Behind Biden’s Approach to Foreign-Owned Apps

President Biden revoked a Trump-era attempt to ban Chinese-owned apps TikTok and WeChat, TCEHY -1.53% instead implementing an executive order to broadly review whether apps controlled by foreign adversaries pose a security threat to the U.S.

The June 9 order means that the future of the popular apps remains unsettled as they undergo a review by the Commerce Department. Other foreign-owned apps are expected to face similar scrutiny.

It represents a twist in the saga around the ownership of TikTok, which allows users to watch and share bite-size video clips. During the Trump administration, U.S. officials expressed concerns that data collected by TikTok could be shared with China’s authoritarian government and tried to force the sale of the company to a U.S. buyer. TikTok has said that it never would share data on U.S. users with China’s government.

Here is a look at key developments.

What does President Biden’s executive order do?

The order launches a review of a broader universe of foreign-owned apps over potential security concerns. It is designed to replace the Trump administration’s approach that targeted individual companies, which senior Biden administration officials said were effectively unenforceable.

Instead of reviewing specific apps, the order calls for a study of any apps developed or owned by people or companies “subject to the jurisdiction of a foreign adversary, including the People’s Republic of China,” according to a White House fact sheet. That could lead to an even broader crackdown on foreign-owned companies than the Trump administration sought.

The order allows 60 days for the director of national intelligence and homeland security secretary to provide threat and vulnerability assessments regarding certain apps to the Commerce Department and 120 days to produce a report with recommendations. Within 180 days, the commerce secretary is supposed to recommend other executive and legislative actions that could be taken to address any risks.

What is the U.S. concerned about?

U.S. officials worry that the data harvested by such apps could be shared with foreign governments, which could then use it to undermine U.S. security interests. Some officials are concerned that the Chinese government is potentially building a vast database of information that could be used for espionage, for instance, by identifying U.S. government employees who might be susceptible to blackmail.

Officials at companies including TikTok parent ByteDance Ltd. and WeChat parent Tencent Holdings Ltd. TCEHY -1.53% have disputed security concerns alleged by some U.S. officials. Both companies have said they protect the privacy of their users.

What happened to the sale of TikTok?

The Biden administration shelved a potential sale of TikTok’s American operations to an investor group that included Oracle Corp. and Walmart Inc., The Wall Street Journal reported in February, citing people familiar with the matter. The delay was part of plans to conduct a broader review of how the prior administration approached the potential security risks from Chinese tech companies.

Concerns about a potential U.S. ban of TikTok last year, in part, drove discussions for ByteDance to explore a deal. The ban threat, combined with executive orders from former President Donald Trump to force a sale, facilitated a bidding process won by the group led by Oracle and Walmart.

Any deal involving the video-sharing app would likely be different from the one discussed in September, people familiar with the matter have said, and any sale would require Chinese regulatory approval.

What kind of user data does TikTok collect?

If you use TikTok, the app collects a range of information such as location data and your internet address, according to its privacy policy, and it tracks the type of device you are using to access its platform. It stores your browsing and search history as well as the content of messages you exchange with others on the app. It may also collect biometric information, such as faceprints and voiceprints.

If you opt in, TikTok says it can collect your phone and social-network contacts, your GPS position and your personal information such as age and phone number along with any user-generated content you post, such as photos and videos. It can store payment information, too. TikTok also gets a sense of what makes you tick. It can track the videos you like, share, watch all the way through and re-watch.

Other social-media platforms such as Facebook and Twitter also collect large amounts of information about users. But TikTok is facing scrutiny because Chinese apps in particular have a reputation for grabbing more data than required to provide their services, often sending information to advertising networks, said Jon Callas, a senior technology fellow with the American Civil Liberties Union. “Chinese apps are frequently far more abusive than others—and we hate the others,” he said.

In 2020, the Journal found that TikTok had skirted a privacy safeguard in Google’s Android operating system to collect unique identifiers from millions of mobile devices. This data allowed the app to track users online without allowing them to opt out.

How secure is TikTok?

Like other popular apps, TikTok has had security problems. In December, researchers at the security firm Check Point discovered a number of bugs in TikTok that could allow hackers to upload or delete videos from user accounts and gain access to personal information such as email addresses. Those bugs have now been fixed, TikTok says.

Also, last year TikTok was one of dozens of iPhone apps that accessed data copied into smartphone clipboards without users’ consent, a practice that could give the app access to sensitive information—copied phone numbers or passwords, for example. TikTok has said the data access was part of an anti-spam feature and that no such information left users’ devices, adding that it had removed that tool.

Other researchers have found that TikTok doesn’t pose a threat to national security. In March, researchers from a University of Toronto cybersecurity group called Citizen Lab released a report that found no evidence of “overtly malicious behavior” in TikTok’s underlying code. The researchers found that the algorithms used by the app are no more intrusive than Facebook when it comes to data collection. However, the researchers warned there could be other security issues they didn’t find and noted the Chinese government could use methods to force ByteDance to hand over data under national security laws.

Are U.S. concerns about TikTok new?

No. The app has been under a national-security review by the Committee on Foreign Investment in the U.S. Some lawmakers in 2019 called for a review of TikTok amid concerns of the potential for Chinese intelligence services to spy on users or conduct foreign-influence campaigns through the platform. TikTok has denied these allegations.

Other apps have prompted U.S. security concerns as well. National-security officials in 2019 ordered a Chinese company to sell gay-dating app Grindr, citing the risk that the personal data it collects could be exploited by Beijing to blackmail people with security clearances. Authorities last year approved the app’s sale to an investor group.

Why does TikTok need the information it gathers?

TikTok says it collects the data to improve the app’s user experience, including by customizing content and providing location-based services. The data is also collected to inform its algorithms, and to tailor which ads the app serves to its users. TikTok says the platform will store your information for as long as it is necessary to provide the services to you.

TikTok says it stores its data on American users on servers in the U.S. and Singapore, but its website says that information can be shared with ByteDance or other affiliates. In a blog post from April of last year, TikTok’s chief information security officer, Roland Cloutier, said the company was working on “limiting the number of employees who have access to user data and the scenarios where data access is enabled.”

What happens to your data if you quit TikTok?

After a user quits the app, the information is stored in what the company says is an aggregated and anonymized format. Users can ask TikTok to delete their data, and the company has said in its policy that it will respond in a manner consistent with applicable law upon verifying your identity.

Write to Paul Ziobro at Paul.Ziobro@wsj.com

Copyright ©2020 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8

Leave a Reply

Your email address will not be published. Required fields are marked *