How dangerous is TikTok really for the U.S.?

Concerns about the national security risks posed by TikTok, the wildly popular Chinese-owned social media app, have reached a fever pitch. U.S. cities and states have blocked its use on government-owned devices, and universities have barred it from campus networks.

Now, the Biden White House is reportedly mulling a national ban if the Chinese owners of ByteDance, TikTok’s parent company, don’t sell their stakes — a prospect endorsed by a bipartisan group of lawmakers in Congress. That includes members of the House Energy and Commerce Committee, who have summoned the embattled company’s CEO to testify at a hearing on Thursday.

For many Americans, one big question remains: How bad is TikTok, really? Experts told Grid that it’s impossible to rule out the possibility of the Chinese government accessing data from the app. It’s not clear whether the Chinese government is interested in the information TikTok collects on its users, but several plausible scenarios worry people who study tech and national security. They include the Chinese government directing TikTok to make changes to the algorithm it uses to serve videos to users in an effort to influence election outcomes or using private information gathered by the app to blackmail dissidents or government officials.

Still, given the range of data that is already public from other sources, and other overarching concerns about app data collection, many experts said TikTok is getting outsized attention.

“In a geopolitical context, it’s viewed as problematic because it is something outside of our control,” said Jess Maddox, an assistant professor of digital media technology at the University of Alabama. “We’ve all heard the hypotheticals about what TikTok and [its owner] ByteDance in China could be doing with our data. I think it comes down to a lack of control over user data and user protections.”

What data does TikTok gather?

In an individual sense, that data isn’t very useful — unless someone is targeting you specifically for some reason. But aggregating many users’ data together allows companies and governments to see trends, connect data points and draw broader conclusions than any one set of data alone.

Could the Chinese government access this data?

That’s an open question.

ByteDance is currently registered in the Cayman Islands — not China, even if it is headquartered there. TikTok Ltd., the U.S. TikTok subsidiary, is registered in the Cayman Islands as well, though it is also incorporated in Delaware and California.

“This is a system that, where necessary, can intervene at the highly personal level, in a way that is meant to be scary,” Creemers said.

Chinese companies certainly aren’t alone in facing this kind of pressure. Apple and other U.S. companies operating in China have also come under scrutiny regarding whether the servers in their country are protected from Chinese government intrusion. Apple stores its Chinese customers’ data on servers accessible to the Chinese government and has taken down thousands of apps that are available outside the country.

What could this data be used for?

If the government was indeed able to gain access to the data that TikTok gathers, it could be leveraged for a variety of purposes — from blackmail to the aforementioned election interference.

Some researchers argue that the security risk depends in large part on which Americans’ data is exposed.

A person’s location, job or family connections could make their data more or less of a U.S. national security risk, they argue, as could whether the way a person using the service allows TikTok to identify and track them or expose confidential information about the U.S. government.

“We couldn’t figure out how big data could be used in a way to jeopardize national security short of having people in sensitive national security positions handle data in a way that would compromise national security,” said Karim Farhat, one of the report’s authors and the assistant director of the Internet Governance Project.

The Chinese government also has other ways to collect masses of data on people in the U.S., raising questions about where TikTok falls in terms of its usefulness to Beijing.

“I think what we don’t have, even at the classified level, is a very specific mechanism where it would be very clear that, if the Chinese intelligence and security services would get their hands on [TikTok user] data, they would be able to, from that, derive these actionable points, which they could then use in the following ways,” said Creemers. “I think it’s a far more general sense that might present a relatively easy channel for our adversary to get their hands on data in our population. We want to close it up. I think it doesn’t go much beyond that level of generality.”

How has TikTok tried to ease concerns about the security of its data?

TikTok has spent millions of dollars working to separate its U.S. data operations from its Chinese owners after President Donald Trump famously pushed the idea of banning the app. More recently, the company had been negotiating with the Biden administration on potential data safeguards that would satisfy U.S. security concerns without requiring a change of ownership. Even so, the Biden administration is now advocating for ByteDance‘s Chinese owners to sell their stakes.

Any banning of an app wholesale will have free expression and free speech implications for the U.S. — one that is sure to come under scrutiny by the courts along with young adults who are TikTok’s dominant user base.

Some privacy researchers don’t see TikTok as the problem but rather the lack of commitment in the U.S. to digital privacy more generally. Rather than dealing with problems piecemeal, as they arise, observers argue that the U.S. needs to enact some form of national privacy legislation, which China and the European Union have both done.

“Overall, we need federal privacy legislation, we need an end to these massive data brokers, and we need to realize that this isn’t just a problem when China does it,” said Quintin. “It’s a problem when anybody does it.”

However, addressing perceived national security threats from China has been more appealing for lawmakers than addressing these overarching tech regulation issues.

“The U.S. is at a level of political dysfunction where the only thing that can make Congress move is to be able to show that you’re tough on China,” said Creemers.