A former TikTok recruiter says that she was supposed to work from 10 a.m. to 7 p.m., but she usually worked double shifts. She said that was because the company’s ByteDance executives in Beijing were heavily involved in TikTok’s decisions and expected the company’s employees in California to be available at all times. She said that TikTok employees would have to start their day over and work during Chinese business hours to answer questions from ByteDance employees.
This recruiter and four other former employees asked to stay anonymous and told that the Chinese company has access to information about American users and is involved in making decisions and making new products for the Los Angeles company.
In September 2017, TikTok was made available all over the world. In November 2017, its parent company, ByteDance, bought Musical.ly, a social app that was becoming more popular in the U.S., for $1 billion. In August 2018, the two apps were merged. In the U.S., it has quickly grown to have nearly 92 million users in just a few years. The app is especially popular with teens and young adults. According to a report from Piper Sandler in October 2020, TikTok is now the second-most popular social media app among U.S. teens, after Snapchat.
Last year, when Donald Trump was president, he tried to get the U.S. to ban TikTok or force it to merge with a U.S. company. Secretary of State Mike Pompeo and others in the Trump administration were worried about national security because China owned the popular social media app TikTok. Pompeo said at one point that TikTok could be “feeding data directly to the Chinese Communist Party.” TikTok has always denied these claims. The Chinese government hasn’t asked the company for user data in the last four transparency reports.
TikTok got a break in June when President Joe Biden signed an order that canceled Trump’s order to ban the app unless it could be sold to a U.S. company. On the other hand, Biden’s order gives the government a way to figure out how dangerous apps linked to foreign enemies are.
ByteDance’s control
The former employees said that the lines between TikTok and ByteDance were so fuzzy that they were almost nonexistent.
One employee said that ByteDance employees could access data about users in the United States. This was shown when an American working on TikTok needed to get a list of all users, including Americans, who searched for or interacted with a certain type of content. This means users who looked for a specific word or hashtag or liked a certain type of video. This employee had to contact a data team in China to get that information. The employee’s information included the IDs of each user, so they could look up any information TikTok had on those users. A second worker confirmed that this kind of thing happens often.
If you look at TikTok’s privacy policy, you’ll see that the company can share the information it collects with its corporate group, which includes ByteDance.
The privacy policy says, “We may share all the information we collect with a parent company, a subsidiary, or another company that is part of our corporate group.”
TikTok played down how important this access was. A TikTok spokeswoman said, “We use strict access controls and a strict approval process, which is overseen by our U.S.-based leadership team. We also use encryption and security monitoring technologies to protect sensitive user data.”
But one cybersecurity expert said it could make it possible for the Chinese government to ask users for information. “Users have already given them the legal right to turn over the data if the Chinese government or their parent company asks for it,” said Bryan Cunningham, executive director of the Cybersecurity Policy & Research Institute at the University of California, Irvine.
The former employees said that the close ties between TikTok and its parent company go way beyond user data.
ByteDance’s leadership, based in China, gives direction and the go-ahead for all kinds of decisions, from small contracts to big plans. This means that employees must work late after long days to meet with their counterparts in Beijing.
TikTok depends on ByteDance for its technology as well. Former employees said that nearly all of TikTok’s product development is done by Chinese ByteDance employees.
Because the lines are so blurry, several employees said they had email addresses for both companies. One worker said that recruiters often look for people for jobs at both companies simultaneously.
TikTok said that employees might have more than one alias, but it uses Google’s enterprise-level Gmail service for its corporate email. Employees’ emails are stored on Google servers, logged, and checked for unauthorized access.
TikTok played down how important its cross-border structure was. A TikTok spokeswoman said, “Like many global technology companies, we have product development and engineering teams all over the world working together across departments to build the best product experience for our community. This includes the U.S., the U.K., and Singapore.”
On the people side, Shouzi Chew, from Singapore, was named CEO of TikTok by ByteDance. Before hiring Chew, TikTok was run by Vanessa Pappas, a former YouTube executive. She took over after Kevin Mayer, a former Disney streaming executive, quit after only three months on the job in August 2020.
Chew was already the chief financial officer of ByteDance and will keep that job along with his new one as CEO of TikTok.
Again, TikTok played down the link. A TikTok spokeswoman said, “Since May 2020, TikTok management has reported to the CEO based in the U.S., and now Singapore. The CEO is in charge of making all long-term and strategic day-to-day decisions for the business.”
The risks of Chinese ties
Cybersecurity experts say that TikTok’s close relationship with its parent company poses a number of risks.
One risk is that the Chinese government could use TikTok to spread propaganda or change the minds of the millions of Americans who use it every month. This could be done by showing Americans short videos that the Chinese government wants to show, whether they are true or not. The company could also decide to block some kinds of content.
There have already been a few times when this has happened. The Guardian said in September 2019 that the company told moderators to remove videos about Tiananmen Square, Tibetan independence, or the religious group Falun Gong. After the report came out, TikTok stopped doing that kind of censorship because they saw that it was wrong.
“Today, we take localized approaches, like having local moderators, local content and moderation policies, local tweaks to global policies, and more,” the company said in a statement at the time.
In November 2020, TikTok’s U.K. Director of Public Policy Elizabeth Kanter admitted to a parliamentary committee that the app had censored content that was critical of the Chinese government about the forced labor of Uighur Muslims in China. Kanter said after the hearing that she misspoke.
