How TikTok could be spying on your child

Should you be concerned if your child is on TikTok? Photo / Getty Images

A young woman wearing hotpants shakes her barely clad derrière in front of the camera. It's impossible to determine her age: she's probably a teenager — she's certainly very young.

"I need some cold water now," is among the more innocuous of the comments. Another quips darkly: "If you gotta ask her age, she's too young."

Welcome to TikTok, the video-sharing platform whose content ranges from innocent, short clips of users lip-syncing and dancing to a variety of backing tracks to more worrying — potentially dangerous — pranks and content.

The platform, in which users typically share a short burst of content up to 60 seconds long, has taken the world of social media by storm (not least during the coronavirus lockdown), since it launched globally in 2017.

A measure of just how far it has come (it had 4.9 million UK users last year and predicts it will have more than 10 million by next year) is the presence among its users of Dame Judi Dench.

The 85-year-old Oscar-winner has appeared in a number of videos, showing off some socially distanced moves with her 23-year-old grandson Sam Williams, since lockdown began.

But like its social media cousins Facebook and Instagram, TikTok has been dogged by concerns about the safety of its users, in particular the risk posed to children by paedophiles. While the vast majority of users are young people in their 20s, and in theory users have to be 13 and over, it's easy to lie.

Yesterday, a disturbing newspaper investigation revealed users caught grooming children on the site were receiving paltry one-week suspensions. Leaked documents reportedly showed the company's policy for subscribers caught messaging children in a sexual way was to lock their account for seven days for a first offence, a month for the second and a permanent ban the third time.

The investigation followed a warning from children's charity Barnardo's, which last year said the popularity of live streaming services like TikTok was contributing to younger and younger children seeking help after being exploited online.

There is also growing, global concern about TikTok's connections with China's Communist regime (parent company ByteDance has its headquarters in Beijing).

What if the information gathered on that innocuous app on millions of British phones — data on where young users go, who they interact with and the messages they write — were to fall into the hands of a foreign power that wanted to use that data to its advantage, as relations between China and the West deteriorate? It doesn't bear thinking about.

Some of the most robust opposition to TikTok has come from the likes of U.S. Republican senator Josh Hawley, who last year called it "a company compromised by the Chinese Communist Party [that] knows where your children are, knows what they look like, what their voices sound like, what they're watching."

Then there was Steve Huffman, head of the social network Reddit, who described TikTok as "fundamentally parasitic", saying the way it tracked user behaviour was "truly terrifying".

The question of the privacy of UK TikTok users has grown with the eruption of hostilities over Huawei and Hong Kong after the UK Government's decision last week to ban the Chinese telecoms firm from the 5G network over security fears.

Last week it emerged that TikTok's parent company ByteDance had suspended talks to open a global headquarters in Britain and create 3000 jobs because of the "wider geopolitical context" — in other words the threat of a punishing economic war between London and Beijing over Huawei.

A guy on reddit reversed engineered #TikTok

Here’s what he found on the data it collects on you

It’s far worse than just stealing what’s on your clipboard: pic.twitter.com/oqaQyYDXT2

— Dan Okopnyi 🇺🇦 (@d1rtydan) June 28, 2020

In June, India, which accounts for 30 per cent of the app's total global downloads, banned TikTok and 50 other China-based apps, calling them a "threat to sovereignty and integrity".

The overwhelming concern, it would seem, is cyber-security. Today, a fierce critic of the company, US Secretary of State Mike Pompeo, will meet Boris Johnson and Foreign Secretary Dominic Raab in London to discuss issues including China and coronavirus.

He has threatened to ban ByteDance, and when asked by US broadcaster Fox News this month whether citizens should download TikTok he said: "Only if you want your private information in the hands of the Chinese Communist Party."

US President Donald Trump's political campaign has reportedly started running ads on Facebook and Instagram accusing the China-based platform of "spying" on its users (something it strongly refutes).

Quite how the President would go about carrying out a ban is unclear.

British politicians have now entered the fray, with former Tory Party leader Sir Iain Duncan Smith saying TikTok "has the ability to harvest data and is considered a security risk, not just in the UK and USA but in countries as diverse as India and Japan".

"ByteDance is considered an untrusted vendor and as such similar to Huawei. We need to treat it the same way we treat Huawei and ban it."

TikTok, which is incorporated in the Cayman Islands, has taken pains to distance itself from China, recently appointing an American as its chief executive and mooting the possibility of changes to its corporate structure that could underline its independence from ByteDance. It also insists it does not hand information to Beijing.

A spokeswoman told the Mail: "There's a lot of misinformation about TikTok out there but the fact is that millions of British users come to TikTok for entertainment, inspiration and connection. TikTok is led by an American CEO and the UK is one of our most important markets globally, with hundreds of employees, a senior leadership team and core business functions based out of our London office.

