(Reclaim The Net) Leaked audio from 80 internal TikTok meetings between September 2021 and January 2022 revealed that the data of American users is repeatedly accessed by China-based employees of the platform’s parent company ByteDance. The leaked audio contradicts previous statements by TikTok that data collected in the US is stored in the US and not in China.
The recordings, obtained by BuzzFeed News, include 14 statements from nine employees that indicate China-based employees have access to US data.
For instance, in a meeting held in September 2021, a member of the Trust and Safety department said “Everything is seen in China.” In another meeting the same month, an employee referenced an engineer based in Beijing as a “Master Admin” with “access to everything.”
BuzzFeed reported the statements contradict testimony by a TikTok executive in a Senate hearing that a “world-renowned US-based security team” determines who accesses US data. The recordings also indicate that staff in the US don’t have permission or do not know how to access data and have to consult their colleagues in China.
In a statement to BuzzFeed News regarding the revelations of the leaked audio, a spokesperson for TikTok said: “We know we’re among the most scrutinized platforms from a security standpoint, and we aim to remove any doubt about the security of US user data. That’s why we hire experts in their fields, continually work to validate our security standards, and bring in reputable, independent third parties to test our defenses.”
The suspicion that China can access US user data resulted in former President Donald Trump threatening to ban TikTok in the US.
Most of the recordings are about “Project Texas,” an effort by the company to address the concerns of US user data being accessed in China. Project Texas is a contract between CFIUS and cloud services provider Oracle. The idea is to store certain protected US user data, like birthdays and phone numbers, in a data center in Texas managed by Oracle.
The companies are currently negotiating what would count as “protected data.” But the recordings indicate public data like user-profiles and posts will not be protected.
