TikTok ban for federal workers close to becoming law, following flurry of state bans

Like most phone apps and social media platforms, TikTok asks users for permission to access data stored on their phones such as location, contacts or calendar. To create accounts, users generally need to provide other information such as email address, phone number and real name.

That data collection, combined with information about users’ interests, allows the platforms to build profiles of users, which can then be sold to advertisers.

The data can also be used by bad actors for phishing schemes and other scams, said Len Gonzales, a private cybersecurity expert who runs the Virginia-based Ally Cyber Investigations, LLC.

“All that data that you provide to TikTok — and, again, any other app — can be viewed by those who nefariously want to capture and use that data,” Gonzales said.

And unlike most apps, which are usually owned by U.S.-based companies, data collected by TikTok contains another risk, especially for those with access to potentially sensitive government data: ByteDance’s obligations to the Chinese government.

Lawmakers say the China-based tech company must share its data with the country’s ruling Communist Party, which was part of the rationale they voiced for blocking government workers from installing it on their phones.

“TikTok is legally beholden to the Chinese Communist Party, and not only does it collect an alarming amount of information on users, but it could one day be used as a propaganda machine to sway the minds of Americans or spread misinformation,” U.S. Sen. Mark Warner, a Virginia Democrat, said in a written statement.

“I certainly don’t want to give the CCP access to our government employees any more than I would want to give them access to our military.”

‘Millions of lines of data’

A widely popular app — it has more than 12 million reviews on Apple’s App Store alone — TikTok has collected “millions of lines of data,” Gonzales said.

In the hands of a bad actor, that data could be used for espionage or blackmail, said Douglas C. Schmidt, a computer scientist at Vanderbilt University.

“If you’re a government employee, and somebody can figure out you have access to some sensitive information or some sensitive budget things, and they can get blackmail information because they know what websites you look at or who you talk to,” Schmidt said. “You can imagine people being more susceptible in those situations.”

TikTok’s offshore status may also make it more difficult for users to sue in the event of a data breach or some other misuse, Schmidt said.

Sharing data with platforms is the tradeoff for using mobile devices that make social networking, shopping and other activates easier, Schmidt said. That’s true regardless of the specific platform, he said.

“People should be concerned in general,” Schmidt said. “TikTok may have some extenuating circumstances that make it even more of an issue. But these are issues no matter what.”