China is watching: Olympians go to great lengths to avoid stolen data at 2022 Games

BEIJING — Kelly Curtis is a 32-year-old first-time Olympian who spent the week leading up to the Games training and doing Olympian things. She’s also a U.S. Air Force airman who at one point thought she’d specialize in cyber surety. So, as she prepared to race skeleton at the upcoming Beijing Games, she spoke with Air Force colleagues and Olympic officials about some concerns.

She, like other Team USA athletes, had been told by the U.S. Olympic and Paralympic Committee to assume “that all data and communications in China can be monitored, compromised or blocked.”

The entire U.S. delegation had been warned, via a tech advisory distributed to sports federations and obtained by Yahoo Sports, that “there should be no expectation of data security or privacy while operating in China,” and that bringing personal smartphones was “discouraged.”

“Computers,” the advisory said, “at a minimum should be cleansed of personal and business data and hardened via appropriate security software and protocols.”

The advice aligned with that of other Western national Olympic committees, and with broader fears of Chinese cyber espionage that experts say are “absolutely rational.” And it set the stage for what has become the Paranoia Olympics.

The Beijing organizing committee told Yahoo Sports in a statement that “the Chinese government attaches great importance to cybersecurity and staunchly opposes cyber theft and cyberattacks in all forms.” The committee said that it “strictly complies” with Chinese data security laws; that it will only disclose Olympic participants’ personal information for Olympic purposes; and that it “has also adopted security measures such as encryption to protect personal information and privacy.”

Nonetheless, USOPC officials arrived in Beijing last week without their usual phones and computers, and with “burners” instead. German officials have taken a similar approach, according to a spokesman. Most high-profile national Olympic committees declined to comment on specific precautions, and some emphasized that they use temporary phones at every Olympic Games anyway, no matter the host. But, one Western official acknowledged, “it is a bigger topic [than usual], because it's China.”

And it’s a topic that, more than ever before, left athletes wondering, perhaps even worrying, about bringing standard devices to the Games. When Curtis and her U.S. bobsled and skeleton teammates traveled to China for pre-Olympic sliding in October, some brought all personal devices, others brought none. Their approaches reflect what sources describe as a wide range of attitudes throughout the Olympic world toward how legitimate the cyber threat is.

Curtis, for her part, took precautions in October, and said in an interview last week that she was planning to again.

Various Olympic participants, she said, were “not the most at ease with bringing their own personal technology.”

The threat is especially high in China

Their worries stem from a variety of sources, from an alleged technical flaw in an app that all Olympics participants must download to broader anti-China hysteria; from Twitter threads claiming to prove that “all Olympian audio is being collected, analyzed and saved on Chinese servers,” to genuine fears about the Chinese government’s ability and willingness to steal sensitive information and use it.

“China,” said Robert Potter, an Australian cybersecurity expert who co-founded Internet 2.0, “is by far the most advanced of the digital autocracies.”

Its widespread surveillance systems, mostly used to track and control its own citizens, “don’t have an exemption for foreigners or athletes,” Potter said. There’s a general acceptance among both experts and Olympic officials that phones and computers connected to Chinese Wi-Fi networks — including networks offering unrestricted web access at Games venues — may be compromised, and used for espionage both during and after the Olympics. Some experts warn that email and social media accounts accessed on those networks may be compromised as well.

To which some athletes respond: So what?

It’s a valid question, according to Adam Segal, a cybersecurity expert at the Council on Foreign Relations. “If you’re the average person,” he said, “you probably aren’t worried about it too much.” Most amateur athletes, he said, don’t need to be concerned about consequences or harassment. One Western Olympic official agreed, and justified modest precautions by saying: “Look, we're a sports team. We're a sports team. Yes, this is serious, but you're not the prime minister. So if people did get into your phone, what's the worst they're going to see?”

Other Olympic officials, however, would rather not take chances. USOPC officials are fully aware that if Chinese authorities were to target one national Olympic committee, it would most likely be the American one. Segal predicted that any staffer with any level of connection to or communication with the U.S. government “will definitely be targeted.”

There is also concern about espionage for sporting benefit. The Chinese government values, funds and works closely with its Olympic sports teams. “The chances that they’re trying to steal athletes’ data in order to use it for their own athletes — I mean, I don’t wanna say 100 percent, but I can’t imagine they’re not trying that,” said Joseph Steinberg, an American cybersecurity consultant.

The concerns, though, remain mostly private, expressed behind-the-scenes, if at all. That, in part, is because of the geopolitical tension looming over these Olympics. One Western Olympic committee official hesitated to speak on the record because “everything is so political right now.”

"Every topic related to these Games is also an international relations topic,” another said. “No one wants to come out and be like, 'China is so unsafe, and so scary that we're all taking burner phones and all this stuff.' Because no one wants to start an international incident or create this environment of even more distrust. But everyone's having the conversation.”

The IOC did not respond to a request for comment.

'The Anaconda in the Chandelier'

The national Olympic committees have largely refrained from mandating security measures for athletes. And there are plenty of athletes and support staff, according to sources, who think the hysteria is overblown. Many have taken personal laptops and smartphones to China for non-Olympic competitions in the past. They’ve returned home without incident. So why change for the Olympics? Why would athletes become targets now?

Experts, however, say this thinking is flawed.

Cristiana Kittner, an analyst at cybersecurity firm Mandiant, pointed out: “You could definitely be compromised and have no idea.”

Steinberg added: “People seem to think China is going after President Biden and [other important figures]. No. They’re going for as much data and as much systems as possible for everybody. Because [data] storage is cheap, and you never know what data can be valuable. The more you collect, the more you can exploit.”

Realistically, Segal said, it’s unlikely that a given athlete’s data becomes valuable. “There'll be people who'll say, ‘You should always protect your privacy, because you always have something to hide.’ But if you are not [a person of interest],” he concluded, it’s reasonable to ignore the relatively minimal risk, enjoy the comforts of personal devices, and focus brain power elsewhere.

The one exception, experts say, is if an athlete plans to speak publicly about China’s human rights abuses, or any other topic that might trigger the Chinese government.

They can likely avoid trouble by avoiding questions about the Uyghurs, Hong Kong or Tibet. “If you're an athlete, and your plan is to keep your head down, you'll probably be fine,” Potter said.

“But that,” he continued, “is the point. If people's plan to avoid surveillance as to not cause a scene, then the system worked. It did exactly what it was designed to do.”

It’s a version of what Sinologist Perry Link once termed “The Anaconda in the Chandelier.” It’s a metaphor “used to describe how the Chinese government controls dissent and speech,” explained Neil Thomas, a China analyst at the Eurasia Group. “It basically sits there as a huge anaconda in the chandelier of a room. ... It doesn't need to do anything, this anaconda. It just needs to be there. It doesn't need to bite you. It doesn't need to spit venom at you. But your behavior will change simply because you know that it exists.”

“Most people,” Potter said, “will try just to escape by keeping a low profile. That is the deliberate intention of the surveillance state.”