How is Congress handling the TikTok conundrum?

The potential security implications of China’s corporate control of TikTok’s parent company ByteDance have scaled up in recent years as U.S.-China relations have soured and China has expanded its domestic social, political, and economic controls. But Congress’ potential answer — the RESTRICT Act — has its flaws. Cam Kerry examines TikTok’s challenges, other ways to address its security concerns beyond an outright ban, and the need for comprehensive privacy legislation.

Related reading:

• TikTok bans won’t guarantee consumer safety
• What U.S. policymakers can learn from the European decision on personalized ads

Listen to Brookings podcasts here, on Apple or Google podcasts or on Spotify, send email feedback to [email protected].

Thanks to audio engineer Gaston Reboredo.

TRANSCRIPT

PITA: At the end of March, TikTok CEO Shou Zi Chew was called to Congress to testify on the social media platform’s collection of and use of user data. Specifically, whether that data is vulnerable to being exploited by the Chinese government. Congress has introduced new legislation to address these national security implications, including one bill known as the RESTRICT Act.

With us to discuss the security and data privacy concerns raised by TikTok and other social media platforms and how the federal government is responding is Cameron Kerry, the Ann R. and Andrew H. Tisch distinguished visiting fellow with the Center for Technology Innovation here at Brookings, also former acting secretary and general counsel at the Department of Commerce in the Obama administration. Cam, thanks so much for talking to us today.

KERRY: Thanks, Adrianna. Great to join you today.

PITA: Wonderful. Well, let’s start with the national security question. The concerns raised by TikTok’s parent company, ByteDance, being a Chinese corporation have circulated for several years now. Some Western governments, including the U.S. and Canada, have banned the platform from government devices. Are these concerns credible to you, and what have we seen TikTok and or Bytedance do in response to them?

KERRY: So I do think that they are credible concerns, yes. When I was at the Department of Commerce, I made the decision to exclude two Chinese communications companies, Huawei and ZTE, from testing by Commerce agencies to be used in public safety communications networks. And I did that not based on specific information that they were somehow acting as agents of the Chinese government, but that there was a risk that if tasked by the government, that they would respond. And ten plus years on, those risks have only increased dramatically because of the increase in Chinese social and political control across its economy and society, the increase in its control over private companies, and a set of laws, national security law and other laws affecting data and communications that really give the government significant powers over communications companies and over the data that they collect and significant access to that data. So those risks are very real. And I think there is an added risk by just the scale. We hope that we will never come to a conflict with China. But there is the potential that TikTok could become a tool of information warfare if adversarial relationships ramp up.

PITA: I think TikTok has taken a couple of steps or has talked about taking steps in the future to try and ameliorate some of these concerns. What is it that they’ve done?

KERRY: Sure. TikTok has set up something that they’re calling Project Texas. It’s designed to significantly wall off its parent company, ByteDance, from the data, from the algorithms, by putting American personnel in charge and really giving the day operations of the systems, the control, the management of the data to Oracle, an American company. And I think that does do something to mitigate the risk. But the problem is that ByteDance still has the legal control over TikTok. The CEO reports to Bytedance and Chinese government has, as I’ve talked about, significant control over ByteDance, including it gets a seat on board.

PITA: All right. So let’s look at some of what Congress has done in response to some of these concerns. The RESTRICT Act is one of the most recent pieces of legislation. That stands for Restricting the Emergence of Security Threats That Risk Information and Communications Technology. This is a bipartisan piece of legislation from Senators Warner and Thune, and it’s stated that it’s intended to, quote, “address the ongoing threat posed by technology from foreign adversaries.” What can you tell us about what’s in this bill and what it sets out to do?

KERRY: Sure. Well, first, that title is a mouthful and it’s an entry in the congressional sweepstakes for the most far-fetched title for acronym for legislation, or the most strained acronym for any bill. But essentially what it would do would give the secretary of commerce the authority to prohibit ownership or put in place measurements to insulate against ownership of companies doing business in America that are owned from so-called foreign adversaries, which, the list could be expanded or contracted, but it specifically includes China in addition to Iran, Cuba, North Korea, Russia, and Venezuela. This is, so, an expansion of existing authorities. It’s kind of a blend of the current Committee on Foreign Investment in U.S. – CFIUS – that’s currently reviewing ByteDance’s ownership of TikTok in the U.S., as well as authority that already exists for the secretary of commerce to investigate and recommend to the president the exclusion of certain imports on national security grounds. But this beefs up those authorities and tries to broaden them, because when the Trump administration tried to ban TikTok, it lost in court on First Amendment grounds. So this bill is an effort to try to ramp that up.

PITA: There are some concerns from some, including the ACLU, the Electronic Frontier Foundation, that the act is overbroad, including some characterization of it as the Patriot Act for the internet. What’s your take on the scope of its powers and its effectiveness?

KERRY: Well, I do think that there are legitimate First Amendment issues here. There are 150 million U.S. users of TikTok. And the Supreme Court has said in the past that under our First Amendment includes not only the freedom of expression, freedom of the press, but also the right of people to receive information. That’s part of the two-way street of communications. But it’s also a vehicle for some significant part of those 150 million people to express themselves.

I do think that there may be ways to deal with the security issues that I talked about with something less than a ban on TikTok, the app. We’ve seen in the past, for example, in Germany after the Snowden revelations, concerns about U.S. companies, some parallels with the concerns about TikTok, because of U.S. government surveillance. Microsoft set up an arrangement to put its German data centers into a trust arrangement with Deutsche Telekom in charge. And what a trust arrangement would do would separate the legal control that ByteDance currently has from the beneficial interest, in other words just from the ability to earn revenue, it would be a completely passive investor and all of the legal control could be in U.S. hands.

PITA: All right. There’s also some additional thought that while all the headlines or a lot of the headlines at least have been about the national security concern about whether China has access to this data. But plenty of tech experts are pointing to more broader data privacy concerns for users that TikTok is really not that different from Meta — Facebook, Instagram — or Google in terms of this scale of the data that they collect and how that data is used. Should this data privacy aspect be a bigger concern? And what sort of action have we seen from Congress or federal agencies in that regard?

KERRY: Look, I think that is a major concern. TikTok is able to collect the data it has because there are no boundaries on the data that TikTok or other platforms can collect under our laws. It’s something that not just outside experts, but a number of members of Congress have pointed out as well, certainly something that the committee leaders brought up in the TikTok hearing in the House and in the Senate. Senator Maria Cantwell from Washington, who heads the committee, would have to review the RESTRICT Act, said it’s a fine idea, but we really need privacy legislation. So Senator Cantwell, I hope, will use her power as the chair to move some privacy legislation forward; it’s something she’s worked on, but she hasn’t brought a bill to markup. We did see a bill, the American Data Privacy Protection Act to get reported out to the House of Representatives, a bill that was sponsored by the leaders of the House committee who brought up privacy during the TikTok hearing. So certainly they will hopefully move forward, try to move that same bill again. It didn’t pass in the lame duck, but hopefully can pick up where Congress left off in the last session and we can get a comprehensive national privacy law that will put some boundaries around the data that companies like TikTok, Meta, and thousands of others in this country can collect, can use, and can share, you know, really do live up to individual expectations that data about them is going to be used in ways that’s appropriate, consistent with their expectations.

PITA: All right. Cam, thanks so much for talking to us today and explaining some of this.

KERRY: Well, thank you. My pleasure.