Understanding the TikTok saga and what it means to Canada

At the beginning of August, President Donald Trump issued an executive order banning U.S. transactions with ByteDance, the Chinese-owned parent company of TikTok. This was predicated on the sale of TikTok and ByteDance’s other assets to be completed by Sept. 20. There has since been a one-week extension after Trump tentatively approved an Oracle-Walmart deal for stakes in TikTok just hours before the app was set to be removed from app stores.

TikTok is a short video-sharing app popularized by Gen Z internet users, or those roughly between the ages of 15 to 25. With its quick and flashy viral content and highly personalised algorithm, it had the highest engagement rate per post of any social media app in 2019. Today, it has 800 million monthly active users.

Microsoft was the first to confirm it was in talks with ByteDance back in August, joined by Walmart later in the month — but software company Oracle beat them to the punch and struck a deal with ByteDance on Sept. 13.

Microsoft was reportedly bidding on the app to harvest video data to fuel its AI ambitions — which made it even more important for them to have the AI algorithm technology included in the sale.

TikTok’s machine learning algorithm watches how you interact with videos, so you don’t have to click anything to express preferences — it guesses what you like based on how long you watch. The more you watch, the easier it can guess. Starting with ByteDance’s Chinese new aggregator Toutio in 2012, the company has had the opportunity to perfect the algorithm for years.

Buying the North American parts of TikTok means safely transferring millions of user’s data and 15 million lines of code. Oracle and Walmart’s pending deal will reportedly ensure that American users data is stored and processed in the United States.

Earlier this summer, Microsoft was in talks with ByteDance to buy TikTok in the United States, Canada, Australia and New Zealand. It is not clear whether Oracle is interested in a similar deal including Canadian data, or if their arrangement will do enough to address American national security concerns and stop the app from being banned.

Why Oracle?

Oracle is a software company primarily known for their JavaScript software, not consumer-facing social media apps. Oracle’s chairman, Larry Ellison, is a public supporter of Trump, which may further issues surrounding the public perception of this sale — especially when Trump made an unprecedented proclamation that the United StatesTreasury should get a “very big proportion” of the TikTok sale price. There is no law in the United States. to support this, although the Committee on Foreign Investment in the United States sometimes collects modest fees from companies to cover the cost of a national security review.

Ellison organized a fundraiser for Trump’s re-election campaign in February where supporters could pay $100,000 for a golf outing and photo-op with the president, which was protested by Oracle employees. Trump endorsed Oracle’s supposed bid for TikTok on Aug. 19.

Why does a multi-billion dollar software company want to buy a social media app? Experts say it’s data. TikTok’s customer data from it’s nearly 2 billion downloads are appealing as a source of revenue and information to improve marketing practices with or without an existing social media app. It could benefit Oracle’s “Data as a Service” business, which offers advertisers and data brokers access to user profiles.

Oracle has been making strides lately as it expands its massive data monetization operations — including marketing automation, cloud infrastructure and a partnership with Zoom at the beginning of the pandemic.

When it comes to advertising, almost half of TikTok’s users are 16 to 24, and the app’s young audience make up a valuable demographic that is getting harder to reach with traditional media.

Walmart initially joined the bidding war teamed up with Microsoft in late August. The big-box retailer is likely interested in TikTok’s e-commerce business, which is in its infancy but currently has 100 million users. 

TikTok racked up $7.4 billion globally worth of in-app spending in 2019 alone — but it’s unclear whether that will translate into the North American/Australian market. Walmart appears willing to take the risk to get a piece of the e-commerce market, which is still dominated by Amazon.  

Internet regionalism

Complicating matters for all parties involved is the fact that no one has ever split a global platform along regional lines. In India, the app was banned outright, with no signs that this ban will be lifted even if Oracle buys TikTok.

With 323 million downloads (excluding Chinese Android downloads), India was TikTok’s top market in 2019.

