Banning TikTok – Schneier on Security

Banning
TikTok

Congress
is
currently

debating

bills
that
would
ban
TikTok
in
the
United
States.
We
are
here
as
technologists
to
tell
you
that
this
is
a
terrible
idea
and
the
side
effects
would
be
intolerable.
Details
matter.

Banning
TikTok

Congress
is
currently

debating


bills

that
would
ban
TikTok
in
the
United
States.
We
are
here
as
technologists
to
tell
you
that
this
is
a
terrible
idea
and
the
side
effects
would
be
intolerable.
Details
matter.
There
are
several
ways
Congress
might
ban
TikTok,
each
with
different
efficacies
and
side
effects.
In
the
end,
all
the
effective
ones
would
destroy
the
free
Internet
as
we
know
it.

There’s
no
doubt
that
TikTok
and
ByteDance,
the
company
that
owns
it,
are
shady.
They,
like
most
large
corporations
in
China,
operate
at
the
pleasure
of
the
Chinese
government.
They
collect
extreme
levels
of
information
about
users.
But
they’re
not
alone:
Many
apps
you
use
do
the
same,
including
Facebook
and
Instagram,
along
with
seemingly
innocuous
apps
that
have
no
need
for
the
data.
Your
data
is
bought
and
sold
by
data
brokers
you’ve
never
heard
of
who
have
few
scruples
about
where
the
data
ends
up.
They
have
digital
dossiers
on
most
people
in
the
United
States.

If
we
want
to
address
the
real
problem,
we
need
to
enact
serious
privacy
laws,
not
security
theater,
to
stop
our
data
from
being
collected,
analyzed,
and
sold—by
anyone.
Such
laws
would
protect
us
in
the
long
term,
and
not
just
from
the
app
of
the
week.
They
would
also
prevent
data
breaches
and
ransomware
attacks
from
spilling
our
data
out
into
the
digital
underworld,
including
hacker
message
boards
and
chat
servers,
hostile
state
actors,
and
outside
hacker
groups.
And,
most
importantly,
they
would
be
compatible
with
our
bedrock
values
of
free
speech
and
commerce,
which
Congress’s
current
strategies
are
not.

At
best,
the
TikTok
ban
considered
by
Congress
would
be
ineffective;
at
worst,
a
ban
would
force
us
to
either
adopt
China’s
censorship
technology
or
create
our
own
equivalent.
The
simplest
approach,

advocated
by
some
in
Congress
,
would
be
to
ban
the
TikTok
app
from
the
Apple
and
Google
app
stores.
This
would
immediately
stop
new
updates
for
current
users
and
prevent
new
users
from
signing
up.
To
be
clear,
this
would
not
reach
into
phones
and
remove
the
app.
Nor
would
it
prevent
Americans
from
installing
TikTok
on
their
phones;
they
would
still
be
able
to
get
it
from
sites
outside
of
the
United
States.
Android
users
have
long
been
able
to
use
alternative
app
repositories.
Apple
maintains
a
tighter
control
over
what
apps
are
allowed
on
its
phones,
so
users
would
have
to
“jailbreak”—or
manually
remove
restrictions
from—their
devices
to
install
TikTok.

Even
if
app
access
were
no
longer
an
option,
TikTok
would
still
be
available
more
broadly.
It
is
currently,
and
would
still
be,
accessible
from
browsers,
whether
on
a
phone
or
a
laptop.
As
long
as
the
TikTok
website
is
hosted
on
servers
outside
of
the
United
States,
the
ban
would
not
affect
browser
access.

Alternatively,
Congress
might
take
a
financial
approach
and
ban
US
companies
from
doing
business
with
ByteDance.
Then-President
Donald
Trump

tried
this

in
2020,
but
it
was

blocked

by
the
courts
and

rescinded

by
President
Joe
Biden
a
year
later.
This
would
shut
off
access
to
TikTok
in
app
stores
and
also
cut
ByteDance
off
from
the
resources
it
needs
to
run
TikTok.
US
cloud-computing
and
content-distribution
networks
would
no
longer
distribute
TikTok
videos,
collect
user
data,
or
run
analytics.
US
advertisers—and
this
is
critical—could
no
longer
fork
over
dollars
to
ByteDance
in
the
hopes
of
getting
a
few
seconds
of
a
user’s
attention.
TikTok,
for
all
practical
purposes,
would
cease
to
be
a
business
in
the
United
States.

