Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Improper ‘shadow’ ads thriving on Facebook during India’s election

Bosses mandated them back to the office. They took legal action instead.

Election 2024 latest news: After big weekend in Palm Beach, Trump returns to N.Y. courtroom

How did we end up with a Biden-Trump matchup again?

Under Putin, a militarized new Russia rises to challenge U.S. and the West 

Noem explains inclusion of story about shooting pet dog

Eddie Rosario and Co. lead the Nats to an MLB-best 12th comeback win

CJ Abrams keeps getting better. It’s time to think about an extension.

Sloppy first inning dooms the Nationals in a 6-3 loss to the Blue Jays

Kim Godwin steps down suddenly as president of ABC News

The ‘Access Hollywood’ video cemented Trump’s air of invincibility

The New York Times, alone in its outrage over access to Biden

Strangers help Sesame Street puppeteer after heirloom necklace was stolen

Teen grabs wheel when driver passes out and school bus veers into traffic

Cat climbed into Amazon return box, found alive 630 miles away

Trump’s vice presidential supplicants toe the line on election fraud

The Trump-Biden battle over the 2017 tax cut

Carolyn Hax: Sisters were close — then one accused the other’s husband of abuse

Miss Manners: I’m bothered by a fellow guest not touching their dessert

Ask Amy: My estranged wife is telling my son I’m an adulterer

Don’t be a jerk at the airport: A guide for headphones

The new cure-all for vacation excess: the IV drip 

What’s the best bus to New York? We tested 5 for comfort and value.

Russia is using toxic chemical weapons, wrecking a ban it helped create

There’s still time for Congress to Trump-proof the Insurrection Act 

The Post endorses April McClain Delaney and Tom Royals for Maryland’s 6th District

How TikTok changed fashion

Book excerpt: The admiral who had a mental breakdown over Fat Leonard

How Pope Francis opened the Vatican to transgender sex workers

That time football legend, rig-driving eligible bachelor Biden was arrested

Trump and allies say Biden pays rent for ‘illegals’ in Michigan. Not true.

Historic floods kill 83, leaving Brazil and its president shaken, angry

Missing surfers from U.S., Australia confirmed dead by Mexico

We reported for months on changes sweeping Russia. Here’s what we found.  

Trump hush money trial live updates: Witness testimony to continue

Former US president Trump's hush money criminal trial continues in New York City, USA - 06 May 2024

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Drew Angerer

A former risk manager at TikTok has met with congressional investigators to share his concerns that the company’s plan for protecting United States user data is deeply flawed, pointing to evidence that could inflame lawmakers’ suspicion of the app at a moment when many are considering a nationwide ban.

In an exclusive interview with The Washington Post, the former employee, who worked for six months in the company’s Trust and Safety division ending in early 2022, said the issues could leave data from TikTok’s more than 100 million U.S. users exposed to China-based employees of its parent company ByteDance, even as the company races to implement new safety rules walling off domestic user information.

His allegations threaten to undermine this $1.5 billion restructuring plan, known as Project Texas, which TikTok has promoted widely in Washington as a way to neutralize the risk of data theft or misuse by the Chinese government.

They could also fuel speculation that the wildly popular short-video app remains vulnerable to having its video-recommendation algorithm and user data distorted for propaganda or espionage. Authorities in the United States have not shared evidence that the Chinese government has accessed TikTok’s data or code.

TikTok and ByteDance officials have <a href="https://www.washingtonpost.com/technology/2019/11/01/us-government-investigating-tiktok-over-national-security-concerns/" target="_blank">since 2019</a> been negotiating with a group of federal officials, known as the Committee on Foreign Investment in the United States, about which privacy standards and technical safeguards they’d need to adopt to satisfy U.S. national-security concerns. The company finalized its proposal in August and presented it to CFIUS, but it has yet to be approved, and CFIUS officials have declined to explain why.

The former employee, who spoke on the condition of anonymity because of fear of retaliation, has told congressional investigators that Project Texas does not go far enough and that a truly leakproof arrangement for Americans’ data would require a “complete re-engineering” of how TikTok is run.

As one piece of evidence, he shared with The Post a snippet of code he said showed that TikTok could connect with systems linked to Toutiao, a popular Chinese news app run by ByteDance. That connection, he said, could allow for surreptitious interference in the flow of U.S. data.