The current deal outlines that TikTok will split into another company, partly owned by Oracle and Walmart and based in the United States.

But this plan risks Trump’s disapproval — it’s not an outright sale, and could constitute a continued business relationship with ByteDance. Under Trump’s executive order, ByteDance has to sever its operations and assets in the United States. TikTok was already headquartered in California with “nominal independence” from Chinese operations, according to the Verge.

On the other hand, purchasing the app in select countries and splitting TikTok’s operations between an American buyer and ByteDance means that TikTok could become two apps with separate servers, codebases and users. Given the global nature of the app, splitting TikTok’s user base would mean fewer viewers and a smaller pool of revenue for any potential purchaser of the app.

The split would affect everyone who works with TikTok — from advertisers and influencers to employees and consumers.

It may even affect the effectiveness of the prized algorithm — with a smaller data set, the machine learning artificial intelligence will have possibly less content to “learn” from.

When it comes to internet regionalism, China doesn’t even have TikTok within its borders. ByteDance censors the content on Douyin, the company’s video-sharing app equivalent to TikTok in China, in accordance with the numerous and expansive censorship laws of Chinese authorities. Reports from The Telegraph in July revealed that Douyin used facial recognition technology to police foreigners.

The Globe and Mail reported in 2018 that Chinese police used data collected by government agencies to send people to re-education centres,which detain people for months at a time without charges, in China’s largely Muslim Uyghur region of Xinjiang.

Tim Wu — a law professor at Columbia University known for coining the phrase net neutrality — argued that the “asymmetry” of China’s censorship at home while its products enjoy unrestricted global access is unfair.

“The privilege of full internet access — the open internet — should be extended only to companies from countries that respect that openness themselves, ” Wu wrote in the New York Times on Aug. 18.

Nationally-enforced internet censorship is rare, but not unheard of in North America. Canada used its powers to block servers for the first time last year when a Canadian Federal court ordered ISPs to block a piracy service, amid censorship criticisms.

What does this mean for Canadians’ data?

This July, Public Safety Minister Bill Blair said that Canada would not ban TikTok. The same month, Liberal MP Nathaniel Erskine-Smith and NDP MP Charlie Angus said that there would need to be more evidence of misuse of personal information in order for a Canadian TikTok ban to go into effect.

The crux of all data collection concern is that ByteDance is based in Beijing — and current guidelines stemming from a deliberately vague 2017 Chinese Cybersecurity law mean that the Chinese government can compel companies to turn over their data.

While TikTok’s collection practices are consistent with Facebook, Google and other U.S. tech companies that use personal information for tailored ads, TikTok is currently the most prominent Chinese-owned social media app to reach such a global audience.

As laid out in TikTok’s privacy policy, the app collects internet or network activity including geolocation data, browsing and search history, information shared from third-party social network providers and behavioural information.

That means TikTok is able to use IP addresses and GPS coordinates to track users’ precise location at all times and assemble a behavioural profile. This may seem excessive — but TikTok is far from the only app to do this. Privacy policies for most major social media platforms include similarly all-encompassing language.

In March 2020, researchers found TikTok and 56 other apps using a vulnerability in Apple’s software to access clipboard data on users’ devices. TikTok has since disabled the function on iOS.

But in the hands of the Chinese government, the geolocation and search history aspects of TikTok’s data collection are of particular concern for national security. As Atlantic Council Fellow Justin Sherman wrote for Lawfare, location and search history on the phone of a federal employee could reveal everything from “the location of secret government facilities,” to personal activities to build files for blackmail. On Aug. 6, 2020, the U.S. Senate unanimously approved a bill banning federal employees from using TikTok on government-issued devices.

There is currently no such ban in Canada, and in the case that Oracle’s purchase is not approved, this could be a major decision point for Canada.

A Canadian TikTok ban is not guaranteed, as seen from the delicate political and economic balance Canada is still trying to strike as the only member of the Five Eyes intelligence-sharing network who hasn’t formally banned Chinese telecom company Huawei from 5G networks.

