TikTok has presented a detailed proposal to a secretive federal panel that will decide its future in the U.S. that relies extensively on the American tech giant Oracle to mitigate perceived security risks of the viral video app.
A TikTok official speaking on condition of anonymity described the company’s proposal to the Committee on Foreign Investment in the United States to CyberScoop. Aspects of the proposal, known as Project Texas (a likely reference to Oracle’s Austin headquarters), have been previously reported and briefed to members of civil society, but as negotiations have stalled with CFIUS, which will decide whether the company can continue to operate in the U.S., the company has begun to describe the proposal in greater technical detail.
Under the terms of the proposal, TikTok would divulge core segments of its technology to Oracle and a set of third-party auditors who would verify that the app is not promoting content in line with Beijing’s wishes or sharing U.S. user data with China.
“Project Texas effort clearly reflects a serious effort to address U.S. government concerns and has been informed by years of negotiation,” said Samm Sacks, a senior fellow at Yale Law School’s Paul Tsai China Center who has been briefed on the plan. “My key takeaway is that you don’t have to trust TikTok or the Chinese government, because at least from what I can understand of the contours of this plan is that the U.S. government would have the ultimate oversight and monitoring of compliance with whatever they agree to.”
The proposal from TikTok, which is owned by the Chinese company ByteDance, represents an attempt to end a battle between TikTok and the U.S. government dating back to the Trump administration over whether it represents a national security threat. In 2020, President Trump attempted to ban the app and force its sale to a U.S. firm. That effort collapsed, and when President Biden entered office, he rescinded the ban, which had been ruled unlawful in U.S. courts. Yet, calls to outlaw TikTok have resurfaced over the past year, and nearly half of all states have moved to ban the app on government-owned devices.
The ongoing debate over whether to allow TikTok to continue operating in the U.S. raises complex questions about the app’s hugely influential role in the American information ecosystem and in popular culture. At a time when Washington and Beijing are engaged in a wide-ranging conflict over who will control the technologies of tomorrow, who will control TikTok represents perhaps its most consequential battleground.
Corporate structures, gateways and audits
To address concerns that ByteDance’s ownership of TikTok would allow Beijing to influence the app, the proposal as described to CyberScoop would house TikTok’s American operations that are relevant to national security in a separate corporate entity — TikTok U.S. Data Security. The new organization would have an independent board of directors to be approved by CFIUS, a Treasury Department-led panel that reviews foreign investments, and a staff expected to total 2,500 to run the American version of the app and review U.S. content moderation policies. By virtue of its corporate structure and a technical infrastructure based in the United States, the proposal envisions a U.S. version of TikTok shielded from its Chinese owners.
As described by the TikTok official, the company’s proposal relies on Oracle to operate so-called “gateways” that would wall off the U.S. app and American user data from the rest of the world. In doing so, these gateways would only allow data permitted by CFIUS to transit from the walled-off U.S. version to infrastructure elsewhere in the world. A third party would verify that U.S. user data has been deleted once transferred to the U.S. system. “No bit or byte goes in or out of the Oracle cloud unless it goes through these gateways, and only data that is permitted by CFIUS is allowed,” the official said.
TikTok’s proposal relies on Oracle and a yet-to-be-identified third party to audit the app’s source code and recommendation algorithm. To ensure that the code base reviewed by Oracle is the same code that makes it onto users’ phones, Oracle would compile the app and deliver it to app stores.
Taken together, the proposal aims to sever TikTok from Beijing. “This independent board reports to CFIUS it doesn’t report to global TikTok or to ByteDance,” Sacks said. “We’re talking about fully localizing the data access, the recommendation system, source code, personnel within a multi-layered system of U.S. government oversight.”
A spokesperson for TikTok said the company is beginning to implement provisions of the agreement as negotiations with CFIUS continue. “This is a comprehensive package of measures with layers of government and independent oversight to ensure that there are no backdoors into TikTok that could be used to manipulate the platform,” said Brooke Oberwetter. “These measures go beyond what any peer company is doing today on security.”
For Washington policymakers, the perceived threat from TikTok is two-fold: that by amassing 100 million American users, China has a powerful trove of personal data to feed its data-hungry surveillance systems and that the app’s powerful algorithm gives Beijing a powerful propaganda tool.
To allay these fears, TikTok has taken a more transparent approach in describing the data-protection measures it is putting in place to prevent the forced sale of the company or from being banned from the U.S.. The company has stepped up its PR operation, too, with TikTok and ByteDance collectively spending $1.2 million on lobbying in the fourth quarter of last year and hiring blue-chip Washington powerbrokers, such as one-time Senate minority leader Trent Lott, the quintessential Southern Good Old Boy politician turned influence peddler.
So far, its proposals and PR push have done little to mollify its most strident critics. “As long as TikTok remains under the ownership of ByteDance, a firm that is legally beholden to the Chinese Communist Party, no deal will ever address the app’s major security concerns,” Sen. Marco Rubio, the Florida Republican, told CyberScoop. “TikTok should be fully divested from Chinese ownership, or it should be banned from the United States altogether.”
‘A game of cat and mouse’
With 100 million users, TikTok is reshaping the social media landscape in the United States, and with 1 billion users globally, it represents one of the few real threats to the dominant social media platforms owned by Meta. TikTok’s meteoric popularity hinges on the company’s artificial intelligence technology, which powers the app’s recommendation engine. Rather than relying on a user’s social graph to determine what content to display, TikTok plumbs the app’s entire content library to decide what it shows. That recommendation engine can figure out what content users will engage with — and keep them coming back for more.
