LINE, a messaging app mostly used in Asia, offers end-to-end encryption but also presents back-end security concerns and a history of data breaches. In this article, Reporters Without Borders (RSF) investigates the safety risks associated with LINE and how best to use the messaging app safely.
LINE, a Japanese messaging app widely used in Japan, Taiwan, Thailand, and Indonesia, offers reasonable security features, including end-to-end encryption and a one-device-only policy. However, it also shows vulnerabilities in terms of data storage and data breaches. In this article, Reporters Without Borders (RSF) presents the main risks linked with using the app and provides recommendations for journalists on how to safely use it.
Main risks
- LINE stores data in China. While the main servers are located in Japan, in 2021 it was revealed that LINE also stored data in Shanghai. Taiwan and Japan, where LINE is widely used and notably by politicians, have a tense relationship with China and could be a target for surveillance. This is of particular concern to journalists critical of the Chinese regime, as data stored on Chinese servers is subject to Chinese jurisdiction and can be accessed by the state.
- LINE abides by state censorship requests. The governments of Thailand, Indonesia, and China have successfully lobbied LINE to censor content, in the case of China going as far as to block lists of keywords on the Chinese version of the app. However, LINE is currently blocked in China and banned in Russia for failure to comply with government-mandated data collection.
- LINE has a history of data breaches. Three major breaches in 2021 and 2023 leaked the private details of tens of thousands of users, and caused LINE to briefly go down in Taiwan after a suspected malicious attack.
- LINE indirectly offers limited anonymity in certain countries. In Hong Kong, Japan, Korea, Taiwan and Thailand, it is mandatory to register a LINE account with a phone number. But to obtain a phone number in these regions, users must provide their real government ID. Therefore, it means that the users’ activity on the app is de facto not anonymous.
Recommendations to journalists
- Create a LINE account through an anonymous Google account. Journalists are advised to set up a Google account unlinked to any identifiable internet presence, and use a VPN (Virtual Private Network) if it is necessary for them to register a LINE account outside of countries where a phone number is mandatory to register.
- Turn on encryption. LINE uses end-to-end encryption called “letter sealing,” but for it to work, every participant in a chat must have it enabled.
- Set a passcode. LINE privacy settings allows users to lock the app with a passcode, contrary to most messaging apps. However, if forgotten, the app will have to be wiped and reinstalled.
- Block unwanted contacts. In the privacy settings, journalists can disable the “external app access” and “allow others to add me by ID” features in order to prevent unwanted contacts. They can further enable “filter messages.”
- Use as few features as possible. LINE offers a range of services including payment, finding a doctor, and food delivery. Using these features requires the app to have access to more personal data, including specific location and payment information, and should not be used by journalists concerned with security.
This article is part of a series on messaging apps:
- Journalists should use Signal to protect themselves and their sources
- LINE, a messaging app to use with caution
- Element, a decentralised alternative to messaging apps
- Need to communicate while offline? Try a mesh messaging app
