Why the US government’s TikTok ban is impractical for the private sector

The warfare on TikTok has begun. Since President Biden accredited the ban on U.S. federal authorities workers downloading or utilizing TikTok on state-owned gadgets in December 2022, over two dozen states have determined to ban the app, as a result of issues over ByteDance’s knowledge assortment practices.

In each the general public and the non-public sector, there’s a rising concern that knowledge collected by the appliance could also be uncovered to the Chinese language Communist Get together (CCP). 

These issues are well-founded, with safety research from Internet 2-0 discovering that the info collected by TikTok is “overly intrusive” and “extreme,” gathering data from all the opposite apps on a person’s telephone. 

Now as organizations are left to think about whether or not to comply with the US authorities’s lead on banning TikTok altogether, it’s vital to guage whether or not banning social media apps is definitely sensible, significantly within the period of deliver your personal gadgets (BYOD), the place the road between private and work gadgets is usually non-existent. 

Analyzing the rationale behind the TikTok ban 

One of many principal causes for the nervousness over TikTok’s knowledge sharing practices is that the group admitted final 12 months that it shares the person knowledge of European residents’ with employees in China, Brazil, Canada, Israel, the U.S., and Singapore. 

Whereas the group insists these strategies are for sustaining the person expertise and are “acknowledged underneath the GDPR,” there may be nonetheless the potential for state entry, with ByteDance required to make its knowledge accessible to the CCP underneath Chinese law. 

Anxiousness over TikTok’s knowledge assortment practices additionally rose when leaked audio emerged from over 80 inside conferences, with 14 statements acknowledging that engineers in China had entry to the non-public knowledge of customers primarily based within the U.S. This controversy has reached the purpose the place the U.S. authorities has opted to ban the app altogether. 

“The potential TikTok bans are a part of a broader U.S. precedence to scale back safety dangers from China. Different applied sciences from Huawei, DJI, Hikvision, and so forth. are falling underneath comparable scrutiny and restrictions,” mentioned Bryan Ware, CEO of LookingGlass and former assistant director of cybersecurity at CISA. 

Nonetheless, the safety dangers of TikTok’s knowledge assortment processes aren’t simply related to the U.S. authorities, however are additionally one thing that organizations want to think about too. 

“These corporations and merchandise symbolize actual safety dangers and enterprise impacts, so enterprises mustn’t wait till ultimate determinations are in place to start limiting or managing their exposures or makes use of to TikTok and different Chinese language merchandise which have recognized safety implications,” Ware mentioned. 

How dangerous are the dangers? 

When it comes to sensible dangers, essentially the most regarding is that personal data collected via the app might find yourself within the palms of the CCP as a part of a nation-state surveillance operation. 

“Whereas some may argue that TikTok is harmful merely because of the impression of social media on the youthful technology, much more regarding is the very actual risk that the favored platform is supported by the Chinese language Communist Get together (CCP) and used to conduct affect operations, accumulating delicate private and biometric knowledge,” mentioned Matthew Marsden, vice chairman at Tanium. 

Marsden highlights that TikTok’s privateness coverage states the supplier “might acquire biometric identifiers and biometric data as outlined underneath U.S. legal guidelines, akin to faceprint and voice prints,” and publicly admits that it could additionally “share the entire data we acquire with a mother or father, subsidiary, or different affiliate of our company group.” 

“That is extremely regarding because the CCP can simply compel China-based corporations to share data to help get together targets,” Marsden mentioned. 

In impact, workers that use TikTok on work and private gadgets could possibly be leaving biometric data and different PII uncovered to nation-state actors. With the usage of biometric authentication growing, the gathering of biometric data could possibly be used to work round and exploit options sooner or later. 

The practicality of banning TikTok 

Though the U.S. authorities has already begun its crackdown on TikTok, banning utilization of the app utterly is tough to realize for organizations for quite a few causes. As an example, organizations want to have the ability to handle utilization on the utility degree to implement a ban. 

“A ban on TikTok, or any utility, wouldn’t be a easy coverage to implement. It requires a complete strategy to be put in place and enforced, which could possibly be a big endeavor for a corporation that’s not set as much as handle customers from a person utility perspective,” mentioned Barrett Lyon, cofounder and chief architect of Netography. 

Lyon highlights that almost all organizations don’t have the technical means or assets to outright ban an app, significantly when apps can change hostnames, community infrastructure, IP addresses or overlap on present CDNs that serve different vital purposes. 

On the similar time, the widespread nature of BYOD insurance policies signifies that lots of the private gadgets that workers use to carry out their features on daily basis aren’t managed by the safety crew. 

This implies the one choice can be to ban the usage of private gadgets, which is impractical for many organizations working in hybrid working environments.

So what can organizations do about TikTok? 

The best choice that enterprises have when mitigating the potential knowledge safety dangers of TikTok is to depend on person consciousness. In follow, which means educating workers on the safety dangers created by the app to allow them to resolve whether or not they wish to put their private data in danger or not. 

“Within the case of non-public gadgets being utilized in locations of employment, there may be little that could possibly be completed, apart from providing tips to workers,” mentioned safety evangelist at Checkmarx, Stephen Gates. 

“For instance, a ban on the utilization of TikTok when the non-public machine was linked to a corporation’s community could possibly be applied. However that’s practically not possible to implement as a result of encrypted site visitors, VPNs and the like,” Gates mentioned. 

It’s additionally vital for organizations to reevaluate whether or not a BYOD program is important for workers to carry out their features. This comes right down to assessing whether or not the flexibleness provided by BYOD outweighs the potential injury of knowledge being leaked to nation-state actors. 

Organizations that resolve to proceed working in BYOD environments in the end have to just accept a lack of management over the danger of apps harvesting private knowledge. 

“Should you enable workers to ‘deliver your personal machine’ (BYOD), then your management of that machine may be very restricted legally as a result of it’s not owned by the group, it’s owned by the worker,” defined Adam Marrè, former FBI cyber particular agent and present CISO at Arctic Wolf.