TikTok officials said the former employee has misconstrued the plan and that his termination, months before it was finalized, means he “would have no knowledge of the current status of Project Texas and the many significant milestones the initiative has reached over the last year.”

His Toutiao allegation was “unfounded,” they said, and the code snippet he shared did not indicate any correlation or connectivity between the two apps. The Toutiao code, they said, does not link back to China and is “nothing more than a naming convention and technical relic” harking back to ByteDance’s first successful app.

Officials also said they have already adopted one key pledge of Project Texas by moving U.S. user data and other critical code to servers run by the American tech giant Oracle — a move, they said, that would further undermine the claim that Toutiao officials could have any influence on TikTok’s U.S. content or operations.

The former employee’s ability to secure meetings with key senators’ staff reinforces the expansiveness of Washington’s interest in a youth-beloved app best known for its viral dances and challenges. TikTok’s chief executive Shou Zi Chew probably will be grilled on Project Texas and the possibility of Chinese influence during a congressional hearing later this month.

His visits in Washington are also timed to accelerating concern about TikTok, including two recent legislative pushes that could lead to an unprecedented nationwide app ban. The former employee said he had met with staff in the offices of Sens. Charles E. Grassley (R-Iowa) and Mark R. Warner (D-Va.). Representatives from both offices confirmed the meetings but declined further comment.

Sen. Warner and a bipartisan group of senators on Tuesday proposed a bill that would give the Commerce Department a <a href="https://www.washingtonpost.com/technology/2023/03/07/tiktok-ban-senate-proposal/" target=_blank>direct path</a> to banning TikTok and other apps with foreign owners following a “risk-based” assessment. Another bill advanced by the House Foreign Affairs Committee last week would let President Biden ban TikTok outright.

The White House said Wednesday it supported Warner’s bill but was also waiting for the CFIUS negotiations to conclude. More than two dozen states have passed measures <a href="https://www.washingtonpost.com/technology/2023/01/20/tiktok-bans-states-colleges/" target=_blank>banning TikTok</a> on government-owned devices, but a 2020 <a href="https://www.washingtonpost.com/technology/2020/09/20/wechat-ban-blocked-trump/" target=_blank>federal court ruling</a> — and a growing group of civil-liberties activists and congressional Democrats — have argued that a nationwide ban would violate Americans’ First Amendment protections against any government law limiting freedom of speech.

As states ban TikTok on government devices, evidence of harm is thin

The former employee worked as head of a unit within TikTok’s Safety Operations team, which oversaw technical risk management and compliance issues, including which employees had access to company tools and user data, according to documents he shared with The Post.

He argues that a nationwide ban would be unnecessary to resolve the technical concerns, which he said could be fixed with “doable and feasible” solutions that would go beyond Project Texas’s protocols. He said he worked to address the data-privacy issues internally but was fired after raising his concerns.

In a December letter to TikTok’s CEO, Chew, which he shared with The Post, the former employee wrote that senior managers were “responsible for the internal fraud pertaining to implementation of Project Texas,” which he said involved them “intentionally lying” to U.S. government officials about how its controls had been tested and verified.

“Various TikTok executives were unduly pressuring me to sign off on Project Texas as if it was something accomplished [a] long time ago,” he wrote. He demanded a “rapid internal investigation to ensure true risk management and my reinstatement.”

ByteDance’s head of global legal compliance acknowledged receiving his letter of concerns and said the company would “review them with expediency,” according to a copy of the email reviewed by The Post. The company, he said, has not offered any updates since.

The former employee said he has not yet filed an official whistleblower complaint with the SEC, and his claims have not been corroborated by an official investigation.

He said he is also separate from an alleged whistleblower referenced in a Tuesday letter that Sen. Josh Hawley (R-Mo.) sent to the Treasury Department, <a href="https://www.axios.com/2023/03/08/senators-tiktok-whistleblower-alleges-data-abuses" target=_blank>first reported</a> by Axios. That person said TikTok’s data-access controls were “superficial” and that China-based engineers could use tools to access U.S. data with “the click of a button,” wrote Hawley, one of TikTok’s biggest critics in Congress. Those claims have also not been verified.

TikTok officials said in a statement Wednesday that the “analytic tools” did not grant direct access to data and that protected U.S. information is now stored on Oracle servers where it can be accessed only in “limited, monitored circumstances.”

