched in the U.S. in 2022 and expanded to the European market the following year. Temu’s operational model bypasses middlemen and stores, shipping goods directly from factories to customers, offering ultra-low-priced products.

Privacy advocate and journalist Fergus O’Sullivan wrote, “Temu doesn’t look like a shop where you buy things but more like a broker for Western consumers to trade with Chinese factories.”

The combination of low prices and extensive advertising has rapidly increased Temu’s market share and driven explosive growth. CSIS points out that during the 2024 Super Bowl, Temu invested $21 million in advertisements and offered $15 million in giveaways, prompting a massive number of Americans to download the app.

In response to explosive growth, China recently announced plans to open new air routes between Zhengzhou and Atlanta, Dallas. In May of this year, Zhengzhou International Airport saw an 18.6% increase in cargo throughput, attributed to the rise of cross-border e-commerce like Temu.

However, Temu faces multiple accusations, including exploiting the U.S. Customs “de minimis” provision to avoid tariffs and inspections, selling goods involving forced labor, and even potentially serving as a smuggling route for fentanyl and other contraband.

In September, two U.S. Consumer Product Safety Commission (CPSC) leaders warned that Temu has been accused of selling “deadly infant products.”

In June, the state of Arkansas filed a lawsuit against Temu, accusing this Chinese platform of violating state privacy laws, engaging in deceptive practices, and “nearly infinitely” collecting customers’ personal information through low-priced products.

The complaint states that Temu entices users to provide “virtually unlimited access to personally identifiable information without their knowledge.”

“Once installed, Temu can recompile itself, changing properties, including overriding data privacy settings that users believe they have configured.” the complaint states.

CSIS warned: “What’s more concerning is that Temu, through its parent company, has business dealings with a company directly linked to the CCP Central Committee.”

According to research from the Australian Strategic Policy Institute (ASPI), Temu, through Pinduoduo, has business relations with “People’s Data Management,” which directly participates in the CCP’s media and data control work.

CSIS wrote, “While it’s unclear what information Temu or Pinduoduo has shared with People’s Data Management, it’s certain that this e-commerce platform has ties to the CCP’s propaganda work.”

Research Company: Temu Exhibits All Characteristics of Malware

Grizzly Research, a market intelligence company, warns that it considers Temu to be “the most dangerous popular app.” The company notes that Temu “has all the traits of the most aggressive malware/spyware.”

Grizzly Research found that Temu has hidden features “allowing for extensive data infiltration without user knowledge, potentially giving malicious actors full access to nearly all data on users’ mobile devices.”

“It’s clear that the company has taken great effort to deliberately conceal the malicious uses and intrusiveness of the software,” Grizzly Research stated.

CSIS calls on the federal government and Congress to take action against Temu to protect Americans’ data. They recommend that the Federal Trade Commission (FTC) investigate Temu’s deceptive practices, including false advertising, fraud, and privacy violations.

“The Federal Trade Commission also has the authority to take legal action against companies that violate consumer protection laws,” CSIS stated.

CSIS also suggests that the next administration should continue enforcing the executive order President Biden issued in February of this year. The order expands measures to protect sensitive personal data of Americans, preventing data from flowing to the CCP and other foreign adversaries.

The think tank further urges the next Congress to avoid passing legislation targeting individual apps and instead seek to expand legislation related to TikTok to restrict all applications owned, operated, or affiliated with the CCP, as they pose an obvious threat to U.S. data security.

Editor: Li Muen