But
Americans
would
still
be
able
to
access
TikTok
through
the
loopholes
discussed
above.
And
they
will:
TikTok
is
one
of
the
most
popular
apps
ever
made;
about

70%

of
young
people
use
it.
There
would
be
enormous
demand
for
workarounds.
ByteDance
could
choose
to
move
its
US-centric
services
right
over
the
border
to
Canada,
still
within
reach
of
American
users.
Videos
would
load
slightly
slower,
but
for
today’s
TikTok
users,
it
would
probably
be
acceptable.
Without
US
advertisers
ByteDance
wouldn’t
make
much
money,
but
it
has
operated
at
a
loss
for
many
years,
so
this
wouldn’t
be
its
death
knell.

Finally,
an
even
more
restrictive
approach
Congress
might
take
is
actually
the
most
dangerous:
dangerous
to
Americans,
not
to
TikTok.
Congress
might
ban
the
use
of
TikTok
by
anyone
in
the
United
States.
The
Trump
executive
order
would
likely
have
had
this
effect,
were
it
allowed
to
take
effect.
It
required
that
US
companies
not
engage
in
any
sort
of
transaction
with
TikTok
and
prohibited
circumventing
the
ban.
.
If
the
same
restrictions
were
enacted
by
Congress
instead,
such
a
policy
would
leave
business
or
technical
implementation
details
to
US
companies,
enforced
through
a
variety
of
law
enforcement
agencies.

This
would
be
an
enormous
change
in
how
the
Internet
works
in
the
United
States.
Unlike
authoritarian
states
such
as
China,
the
US
has
a
free,
uncensored
Internet.
We
have
no
technical
ability
to
ban
sites
the
government
doesn’t
like.
Ironically,
a
blanket
ban
on
the
use
of
TikTok
would
necessitate
a
national
firewall,
like
the
one
China
currently
has,
to
spy
on
and
censor
Americans’
access
to
the
Internet.
Or,
at
the
least,
authoritarian
government
powers
like
India’s,
which
could
force
Internet
service
providers
to
censor
Internet
traffic.
Worse
still,
the
main
vendors
of
this
censorship
technology
are
in
those
authoritarian
states.
China,
for
example,
sells
its
firewall
technology
to
other
censorship-loving
autocracies
such
as

Iran

and

Cuba
.

All
of
these
proposed
solutions
raise
constitutional
issues
as
well.
The
First
Amendment

protects
speech

and

assembly
.
For
example,
the
recently
introduced

Buck-Hawley
bill
,
which
instructs
the
president
to
use
emergency
powers
to
ban
TikTok,
might
threaten
separation
of
powers
and
may
be
relying
on
the
same
mechanisms
used
by
Trump
and
stopped
by
the
court.
(Those
specific
emergency
powers,
provided
by
the
International
Emergency
Economic
Powers
Act,
have
a
specific
exemption
for
communications
services.)
And
individual
states
trying
to
beat
Congress
to
the
punch

in
regulating
TikTok
or
social
media
generally

might
violate
the
Constitution’s
Commerce
Clause—which
restricts
individual
states
from
regulating
interstate
commerce—in
doing
so.

Right
now,
there’s
nothing
to

stop

Americans’
data
from
ending
up
overseas.
We’ve
seen
plenty
of
instances—from

Zoom

to

Clubhouse

to

others
—where
data
about
Americans
collected
by
US
companies
ends
up
in
China,
not
by
accident
but
because
of
how
those
companies
managed
their
data.
And
the
Chinese
government
regularly
steals
data
from
US
organizations
for
its
own
use:

Equifax
,

Marriott
Hotels
,
and
the

Office
of
Personnel
Management

are
examples.

If
we
want
to
get
serious
about
protecting
national
security,
we
have
to
get
serious
about
data
privacy.
Today,
data
surveillance
is
the
business
model
of
the
Internet.
Our
personal
lives
have
turned
into
data;
it’s
not
possible
to
block
it
at
our
national
borders.
Our
data
has
no
nationality,
no
cost
to
copy,
and,
currently,
little
legal
protection.
Like
water,
it
finds
every
crack
and
flows
to
every
low
place.
TikTok
won’t
be
the
last
app
or
service
from
abroad
that
becomes
popular,
and
it
is
distressingly
ordinary
in
terms
of
how
much
it
spies
on
us.
Personal
privacy
is
now
a
matter
of
national
security.
That
needs
to
be
part
of
any
debate
about
banning
TikTok.

This
essay
was
written
with
Barath
Raghavan,
and

previously
appeared
in

Foreign
Policy
.


,
,
,

About Author

Subscribe To InfoSec Today News

You have successfully subscribed to the newsletter

There was an error while trying to send your request. Please try again.

World Wide Crypto will use the information you provide on this form to be in touch with you and to provide updates and marketing.