Huawei is anticipating action by the Canadian government, though, and has drawn up a “no-backdoor, no-spying” legal pledge in an attempt to prevent the ban. Canada may have to take a similar approach when it comes to TikTok.

Previous versions of TikTok’s privacy policy warned that TikTok could share information with Chinese businesses, law enforcement agencies and public authorities if required to do so. ByteDance was already compelled to shut down an app called Inside Jokes for “vulgar” content in April 2018, and to issue a letter of self-criticism. Currently, the policy says TikTok can share information with its parent companies, subsidiaries or other affiliates.

But China does not have real-time access to company TikTok’s data; and compliance often involves lengthy negotiations, with the government making manual requests and companies often pushing back.

The app has also been building its Canadian and U.S.teams since last year in an effort to distance itself from the Chinese government.

But even without TikTok complying with a hypothetical request for Canadian data from the Chinese government, experts and activists have highlighted the documented cases of Chinese interference in Canada for years — specifically targeting the Chinese-Canadian diaspora. In a 2019 report, the Canadian Security Intelligence Service identified Canada as a permissive target for Chinese interference.

Is a U.S.-owned TikTok better for Canadians?

NDP MP Charlie Angus told Yahoo Finance that if enough complaints were raised about TikTok, the issue should be handled by the Office of the Privacy Commissioner (OPC.) The OPC is currently seeking a court order for Facebook to correct its privacy practices and comply with Canadian privacy law.

Last year, after the Cambridge Analytica scandal, the OPC issued a joint investigation report about Facebook and their practice of sharing user information with third parties. The report found that the social media giant had violated Canadian privacy law by failing to obtain meaningful consent and having inadequate safeguards and accountability.

Without direct enforcement powers, the OPC’s only avenue to legally act on complaints is to initiate proceedings before Canada’s Federal court.

In the first nine months of 2018 alone, there were 3,676 reported breaches and data scandals including American fitness apps, marketing firms and even Panera bread.

And the United States has its own “comprehensive electronic surveillance infrastructure,” according to Stanford Law Professor Mark Lemley. In 2014, files provided by whistleblower Edward Snowden revealed that 90 per cent of communications intercepted by the National Security Agency for U.S. digital networks (NSA) were from ordinary American and Non-American Internet users — not legally targeted foreigners.

At the beginning of this year, Apple dropped its “end-to-end encryption” plans for iCloud Backup after the FBI complained that it would harm investigations — leaving the door open for Apple to turn material over to American authorities.

Oracle purchasing TikTok may bring Canadian user’s data to U.S servers and address concerns regarding Chinese surveillance, but Canadian policymakers also have to consider that there is no guarantee U.S. agencies are not doing the same.

What happens if TikTok is banned?

If the sale is not approved and the ban comes into effect, the United States government could order ISPs to block TikTok servers, but it is unprecedented on this scale. It is uncertain what would happen to the app that is already downloaded by millions of American and Canadian users — the existing downloads may remain functional, but government orders may stop access to updates like new features and bug fixes.

Specifically, the aspect of the order that bans “transactions” could affect software distributors like the Google Play Store or Apple’s App Store. Last week, when the executive orders were scheduled to go into effect, the U.S. Department of Commerce announced that TikTok would be removed from app stores in the United States.  To access TikTok after the ban, users could use a virtual private network or risk malware and download the app from third-party sites.

With shifting deadlines and no clear path forward, the TikTok saga continues for its hundreds of millions of users and 1,500 North American employees.

The app has been used for everything from a launchpad for Canadian talent — like Canadian  TikTok star Boman Martinez-Reid — to a coping mechanism for young people amidst COVID-19. If the app survives, it remains to be seen whether Oracle can recapture that sense of borderless community and continue the same user-friendly experience that Chinese technology built.

This article was originally published by the Rogers Cybersecure Catalyst at Ryerson University. A version appears here with permission.