CMMC 2.0: Why Banning Tiktok on US Devices is a Good Idea

It is important to note that the US Government hasn’t imposed a nationwide ban on TikTok. However, FAR 52.204-27 restricts its use on government devices and by government contractors due to national security concerns. The only State that has an existing law purporting to ban TikTok across its borders is Montana. However, in a lawsuit against Montana’s TikTok ban, a judge ruled that it “oversteps state power” and “likely violates the First Amendment.” Additionally, a growing number of universities, such as the University of Texas at Austin, Auburn University, and Boise State University, have blocked the app on their campus Wi-Fi networks. While some may view this move as an overreaction or infringement on personal freedoms, there are several compelling reasons why banning Tiktok on US devices is a good idea. So, why is the US banning TikTok in Government-owned, contractor-owned, and even personal devices used for work (BYOD)?  

National Security Concerns  

Although TikTok CEO asserts that the company is based in Singapore, its parent company, ByteDance, is in Beijing, China. US officials worry that China’s ability to compel access to information under national security laws could compromise the privacy of data collected by TikTok from US users. According to Western legal experts, Chinese national security laws are too broad. They require any citizen or organization in China to help and cooperate with the state “intelligence work.” Unfortunately, the law doesn’t define the meaning of “intellience work.” TikTok has been criticized for its extensive data collection practices, including personal information, location details, device information, and browsing history. Should Chinese authorities gain access to TikTok’s user information, they could use it to identify potential intelligence opportunities by uncovering predilections, vices, or pressure points of a potential blackmail target or spy recruit. Beijing could weaponize this information for nefarious purposes like targeted disinformation campaigns. 

Cyber Security Concerns  

Beyond data concerns, cybersecurity vulnerabilities raise national security alarms. The app’s Chinese ownership, ByteDance, raises critical questions about potential vulnerabilities:   

• Backdoor access:  Experts warn of potential “backdooring,” where the Chinese government could leverage apps like TikTok to gain unauthorized access to US government networks and exfiltrate data.   
• Data breaches: Any large platform is susceptible to cyberattacks, but TikTok’s Chinese connection heightens anxieties. State-sponsored cyberattacks by China are a growing concern, and the potential for stolen data to reach Chinese authorities fuels further worry.  
• Malware and spyware: While not confirmed, some cybersecurity experts suspect the app itself could contain malicious software designed to collect user data or compromise devices. In fact, Tiktok’s parent company, ByteDance, has been criticized for monitoring employee communications and potentially using that information for surveillance purposes.  

To mitigate these risks, lawmakers implemented a ban on TikTok across government-owned devices, contractor devices, and even personal devices used for work purposes.   

Data Security and Privacy Concerns  

Another reason for the TikTok ban hinges on deep-seated concerns surrounding data security and privacy. There have been concerns about the app’s aggressive data collection practices, with some experts arguing they go beyond industry standards. But how does TikTok use this data? TikTok’s data handling practices have been criticized for their lack of transparency. It is unclear how user data is being used or who has access to it. And that’s not all. TikTok has been accused of sharing user data with third-party companies, which could use it for targeted advertising or other purposes. Under GDPR, TikTok should first seek user consent before collecting or using user data. TikTok maintains that US data is now stored in data centers within the US and Singapore. However, a 2022 Buzzfeed investigation revealed that ByteDance employees in China “repeatedly” accessed non-public US user data.  

Algorithm Transparency Issues  

The lack of transparency surrounding TikTok’s algorithm and content recommendation system raises concerns about its ability to manipulate and influence users. National security officials have voiced their concerns that Beijing may leverage TikTok’s content moderation and recommendation algorithms to influence content shown to US citizens. This, again, leads to national security anxieties, fearing potential manipulation for foreign agendas and misinformation. TikTok has taken steps to increase transparency, such as providing general information about the algorithm’s factors and offering limited user controls. As part of “Project Texas,” Oracle reportedly is auditing TikTok algorithms to ensure US user information is secure from manipulation. However, critics argue these are insufficient measures.