TikTok’s security threats go beyond scope of United States legislation

WASHINGTON — In a capital where Republicans and Democrats agree on virtually nothing, it was notable when the House overwhelmingly declared Wednesday that TikTok poses such a grave risk to national security that it must be forced to sell its US operations to a non-Chinese owner.

But that glosses over the deeper TikTok security problem, which the legislation does not fully address. In the four years this battle has gone on, it has become clear that the security threat posed by TikTok has far less to do with who owns it than it does with who writes the code and algorithms that make TikTok tick.

Those algorithms, which guide how TikTok watches its users and feeds them more of what they want, are the magic sauce of an app that 170 million Americans now have on their phones. That’s half the country.

But TikTok doesn’t own those algorithms; they are developed by engineers who work for its Chinese parent company, ByteDance, which assembles the code in great secrecy in its software labs, in Beijing, Singapore and Mountain View, California. But China has issued regulations that appear designed to require government review before any of ByteDance’s algorithms could be licensed to outsiders. Few expect those licenses to be issued — meaning that selling TikTok to an American owner without the underlying code might be like selling a Ferrari without its famed engine.

The bill would require a new, Western-owned TikTok to be cut off from any “operational relationship” with ByteDance, “including any cooperation with respect to the operation of a content recommendation algorithm.” So the new, American-based company would have to develop its own, made-in-America algorithm. Maybe that would work, or maybe it would flop. But a version of TikTok without its classic algorithm might quickly become useless to users and worthless to investors.

And right now, China has no incentive to relent.

The House vote “was a nice symbolic gesture,” James A. Lewis, who leads the cyber research program at the Center for Strategic and International Studies, said Wednesday. “But the Chinese get a vote, too.”

It is all part of a broader standoff between the world’s two most powerful technology superpowers. The sparring plays out every day, including in President Joseph R. Biden’s refusal to sell China the most advanced computer chips and in China’s objections to a forced sale of one of the most successful consumer apps in history. A spokesperson for China’s Foreign Ministry said Wednesday that the United States was “resorting to hegemonic moves when one could not succeed in fair competition.”

It is a remarkable problem, one not envisioned when TikTok first released its app in 2016. At that time, the United States was focused on other problems from China. It accused China’s intelligence agencies of cleaning out the Office of Personnel Management, stealing the security clearance files of more than 22 million US government officials and contractors. It was still smarting from the cyber-enabled theft of American chip designs, jet engine technology and the F-35 fighter.

No one was contemplating the possibility that Chinese engineers could design code that seemed to understand the mindset of American consumers better than Americans did themselves. By the millions, Americans began to put Chinese-designed software, whose innards no one really understood, on their iPhones and Androids, first for dance videos, then for the memes and now for news.

It was the first piece of Chinesedesigned consumer software to go wildly viral across the United States. No American firm seemed capable of displacing it. And so it wasn’t long before its ubiquity raised worries about whether the Chinese government could use the data TikTok collected to track the habits and tastes of American citizens. Panicked, state governments across the United States started banning the app from state-owned phones. So did the military.

But officials know they cannot wrest it from ordinary users — which is why the threat of banning TikTok, especially in an election year, is faintly ridiculous. In a fit of remarkable candor, Commerce Secretary Gina Raimondo told Bloomberg last year that if any democracy thinks it can outright ban the app, “the politician in me thinks you’re going to literally lose every voter under 35, forever.”

The House bill passed Wednesday holds open the threat of such a ban. But that is probably not its real intent. Rather, it seeks to give the United States leverage to force a sale. And for two years now, the Committee on Foreign Investment in the United States, a secretive body that reviews corporate deals that could jeopardize national security, has quietly been trying to work out an arrangement that would avert a true showdown. So far it has failed — one reason that the bill passed.

In the course of those negotiations, TikTok has proposed to continue US operations — while still fully owned by ByteDance — and have its algorithm inspected and dissected in the United States. It is part of a broader plan TikTok calls Project Texas.

Under Project Texas, all US-origin user data from TikTok would be stored on domestic servers operated by Oracle, a cloud computing company. To build confidence in the independence of its algorithm, TikTok has also proposed that Oracle and a third party will review its source code to make sure it has not been manipulated.

TikTok says much of this plan is already being implemented. But government officials insist that it is hard to know how such inspections would actually work — even for the most experienced experts, reviewing minor changes in code, at high speed, is a complicated proposition. Biden administration officials say it is not like inspecting agricultural goods or counting weapons under an arms treaty. Very subtle changes could alter the news that is delivered, whether it was about a presidential election or Chinese action against Taiwan.

TikTok has tried to enshrine that arrangement into a formal agreement to resolve the government’s national security concerns. But that idea met resistance from senior Biden administration officials, starting with Deputy Attorney General Lisa Monaco, who felt it was not tight enough to resolve their concerns.