China-Owned TikTok Is Racing To Move User Data To The US

So far, Project Texas appears to be primarily an exercise in geography, one that seems well-positioned to address concerns about the Chinese government accessing Americans’ personal information. But it does not address other ways that China could weaponize the platform, like tweaking TikTok algorithms to increase exposure to divisive content, or adjusting the platform to seed or encourage disinformation campaigns.

Adam Segal, director of the Digital and Cyberspace Policy program at the Council on Foreign Relations, told BuzzFeed News that the Chinese government’s influence on TikTok’s algorithms is a more pressing concern than data exfiltration. “I’ve never seen a particularly good argument about what the Chinese could get from TikTok data that they can’t get from hundreds of other sources,” he said. But he did point to examples of the Chinese Communist Party using technology to warp digital discourse, including TikTok’s previous censorship of speech harmful to China’s “national honor,” and a 2020 attempt by a China-based Zoom employee to disrupt video meetings commemorating the Tiananmen Square massacre.

TikTok vehemently denies accusations that it censors speech critical of China today. And members of TikTok’s Trust & Safety team, which makes and enforces content policies for the company, portrayed it as comparatively well insulated from ByteDance influence. Employees described Trust & Safety workers as having less frequent contact with Beijing, and clearer lines of reporting, than other employees that BuzzFeed News spoke to — and described TikTok’s Trust & Safety practices as similar to those adopted by US-based tech giants. Nonetheless, the question of reporting structure looms large: Like other senior TikTok officials, its head of Trust & Safety reports to TikTok’s CEO, who reports to ByteDance as TikTok’s corporate owner. And as long as the buck stops with ByteDance, “there is a ceiling” to how much TikTok can distance itself from the Chinese government, Lewis said.

US lawmakers have made clear that their concerns about TikTok go beyond where data is stored. In a 2019 tweet, Sen. Chuck Schumer said that under Chinese law, TikTok and ByteDance “can be compelled to cooperate with intelligence work controlled by China’s Communist Party.” At an October 2021 Senate hearing, TikTok’s Head of Public Policy for the Americas Michael Beckerman testified that TikTok’s privacy policy allows it to share the information it collects (including US user data) with ByteDance. He declined to answer questions from Sen. Ted Cruz about whether the policy allows TikTok to share that data with Beijing ByteDance Technology, another ByteDance subsidiary that is partially owned by the Chinese Communist Party.

At the same hearing, Sen. Marsha Blackburn asked Beckerman whether ByteDance employees had access to TikTok’s algorithm. Beckerman, not directly answering the question, said that US user data is kept in the US. Blackburn also asked whether there are programmers, product developers, and data teams in China working on TikTok. Beckerman confirmed that there are.

Lawmakers beyond the US have also raised concerns about TikTok’s relationship with China. In June 2020, the Indian government banned TikTok, WeChat, and more than 50 other Chinese apps after a clash on the India–China border that killed 20 Indian soldiers. India’s regulatory body, the Ministry of Electronics and Information Technology, alleged that the apps were “stealing and surreptitiously transmitting” Indian user data to data centers outside of India. In August 2020, intelligence agencies in Australia began investigating whether TikTok poses a security threat to the country. In September 2021, Ireland’s Data Protection Commission opened an investigation into how TikTok transfers user data to countries outside the EU.

The similarities between different countries’ regulatory concerns about TikTok and China emphasize the potential importance of Project Texas. If it succeeds in the US, the project may serve as a roadmap for TikTok in other jurisdictions (perhaps even in India, where it has been banned). It may also serve as a model for other large companies, like Amazon, Facebook, and Google, which face similar concerns from overseas regulators about collecting their citizens’ personal information.

Graham Webster, editor-in-chief of the Stanford–New America DigiChina Project at the Stanford University Cyber Policy Center, sees TikTok as “a guinea pig” for lawmakers’ inherent skepticism about foreign companies collecting their citizens’ data. Still, Webster says he’s optimistic, because ByteDance has a heavy incentive to get regulators fully comfortable with TikTok.

“This is a company that is looking for a way for this to actually work,” he said. “They’re going to keep trying until there’s an obvious defeat, because the amount of money on the table is enormous.” ●