As Washington wavers on TikTok, Beijing exerts control

Project Texas would wall off TikTok’s U.S. operations into a new subsidiary, TikTok U.S. Data Security, whose leaders would be vetted by the U.S. government and report to CFIUS, according to briefings the company has given to researchers, journalists and members of Congress.

All U.S. user data would be siloed in a system with monitored gateways for authorized use, according to the plan, and TikTok’s code and recommendation algorithms would be reviewed by engineers from Oracle, who could alert U.S. regulators to possible concerns.

Some briefed on the plan have commended its rigor, including Samm Sacks, a senior fellow at Yale Law School’s Paul Tsai China Center, who said it reflected a serious effort that would give the U.S. government an unprecedented level of supervision and control into how the company works.

“If it’s not working, if there’s data leakage or content that’s problematic, TikTok would be subject to more oversight than any social media company operating in the U.S.,” she said.

But skeptics have argued that no technical safeguard can protect from ByteDance’s ownership, which they say could pressure TikTok managers to censor inconvenient topics, boost pro-government messages or introduce vulnerabilities through lines of code. TikTok employees <a href="https://www.washingtonpost.com/technology/interactive/2022/bytedance-tiktok-privacy-china/" target=_blank>told</a> The Post last year that ByteDance teams in Beijing worked on design, engineering and software tools that they relied on for daily operations.

If Project Texas is rejected, some members of Congress have argued that the only solution would be to force ByteDance to sell TikTok to an American buyer — an idea, first floated by the Trump administration, that TikTok’s supporters have compared to hostage-taking. Government authorities in Beijing used export laws to block the Trump proposal in 2020 and could do so again.

TikTok can collect a large range of user data, including video viewing histories, email addresses and contacts, though American tech giants such as Facebook and Google gather even more, including precise GPS locations, extensive biographical details and web-browsing histories, according to a Post <a href="https://www.washingtonpost.com/technology/2023/02/03/tiktok-delete-advice/" target=_blank>review</a> last month.

Is TikTok really giving your data to China?

Chinese government authorities can, by law, compel tech companies to hand over user data to support “national intelligence” work. TikTok has argued that Americans’ information would not be subject to that law because it is stored in servers in the U.S. and Singapore.

Critics of a ban have argued it would violate Americans’ free-speech rights and fail to address the bigger need for a national law restricting how personal data is collected by all apps, not just TikTok. The digital rights group Fight for the Future <a href="https://www.fightforthefuture.org/news/2023-02-28-new-dontbantiktok-campaign-calls-for-privacy-legislation-instead-of-hypocrisy-and-censorship" target=_blank>said</a> in a statement last month that the ban proposal amounted to “xenophobic showboating that does exactly nothing to protect anyone.”

The former employee’s claims match those from a source who shared hours of internal meeting recordings, <a href="https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access" target=_blank>first reported</a> by BuzzFeed last year, in which company employees said they were working to close up ways in which U.S. data could be accessed by employees in China, in line with their CFIUS proposal.

Following that report, an internal ByteDance team used TikTok data such as users’ IP addresses, which offer a general estimate of their location, in an attempt to identify how company information had been leaked. The attempt failed, according to ByteDance officials, who <a href="https://www.washingtonpost.com/technology/2022/12/22/tiktoks-chinese-owner-fires-workers-who-gathered-data-journalists/?itid=lk_inline_manual_56" target=_blank>announced </a>the attempt in December and said the four employees involved in the effort had been fired.

Chew, who <a href="https://www.washingtonpost.com/technology/2023/02/15/ceo-tiktok-exclusive-interview/" target=_blank>met </a>with The Post last month during a cross-Washington charm offensive, said the company was restructuring its internal-audit team and working to explain its safety controls to skeptical lawmakers and regulators. The scandal, he said, threatened to “erode all the work that we have done.”

Finalist for the Livingston Award in 2022. Member of the "Pegasus Project" team that won a George Polk Award in 2021. 

University of Florida

Drew Harwell is a reporter for The Washington Post covering technology. He was a member of an international reporting team that won a George Polk Award in 2021.

Drew Harwell

washpost

TikTok's data security plan is 'deeply flawed,' whistleblower claims

the-washington-post

Senate Intelligence Committee Hears Testimony On Worldwide Threats To The U.S.

Staff