The recommendation engine lies at the heart of fears that Beijing could subvert the app. Decisions made by recommendation systems can be difficult to understand from the outside — a phenomenon AI experts call the “black box” problem — and their opaque nature means that Beijing could in theory secretly choose what content to promote and suppress.
TikTok proposes to address these problems by relying on Oracle to audit its recommendation algorithm and ensure the algorithm isn’t suppressing content that China doesn’t like. “They’re going to make sure that the model that takes down videos with too much skin isn’t also taking down anti-China content,” the TikTok official said. “Oracle can review the algorithms, the software, the data models, exactly how all the stuff works.”
TikTok’s proposal places immense responsibility on Oracle — and as-yet-unidentified third-party auditors — to address concerns regarding the code base, the algorithm and data security.
While the exact size of TikTok’s code base is unknown, computer security experts estimate that it could be more than 1 million lines of code — and perhaps larger. Inspecting such a large code base for flaws or backdoors represents a herculean task. A third-party auditor will carry out a separate review, but that auditor can’t be identified until CFIUS signs off on the proposal.
Auditing TikTok’s algorithm represents an equally challenging task. Understanding why recommendation algorithms make certain decisions represents a difficult computer science problem, and while there have been advances in recent years to build auditable algorithms, it remains unclear whether TikTok’s proposal will satisfy questions about whether the app’s algorithm is — or could be — subverted by Beijing.
“It’s not as though these recommendation algorithms are set in stone things — they are an agile piece of software in and of themselves,” said Klon Kitchen, a technology expert at the American Enterprise Institute. “How can you meaningfully assess the reliability of something that is always changing by definition?”
Oracle will be responsible for operating the gateways that sit at the border of the U.S. version of TikTok and oversee data flows from inside the U.S. entity to the rest of the world and ensure that data only approved by CFIUS passes through the gateway. Pellaeon Lin, a senior fellow at Citizen Lab who has studied TikTok’s privacy and security features, said maintaining the integrity of such a system would amount to a “cat and mouse game” in which Oracle would need to constantly guard against ways to undermine the gateway regime. “It’s still technically possible to bypass the gateway just like it’s possible to bypass the Great Firewall of China.”
Oracle did not respond to an interview request for this article.
The political battleground
Concerns about TikTok’s presence in the U.S. are as much political as they are technical. At the heart of the argument that TikTok poses a threat to America are provisions of Chinese law requiring its domestic companies to turn over data at the government’s requests.
TikTok’s proposal in its totality — between its corporate governance reforms, the use of gateways to govern data transfer and source code and algorithm audits — tries to create a structure to address that concern, but for computer security experts who view these aspects of Chinese law as fundamentally incompatible with operating in the U.S., the provisions of TikTok’s proposal fall short. “What none of them do is decisively address the underlying challenge of Chinese law, which is exceedingly clear: Chinese companies and their derivative companies no matter where they operate must make every bit and byte of data that they collect or store available to the Chinese government,” Kitchen said.
There are plenty of reasons for TikTok critics to be worried. Last year, BuzzFeed reported that “China-based employees of ByteDance have repeatedly accessed nonpublic data about U.S. TikTok users,” even as the company has pledged to transfer American user data to servers in the U.S. Later in 2022, Forbes uncovered that TikTok employees had used internal data to track journalists reporting on the company in a bid to root out leakers. Amid widespread anti-China protests in Hong Kong, the app appeared to censor content from the protest movement. And amid China’s human rights atrocities against the Uighur people, TikTok suppressed content about events in the Xinjiang region.
With no comprehensive approach to address the risks posed by TikTok, states and Congress have taken piece-meal action against the app. A growing number of states have banned TikTok from use on government devices, and Congress late last year passed a measure forbidding TikTok on federal devices. Faced with a complex proposal before CFIUS to mitigate TikTok’s security risks, Lisa Monaco, the No. 2 official at the Justice Department, is reportedly skeptical that the proposal is sufficiently “tough on China,” as The New York Times put it. Meanwhile, banning the app outright would create massive political backlash, especially among young Americans for whom the app is an essential aspect of daily life.
While the Biden administration has taken a series of aggressive moves to limit Chinese access to U.S. technology, banning an app best known for its viral dance challenges would represent a major escalation in the White House’s war on Chinese influence — at a time when Washington is seeking to cool tensions with Beijing. “The whole thing is a mess,” said a former government official who until recently sat on CFIUS and spoke on condition of anonymity to describe the difficulty of inking an agreement.
With its narrow focus on addressing U.S. concerns, some experts see the CFIUS proposal as the first step in the United States abandoning its vision of an open internet. If approved, the proposal would fundamentally change “the way that the internet is governed,” create a “blueprint” for how other countries could force companies to localize their operations and leave U.S. companies with little credibility to push back, Sacks said.
“We see that model in China, we see that model in the E.U.,” she added. “Now we’ve just fueled a race to the bottom on that discussion of digital sovereignty.”
With the CFIUS process seemingly frozen in place, some voices within Congress are growing impatient, and Sen. Josh Hawley, R-Mo., has said he plans to introduce a bill banning TikTok nationwide. Sen. Mark Warner, D-Va., has advocated for a more comprehensive approach for governing foreign apps. His office declined to comment for this story but in an interview with The Washington Post earlier this week the chairman of the Senate Intelligence Committee wondered whether it’s time to take a new approach: “Is there a way that we can broadly look at foreign-based technology applications that raise serious national security concerns? … “I would even argue that for some of this, that even CFIUS may not be the right venue.”
Tonya Riley contributed reporting to this article.