“When the Chinese government has control over a platform like TikTok, which has billions of users and is only getting more popular, it gives them the power to tell us what we should think about, what is true, and what is false,” said Ambuj Kumar, CEO of Fortanix, an encryption-based cybersecurity company. Kumar is an expert on end-to-end encryption, which means he knows how to deal with China’s special data encryption rules.
A bigger problem that isn’t discussed as much is the information TikTok gets from its users and how the Chinese government could use it.
In its privacy policy, TikTok collects many different kinds of information. This includes information from users’ profiles, like their names and profile pictures, and any information they may add through surveys, sweepstakes, and contests, like their gender, age, and preferences.
The app also keeps track of where users are, what messages they send within the app, and how people use it, such as what they like, what they look at, and how often they use it. The app also gathers information about users’ interests based on their watches.
The most important thing is that TikTok collects information from the videos and photos users create or upload through the app. This would include videos made by users.
Some experts are worried that content made by a teenager and uploaded to TikTok, even as an unpublished draft, could come back to haunt that person if they later get a high-level job at a well-known American company or start working for the U.S. government.
Kumar said, “I’d be shocked if they didn’t save all the videos that teenagers post.” “Twenty, thirty, or fifty years from now, when we want to choose our next U.S. Supreme Court justice, they will go back and find everything they can. Then they will decide what to do with it.”
TikTok is not the only app that tracks what American users do. American tech companies like Facebook, Google, and Twitter also have a lot of information about their users that they have collected. Experts on Sino-U.S. relations and Chinese espionage say that the difference is that American companies have many tools to protect their users when the U.S. government wants data. Still, Chinese companies have to follow the rules of the Chinese government.
“ByteDance is a Chinese company, so it has to follow Chinese law, which says that companies must give the government any data they have whenever the government asks for it. They can’t file an appeal, “said Jim Lewis, senior vice president, and director of the strategic technologies program at the Center for Strategic and International Studies, a think tank for international affairs. Lewis previously worked for different parts of the U.S. government, including on Chinese espionage.
“The Chinese government can look at the information that ByteDance is collecting, and no one can stop them,” Lewis said.
The Chinese government has a bad track record regarding human rights and wide-scale surveillance.
People are worried about what the Chinese government might do because it is authoritarian, said Daniel Castro, vice president of the Information Technology and Innovation Foundation, a nonprofit, nonpartisan think tank.
In particular, these experts point to the 2015 Office of Personnel Management hack, in which thieves stole more than 22 million records about U.S. government workers and their friends and family. People thought that the hackers who did this worked for the Chinese government.
“They have 10 million pieces of information about Americans,” said Lewis. “This is a lot of data. In the United States, it is used for advertising. In China, the government uses it to spy on people.”
Bill Evanina, CEO of Evanina Group, which helps companies make risk-based decisions about complex geopolitics, said that if Americans use TikTok, they should know that they are likely giving their data to a Chinese company that is subject to the Chinese government.
“What’s in that ‘I agree to terms’ box when you want to download TikTok is very important,” Evanina said.
Not all experts worry that TikTok is a threat, though.
Graham Webster, the editor-in-chief of the Stanford-New America DigiChina Project at the Stanford University Cyber Policy Center, says that the Chinese government could get most of the information that TikTok collects just as easily through other services. He said China doesn’t need its consumer app to get information from Americans.
Webster said, “I think it’s a very low-probability model of a real threat to national security.”
What TikTok could do to calm fears
While TikTok waits to see what the Biden administration does, the company could take a number of steps to reassure the new president and the American public that their data won’t be misused.
TikTok could take the first step by being more open about how it collects data. Cyber security experts would gain a lot of credibility by giving specific details.
Jason Crabtree is the CEO of a cybersecurity company called Qomplex. During the Obama administration, he was a senior advisor to the U.S. Army Cyber Command. He said that TikTok should be clear about what data it collects, where it is stored, how long it is stored, and which employees of which companies have access to the data.
A TikTok information sheet says that the company stores information about U.S. users in Virginia, with a backup in Singapore. Employee access is strictly controlled. The company doesn’t say what kind of user information it collects, but it does say that “the TikTok app is not different from other mobile apps in the amount of information it collects.” The company says it stores data “as long as it is necessary to provide you with the service” or “as long as we have a legitimate business purpose in keeping such data or where we are required by law to keep the data.” The company also says that any user can ask to see or get rid of their information, and TikTok will respond in a way that follows the law.
Crabtree said, “If all those things are written down and backed up by witnesses, you have a much better chance of explaining to the U.S. public, regulators, and other interested parties why this isn’t a problem for consumers.” “If you don’t or aren’t willing to give real clarity, that’s something that people should be very worried about.”
ByteDance could also stick to the plan it made near the end of Trump’s time in office and sell TikTok to a U.S. company that Americans already trust. After Trump signed the order that could have banned TikTok, the company talked to Microsoft about a deal, but they couldn’t agree on anything. At one point, Walmart and Oracle agreed to buy small parts of the company, but the sale was never completed. For some cybersecurity experts, anything less than this would not be enough to make them feel comfortable with how TikTok handles American data.
“As long as TikTok is a part of ByteDance, I won’t be happy with any supposed technological fixes,” Cunningham said.
Webster said that the U.S. shouldn’t just focus on TikTok or Chinese apps but should instead make stricter privacy rules to protect Americans from all tech companies, even those with ties to countries that are at odds with the U.S.
“The answer should be privacy protection for everyone, including protection from both American and Chinese companies,” said Webster.
A Similar Report on this was first Published on ForeignPolicy in January 2019.
Read More About Business News around the World here!