Qihoo is just a typical tech company with a “security” focus. It having a VPN is like Norton having a VPN - like Norton VPN.
Using a shell company is likely just a way to avoid sanctions.
A Chinese app talking to Chinese servers is no more alarming than a Swedish app talking to Swedish servers or an American app talking to American servers. Imagine writing a breathless “report” about how searching the App Store phones home to the United States. You know, to search for and download apps.
So basically the Tech Transparency Project is just doing some nationalist orientalism.
From their website: “TTP is a research initiative of Campaign for Accountability (CfA), a 501©(3) nonpartisan, nonprofit watchdog organization that uses research, litigation, and aggressive communications to expose misconduct and malfeasance in public life.”
Their director: “Katie Paul, TTP’s Director, specializes in tracking criminal activity on online platforms such as Facebook. She also serves as co-director of the Antiquities Trafficking and Heritage Anthropology Research (ATHAR) Project and a founding member of the Alliance to Counter Crime Online (ACCO).”
They are somewhat opaque about their funding. They claim to not accept corporate funding but every funder they list is just a middleman NGO for corporate/billionaire funding.
So, a typical NGO run by a cop.
Tech companies are generally terrible and tied to financialized nonsense, but there is nothing out of the ordinary here. The outrage is premised entirely on xenophobia.
Security and privacy benefits from building threat models. It is good to understand how trackable you are on the internet and walking around with your phone.
Do you need to think about how trackable your phone is if you are driving to and from the grocery store? At most you are providing information that the interested parties already have (where you live, where you shop, and when you shop). If you ran into some trouble it could be useful to have not had a tracking device in your pocket, but otherwise little to worry about.
On the other hand if you are taking part in a sensitive action, then yes you need to leave your phone at home or turned off and in a Faraday bag. If it is particularly sensitive then you need to make sure everyone involved does that. Having a tracking device that shows you were at the location at that time is very bad for you and your compatriots. If you need to communicate on-site, use walkie talkies and speak in code. And plan your action around not having comms. This will make your action better planned out in the first place, which is also important for security.
A threat model makes all the difference.