‘In China, the state uses it for intelligence purposes’: TikTok whistleblowers raise concerns over Chinese government access to US user data

Over concerns about national security risks associated with the app and its parent company, former President Donald Trump moved to either ban the app, or force the company to merge with a US based one.

Former Secretary of State Mike Pompeo warned that the app may be "feeding data directly to the Chinese Communist Party," although the app has denied these claims, telling CNBC that "we have never provided user data to the Chinese government, nor would we do so if asked."

President Joe Biden revoked Trump’s ban on the app in June, but issued criteria for the government to evaluate the risk of apps connected to foreign adversaries.

One former employee of TikTok told CNBC that lines between TikTok and ByteDance have become so blurred, that they are almost non-existent.

An employee expressed concerns over ByteDance’s ability to access US user data, highlighting an incident in which they needed a list of global users, including Americans, who searched for specific content. A data team in China sent over copious amounts of information containing all information the app had on said users.

TikTok’s privacy policy states that the company "may share all of the information we collect with a parent, subsidiary, or other affiliate of our corporate group."

While TikTok has downplayed the importance of this data access, with a spokeswoman telling CNBC "we employ rigorous access controls and a strict approval process overseen by our U.S.-based leadership team, including technologies like encryption and security monitoring to safeguard sensitive user data," cybersecurity experts are concerned that users could be exposed to information requests by the Chinese government.

"If the legal authorities in China or their parent company demands the data, users have already given them the legal right to turn it over,” Bryan Cunningham, executive director of the Cybersecurity Policy & Research Institute at the University of California, Irvine, told CNBC.

China’s National Intelligence Law required Chinese organizations and citizens to "support, assist and cooperate with the state intelligence work."

Concerns were also expressed over the choice of executives in both companies.

ByteDance announced in April that it appointed Shouzi Chew as TikTok’s new CEO. Chew had also served as ByteDance’s chief financial officer, and will reportedly continue to hold this position as well as his new CEO spot.

Downplaying the choice in CEO, a TikTok spokeswoman said in a statement, "since May 2020, TikTok management has reported into the CEO based in the U.S., and now Singapore, who is responsible for all long-term and strategic day-to-day decisions for the business."

Cybersecurity experts expressed their concerns to CNBC about the two companies growing interweaving.

Propaganda could be spread by the Chinese government on the platform, or chose to censure certain content, as seen in previous instances.

In the past, the company had instructed moderators to censor videos that mentioned Tiananmen Square, Tibetan independence or the religious group Falun Gong, according to a September 2019 report by The Guardian. TikTok said it no longer practiced that censorship and said it recognized that it was wrong following the report.

"Today we take localized approaches, including local moderators, local content and moderation policies, local refinement of global policies, and more," the company stated at the time.

"Anytime [the Chinese government has] control over a platform like TikTok that has billions of users and is only getting more popular, it gives them power to feed our mind what we should think about, what we consider truth and what is false," said Ambuj Kumar, CEO of Fortanix, an encryption-based cybersecurity company. According to CNBC, "Kumar is an expert on end-to-end encryption, including dealing with China’s special conditions for data encryption."

Another concern expressed is the collection of data TikTok has gathered and how the data could potentially be exploited by the Chinese government.

The app collects copious amounts of data on its users, including profile data, locations, messages sent within the app, what content they view, content they create, and how frequently they use the app.

While TikTok is not unique in collecting data, what is concerning is the connection to a Chinese company, who has to abide by all requests the government has to see data.

"ByteDance is a Chinese company, and they’re subject to Chinese national law, which says that whenever the government asks for the data a company is holding for whatever reason, the company must turn it over. They have no right to appeal," said Jim Lewis, senior vice president and director, strategic technologies program at the Center for Strategic & International Studies. CNBC states that "Lewis previously worked for various agencies in the U.S. government, including on Chinese espionage."