"We have no higher priority than promoting a safe and secure app experience for our users. TikTok UK user data is stored in the US and Singapore, and we have never provided user data to the Chinese government, nor would we do so if asked.

"There is zero truth to these accusations and we remain fully committed to investing in the UK and continuing to inspire creativity and bring joy to our users here."

In relation to concerns about child safety and predators, she said the firm had a "zero-tolerance policy" on child sexual abuse material and that suspected grooming behaviour was swiftly escalated, internally and externally. "Many of the claims brought to our attention refer to outdated practices, policies and processes that are no longer in place. Keeping people on TikTok safe is a top priority."

So just what is TikTok and what do we know of its Chinese connections? And should we really worry that our children are being spied on?

If you haven't heard of it, you can be sure your children or grandchildren have. In 2018, it was the world's fourth most downloaded app (655.8 million), ahead of Facebook, Instagram and Snapchat; in the first quarter of this year it was the most downloaded. It has 800 million users worldwide.

Its rise has been meteoric. The man behind the global spread of the phenomenon is 38-year-old tech billionaire Zhang Yiming, who set up ByteDance in 2012.

Zhang — China's 10th richest man with a personal wealth of £10.3 billion — has previously been named by the Chinese Communist Party as one of "100 outstanding private entrepreneurs" in China who "unswervingly go along the path of socialism with Chinese characteristics". The list has been described as a who's who of those in Beijing's good books.

Zhang, whose company owns a portfolio of other apps, already had a Chinese version of TikTok, named Douyin, under his belt when ByteDance bought it for £770 million in 2017 and merged it with TikTok, a move that made ByteDance the most valuable start-up firm in the world. With the tagline "make every second count", TikTok's video-only interface makes it more straightforward for users than Facebook or Twitter. Pranks, jokey clips, lip-syncing and dancing are TikTok's bread and butter — with special effects users can add to their content.

Clips were originally only 15 seconds long but can now be up to 60 seconds. Accounts are public by default, meaning anyone can see what has been posted until it is made private manually. Users can comment under videos and also send private messages when following each other.

An investigation into the app revealed some worrying trends. Photo / 123rf

As it mushroomed in popularity, so did concerns about just what information China might have access to. Critics claim that ByteDance, and by extension TikTok, could be compelled to supply information to the Chinese government because of its stringent state security laws.

Like most social media apps, TikTok collects personal information about its users by demanding access to their phone's camera, microphone, contact list and location using GPS tracking, and also (according to its terms and conditions) by location data from the device's SIM card and/or IP address. It starts collecting data from the moment the app is downloaded.

Users are warned it has full access to photos, videos and contact information of friends stored in the device's address book, unless you revoke permissions.

Cybersecurity firm American Lookout has warned that with China's history of surveillance on its own people, it could deploy similar tactics to monitor its adversaries abroad.

Christoph Hebeisen, director of security intelligence research, told the Mail that while social media companies are notorious for being "data hungry", the pertinent question is who wants access to that data.

"It becomes a question not just in relation to TikTok and the Chinese government but other social media firms and Western governments of who you trust with your data.

"What might be innocuous in itself — a 45-second dance video — could be mined and combined with data from other sources by security services to establish a pattern.

"Patterns of movement, in particular, could be extremely interesting and dangerous and potentially be used to blackmail somebody if they get into the wrong hands."

Certainly, TikTok has been the source of security flaws. Earlier this year experts found a major flaw (since patched) that could potentially allow an attacker to control someone else's account.

Security specialists graded it on a scale of 0 to 100, with 100 being the least private possible — TikTok's grade was 100.

Then there was the oddity of collected computers' IP and MAC addresses (unique forms of identification) that allowed it to track users, even if GPS was disabled.

TikTok took swift action and last week scored 45 out of 100.

Last year, another investigation found that moderators were guided by ByteDance to censor videos that mentioned Tiananmen Square, Tibetan independence and the banned religious group Falun Gong. TikTok says those policies were outdated and had been replaced.

Is there a genuine concern that TikTok could be compelled to share data gathered with the Chinese state? TikTok says no.

But its terms of service do stipulate that the company may share information with its parent, subsidiary or other affiliate.

US officials haven't provided any proof publicly that TikTok is sharing information with the Chinese government. Yet data fears have prompted the US Army to launch a review of TikTok, banning soldiers from using it.

TikTok has said it has instituted a full security review, insisting: "We are committed to respecting the privacy of our users and being transparent with our community and security experts about how our app works."

It has been keen to show that it is not simply a Chinese-owned firm but a global company.

But in the light of ructions over Huawei and ongoing tensions between China and the West, the clock may be ticking for TikTok.