The popular video-sharing company TikTok, with an estimated 800 million users, has been at the center of criticism for its connection with China and the Chinese Communist Party. In India, where it emerged as a favorite medium among the youngsters and adults, it was perceived as a huge threat to privacy and banned.
The company was fined by South Korea's telecommunications watchdog for mishandling child data. Korea Communications Commission (KCC) claimed that the company has been fined 186 million won ($155,000) for failing to protect users' private data.
However, just a few days ago, after the review of TikTok's data collection policies, lawsuits, cybersecurity white papers, privacy policy, and past security vulnerabilities, ProtonMail found that this platform shares data with the CCP Government in China. The experts at the Switzerland based company urged people to "approach TikTok with great caution, especially if your threat model includes the questionable use of your personal data or Chinese government surveillance."
TikTok Data Collection
After the high-profile Facebook-Cambridge Analytica data breach scandal, the data privacy issue with TikTok has emerged as one of the biggest threats of late. As per the ProtonMail, it has found that the social media platform can collect a huge amount of the data even if a user just downloads the app and opens it, without creating an account.
ProtonMail, which provides world's largest secure email service, said the TikTok app can collect the IP address, history of the contents a user watched on the platform, mobile carrier, mobile data and location data of the mobile device, including GPS and WiFi.
After creating an account in TikTok, which requires adding a phone number or email address and the date of birth, it asks to grant permission to access users' other social media accounts, phone contact list, and GPS data. Once a user starts using the app, TikTok collects details about videos uploaded by the user, how much time a user has spent on watching videos, videos liked and shared by a user, as well as messages exchanged in the app.
The video-sharing app said that if a user deletes the account, the company also deletes the account's data, videos, and other information within 30 days. However, as per the experts whether such claims are true or not, is just impossible to verify. But ProtonMail pointed out that in TikTok's privacy policy, the company has mentioned clearly that it shares users' browsing data and email address with third parties to serve the users with targeted advertising.
During the recent tension between the U.S. and China over the Coronavirus spread, all these privacy issues with Huawei and now TikTok have sprung up mostly because of the parent company's close ties with the Chinese government, which may pose a security threat in the future.
In 2019 November, a group of TikTok users in California filed a class-action lawsuit against the social media platform and the parent company ByteDance. The lawsuit claimed that the app includes "Chinese surveillance software," and collects all videos shot on the app, even if the videos are not published or saved. It was also claimed that TikTok allegedly uses these users' videos and photos to collect biometric data, such as face scans, without the consent of the users.
Another lawsuit was filed in Illinois by four teenagers in May 2020 that claimed that the app has violated the State's law protecting people's biometric information, which can include data from facial, fingerprint, and iris scans without informing the users.
China Collects Data From TikTok?
Recently, Robert C. O'Brien, US National Security Adviser, had alleged that TikTok "is getting facial recognition" on millions of US citizens as well as mapping their relationships, and then sending the data back to China for processing. He told Fox News Radio during a July 14 interview that "China is going to know everything about you, they're going to have biometrics on you. You have to be very careful who you give such personal information to."
In response to O'Brien's claims, a TikTok spokesperson claimed that there is a massive misinformation surrounding TikTok. The spokesperson added that the company has an American CEO and Chief Information Security Officer with decades of industry and US law enforcement experience. Four of the five board seats in the parent company are controlled by some of the world's best-respected global investors. He said, "US data is stored in the US and Singapore, with strict controls on employee access. These are the facts."
TikTok's parent company ByteDance is a Beijing based company worth over $100 billion. The law and regulation in China as well as the county's internal politics can make it hard to understand whether it is an independent firm or coordinating with CCP.
Under the National Intelligence Law of China, it gives the power to the government to compel any Chinese company to provide any information it requests that includes foreign citizen's data. The CCP-ruled country further forces these requests to be kept as secret and not be disclosed via transparency reports.
Almost two years ago, ByteDance closed its Chinese social media app called Neihan Duanzi that was used to share jokes and comedy, as the government accused it of hosting "vulgar" content. Later, the company said it would "deepen cooperation" with the CCP. However, in terms of TikTok, ByteDance said that the users' data is not stored in China. But as per ProtonMail, TikTok in its policy explicitly reserves "The right to share user information with other members of its 'corporate group' (of ByteDance)."
Another cybersecurity firm Penetrum reported that more than one-third of the IP addresses the TikTok APK connects to are China-based and the majority of them are hosted by Chinese tech giant Alibaba. This was mentioned in the California lawsuit. As per Penetrum, "TikTok does an excessive amount of tracking on its users and that the data collected is partially, if not fully, stored on Chinese servers with the ISP Alibaba."
There are concerns that the Chinese government and TikTok's parent company are using the social media platform as a tool to extend the country's censorship. A reporter at The Washington Post earlier tweeted: "Former TikTok employees told us the company's Beijing-based leadership often overrode their censorship concerns and restricted lots of social and political videos. 'They want to be a global company ... but the decisions all come from China'"
Since February this year, Australian politicians have been demanding a probe on TikTok's data collection issue, while the U.S. government is seriously considering its ban. Recently, an American lawmaker told Wall Street Journal that "all it takes is one knock on the door of their parent company, based in China, from a Communist Party official for that data to be transferred [from TikTok] to the Chinese government's hands, whenever they need it." This view surmises all the apprehensions against TikTok.
