The federal treasurer says he is concerned that Chinese employees of the social networking platform TikTok will be able to access data from Australian users.
Key points:
- TikTok has confirmed that employees based in China can access Australian data
- Chinese cybersecurity laws force social media companies to provide information if asked
- The company says its U.S.-based security team limits access to data only to employees who need it.
In response to a letter from shadow cybersecurity minister James Paterson, TikTok admitted that its staff in China were able to access Australian data.
“Our security teams minimize the number of people who have access to data and limit it only to people who need that access to do their job,” wrote the company’s Australian director of public policy, Brent Thomas.
“We have policies and procedures that limit internal access to Australian user data by our employees, wherever they are, as needed.
“We have never provided data on Australian users to the Chinese government, the Chinese government has never asked us for data on Australian users and we would not provide it if they asked us to.”
Loading
The letter comes after reports in the US media that TikTok’s US data could be accessed and mainland China had been accessed.
Senator Paterson said TikTok’s claim that Australian data could not be compromised was not credible.
“TikTok denies that they would ever hand over data to the Chinese Communist Party, but that is very hard to believe given their national security laws,” he wrote.
“It is time for the Albanian government to wake up and take steps to protect the privacy of 7 million Australian users.”
Treasurer Jim Chalmers told TikTok users to be careful about what they did on the platform.
“These concerns have been there for a long time, and we take advice from our various national security agencies,” Chalmers said.
“Australians need to be careful online and we need to recognize the risks of participating in some of these platforms.”
Chinese law requires TikTok to share user data
Chinese cybersecurity laws require Chinese companies to store certain data and allow Chinese authorities to conduct timely checks on their operations.
Laws also require social media companies to provide information if Beijing requests it.
TikTok’s Australian data is held on servers in the US and Singapore, and its security team, which provides authorizations, is based in the United States.
Thomas wrote that the integrity of Australian data was of the “utmost importance” and was the core of his day-to-day operations.
Fergus Ryan, a cybersecurity expert at the Institute for Strategic Policy in Australia, said the social media platform’s claim that it does not share data with Beijing is unbelievable.
“They can’t [refuse an order for data]and beyond that, if the Chinese authorities tried to access any of the data they had collected … TikTok and Bytedance, the parent company, would not be legally allowed to talk about the fact that they had accessed the data, “Mr. Ryan said.
Ryan said that over the years Beijing “has shown that it has an insatiable appetite for data,” and that the Australian data collected by TikTok could be used to help create “vivid” profiles of people’s lives.
“It’s up to individual TikTok users to decide for themselves how far they are with their data accessible from China,” Ryan said.
“But for TikTok users to make that decision, TikTok needs to be honest about the fact that their data is accessible from and accessed from China.
“There are TikTok users who could now be teenagers, but in a few years they could be working in sensitive areas of the Australian government, for example.”
Ryan said that while the federal government should not rule out a ban on the platform, former U.S. President Donald Trump’s attempt to do so has shown that bans don’t always work.
Rather, the government should consider introducing regulations that require the platform to be transparent with its data and tag content affiliated with the state of China.