ByteDance Investigation Reveals Employees Obtained User Data From 2 Journalists

ByteDance, the Chinese parent company of TikTok, said on Thursday that an internal investigation found that employees had improperly obtained data from American TikTok users, including that of two journalists.

Over the summer, a few employees of a ByteDance team tasked with monitoring employee conduct attempted to find the sources of alleged leaks of internal conversations and business documents to reporters. In doing so, the employees gained access to the IP addresses and other data of two journalists and a small number of people connected to the journalists through their TikTok accounts. They were trying to determine if these people were in close proximity to ByteDance employees, according to the company, which added that efforts had not found any leaks.

The investigation was launched after the publication of an article by Forbes, and the investigation confirms part of this report and highlights the privacy and security risks associated with TikTok that US lawmakers, state governors and the Trump and Biden administrations have been raising for more than two years. More than a dozen states have banned TikTok from government-issued devices, and the company has been in lengthy negotiations with the administration over security and privacy measures that would block any potential access to U.S. user data by ByteDance. and the Chinese government.

ByteDance General Counsel Erich Andersen revealed the findings of the investigation, which was conducted by an outside law firm, in an email to employees on Thursday.

All four employees involved in the scheme have been terminated, the company said, correcting an earlier statement that one of the four quit. Two of these employees worked in China and two in the United States. ByteDance said it restructured its internal audit and risk management team and removed all access to US data from that department.

The journalists targeted were Emily Baker-White, who wrote for BuzzFeed and is now at Forbes, and Cristina Criddle of the Financial Times, ByteDance said, though it declined to identify any other affected TikTok users. Forbes reported that two other of its reporters, who are also former BuzzFeed reporters, were targeted. ByteDance said its investigation did not conclude these additional reporters were involved, but said it would re-examine the raw data to determine if the allegations were true.

Mr. Andersen and ByteDance chief executive Rubo Liang disclosed the findings of the investigation in separate emails to employees.

“I was deeply disappointed when I learned of the situation…and I’m sure you feel the same,” Liang wrote. “The public trust that we have worked so hard to build is going to be significantly undermined by the misconduct of a few individuals.”

TikTok chief executive Shou Zi Chew also emailed his employees about the investigation, expressing his disappointment and underscoring the company’s commitment to protecting US data.

“We take data security extremely seriously,” Chew said in the email. He said that over the past 15 months, the company has been working to create a new US-based data storage program as “a testament to that commitment.”

Employees obtained historical data, according to ByteDance and TikTok officials. For several months, the company said it was in the process of putting all US data on the Oracle cloud, but past data obtained by ByteDance employees was still available. TikTok said it plans to delete all historical data outside of Oracle systems.

The revelations come amid growing concerns from US officials about the privacy and national security risks posed by TikTok, a hugely popular video-sharing app with around 100 million US users. ByteDance acquired TikTok, formerly known as Musical.ly, in 2017. Since then, the company has been a focus of concern for national security officials who say the app is too closely aligned with its parent company in China. and can put sensitive data, such as geolocation and user habits and interests in the United States, into the hands of the Chinese government.

In September, TikTok chief operating officer Vanessa Pappas told a Senate hearing that the app does not share data with the Chinese government. The company tried to steer the app away from ByteDance, saying TikTok has its own corporate structure, with offices in New York, Los Angeles, Singapore and Washington.

Hoping to allay national security fears, ByteDance moved US users’ data to a cloud storage system operated by Oracle, the Silicon Valley software company.

TikTok has been locked in negotiations with the Biden administration over this security plan to move all US data and erect walls around the data to prevent Chinese government access. Negotiations, which began under the Trump administration, have stalled in recent weeks, prompting a cascade of state and federal actions to restrict TikTok use. Sen. Mark Warner, a Democrat of Virginia and chairman of the intelligence committee, called on the administration to wrap up discussions with TikTok on national security fixes to the app.

“This new development reinforces serious concerns that the social media platform has allowed TikTok engineers and executives in the People’s Republic of China to repeatedly access US users’ private data despite repeated claims by lawmakers and regulators. users that this data was protected,” Warner said. . “It is time to propose this solution or Congress may soon be forced to intervene.”

Congress is expected to vote as early as this week on a proposal that would ban TikTok from any federally issued devices. Intelligence officials, including FBI Director Christopher Wray, have warned that Chinese officials can siphon off sensitive data about US citizens to use for surveillance and propaganda purposes.

TikTok is in the midst of an escalating economic and trade war between the United States and China for tech leadership. The superpowers have imposed trade restrictions on foreign-made technology and poured out hundreds of billions of dollars in grants and subsidies to bring tech supply chains back to manufacturing within their borders.

Senator Marco Rubio, a Republican from Florida and a top Intelligence Committee member, introduced legislation with the support of Democrats that would ban TikTok from all consumer devices. The bill would face First Amendment challenges, legal experts say, but underscores growing pressure to ban the app.

“No one should be surprised or misled by ByteDance’s public apology,” Mr. Rubio said in a statement about the internal investigation. “The company is desperate to assuage growing bipartisan concerns about how it is allowing the Chinese Communist Party to use — and potentially weaponize — US citizens’ data. Every day it becomes clearer that we need to ban TikTok.”