TikTok Admits Teams in China ‘Might Need Access to Data for Engineering Functions’

It was TikTok’s turn to fire back in the he said, she said conversation over how it handles its users’ data, and vice president and head of public policy, Americas Michael Beckerman conceded in a blog post Tuesday that some user data may in fact have made its way to China, despite previous denials. “As a rule, security teams want to minimize the number of people who have access to data and limit it only to people who need that access in order to do their job,” he wrote. “We have policies and procedures that limit internal access to user data by our employees, wherever they're based, based on need. Like many global companies, TikTok has engineering teams around the world—including in Mountain View (Calif.), London, Dublin, Singapore and China—and those teams might need access to data for engineering functions that are specifically tied to their roles.” He continued, “That access is subject to a series of robust controls, safeguards like encryption for certain data and authorization approval protocols overseen by our U.S.-based leadership/security team. To facilitate those approvals, we also have an internal data classification system—the level of approval required for access is based on the sensitivity of the data according to the classification system. The intention of these processes and protocols is to ensure that the data is only accessed by those that need it to allow our business and our service to function.” Federal Communications Commission member Brendan Carr urged Apple and Google to remove TikTok from their respective application stores last week, saying that the video creation platform poses “serious national security threats” and violates Apple’s and Google’s data privacy standard. Carr tweeted, “TikTok is not what it appears to be on the surface. It is not just an app for sharing funny videos or memes. That’s the sheep’s clothing. At its core, TikTok functions as a sophisticated surveillance tool that harvests extensive amounts of personal and sensitive data.” TikTok’s issues with the federal government, particularly Republicans, came to light aboard Air Force One in July 2020, when then-President Donald Trump told reporters he intended to ban the application in the U.S., accusing the company of sharing user data with its Chinese parent company, ByteDance, and with government officials in Beijing. Trump threatened to invoke emergency economic powers to prohibit U.S. contractors from working with the company. TikTok fired back, asserting that no user data was shared in China, and that ByteDance was actually headquartered in the Cayman Islands, but the Trump administration kept applying pressure, leading to a near-sale of TikTok to Oracle and Walmart in September 2020. However, the presidential election in November of that year became the administration’s top priority, and no further actions were taken against TikTok—a path the administration of current President Joe Biden has followed to date, as well. The China connection stormed back into the news in a big way last month, when Emily Baker-White of BuzzFeed News obtained access to leaked audio from more than 80 internal TikTok meetings, which contained multiple references by multiple employees stating that ByteDance employees based in China repeatedly accessed nonpublic data about U.S. TikTok users. Albert Calamug, who works on U.S. security public policy for TikTok, responded in a blog post that all U.S. user data has been stored in its data centers in the U.S. and Singapore, adding that 100% of U.S. user traffic is now being routed to Oracle Cloud Infrastructure, with the data centers being used for backup. Beckerman wrote Tuesday, “The security of the data our community entrusts us with is a top priority at TikTok, despite recent reports questioning that commitment. We have sent a letter to Congress addressing these issues and others,” and he referenced the company’s recently created U.S. Data Security division, adding, “We are addressing who has access (and why they need it) and where those people are as two critical parts of our security protocols.”