TikTok deal exposes a security gap, and a missing China strategy

“We don’t have to guess what their intentions,” she said. “They have written what their intentions are, and it’s called ‘Made in China 2025,’” the country’s strategy of becoming a peer competitor of the United States in all major technological arenas in the next five years. “And yet we think we can counter this by banning an app. The forest is on fire, and we are spraying a garden hose on a bush.”

If American politicians seem to be behind on this one, perhaps it is because technological progress has once again outpaced the political debate. On Capitol Hill, the China problem many politicians still fume about is cheap Chinese goods, ignoring the fact that China’s labor is no longer inexpensive. Others call for crackdowns on intellectual property theft, a problem that George W. Bush tried to tackle with his Chinese counterpart in the Great Hall of the People 15 years ago, and that Barack Obama and President Xi Jinping, then new as China’s president, declared they had solved five years ago.

Of course, they didn’t. China shifted its hacking operations from units of the People’s Liberation Army — some indicted by the Justice Department — to the Ministry of State Security. In recent days, the FBI has warned of broader surveillance and theft operations on American campuses, much of it aimed at coronavirus vaccines.

TikTok presented an entirely new problem, one that most policymakers in the United States had not contemplated before.

For the first time, a genuine Chinese app — not a knockoff of something invented in the United States or Europe — captured the hearts of American teenagers and millennials. On one level, it was harmless: TikTok is mostly jammed with one-minute dance videos. By many measures, it was a bigger parenting problem than a national security problem. Whatever it was, it clearly wasn’t on Washington’s radar the way that the expansion of China’s nuclear arsenal, or its actions in the South China Sea, dominate the China debate.

Yet as Brad Smith, president of Microsoft, which competed with Oracle to buy TikTok’s operations in the United States, noted, “there is a potential threat.” To make TikTok tick, the company collects vast amounts of data on Americans’ viewing habits. And the same algorithm that picks your next dance video could, in the future, pick a political video. (There is already more than a whiff of political content on the app.)

Like Oracle, Microsoft would have taken over the storage of all data on Americans, keeping it in the United States. (TikTok currently has a major data server in Virginia, but backs up data in Singapore.) But Microsoft’s bid went further: It would have owned the source code and algorithms from the first day of the acquisition, and over the course of a year moved their development entirely to the United States, with engineers vetted for “insider threats.”

So far, at least, Oracle has not declared how it would handle that issue. Nor did Trump in his announcement of the deal. Until they do, it will be impossible to know if Trump has achieved his objective: preventing Chinese engineers, perhaps under the influence of the state, from manipulating the code in ways that could censor, or manipulate, what American users see.

“If Oracle is providing hosting with the majority of engineering and operations staying with ByteDance, then the only effect of this deal was to swing billions of dollars of cloud revenue,” said Alex Stamos, who runs the Stanford Internet Observatory. “The details of the deal will really matter, and so far the public has not been provided with enough information to have an educated opinion.”

Without that issue resolved, it is unclear how Trump could declare that the security issues are solved, much less how he could say that the new entity “will have nothing to do with China.