TikTok Creators’ Financial Info, Social Security Numbers Have Been Stored In China

Forbes has learned that the financial information and social security numbers of TikTok creators have been stored in China without their knowledge.

Over the past several years, thousands of TikTok creators and businesses around the world have given the company sensitive financial information—including their social security numbers and tax IDs—so that they can be paid by the platform.

But unbeknownst to many of them, TikTok has stored that personal financial information on servers in China that are accessible by employees there, Forbes has learned.

TikTok uses various internal tools and databases from its Beijing-based parent ByteDance to manage payments to creators who earn money through the app, including many of its biggest stars in the United States and Europe. The same tools are used to pay outside vendors and small businesses working with TikTok. But a trove of records obtained by Forbes from multiple sources across different parts of the company reveals that highly sensitive financial and personal information about those prized users and third parties has been stored in China. The discovery also raises questions about whether employees who are not authorized to access that data have been able to. It draws on internal communications, audio recordings, videos, screenshots, documents marked “Privileged and Confidential,” and several people familiar with the matter.

In testimony before Congress earlier this year, TikTok CEO Shou Zi Chew claimed U.S. user data has been stored on physical servers outside China. “American data has always been stored in Virginia and Singapore in the past, and access of this is on an as-required basis by our engineers globally,” he said under oath at a House hearing in March.

TikTok spokesperson Alex Haurek said in a statement that “we remain confident in the accuracy of Shou’s testimony.” ByteDance did not respond to a detailed request for comment. At publication time, neither company had answered basic questions about whether sensitive tax information of U.S. citizens is stored and accessible in China.

Over the last year, TikTok has been touting its plans to cordon off Americans’ data from China in a $1.5 billion undertaking called Project Texas. That initiative has been central to negotiations with the Biden administration on a deal that would allow the wildly popular app to continue operating in the U.S., despite longstanding national security concerns about its Chinese ownership and the potential for the platform to be used to surveil or influence the 150 million Americans using it. But since those talks hit a snag late last year, with both FBI Director Christopher Wray and Treasury Secretary Janet Yellen speaking out about national security issues with the app, the Biden administration (through the Committee on Foreign Investment in the U.S.) has demanded that TikTok split from its Chinese parent company or face a possible ban.

“There’s ongoing litigation over TikTok that is not yet resolved,” Yellen, whose department leads CFIUS, said at a hearing in March. And many in Congress have cast doubt on Project Texas altogether: “I don’t believe that it is technically possible to accomplish what TikTok says it will accomplish through Project Texas,” California Republican Jay Obernolte told the TikTok CEO at the March hearing. “There are too many backdoors.”

“Even if TikTok was not a subsidiary of a Chinese company, this would be pretty alarming IT security malpractice.”Former White House and CIA national security lawyer Bryan Cunningham

Identity theft using stolen social security numbers is not uncommon in the U.S., and the Chinese government has been accused of stealing personal financial information from Americans before. One expert told Forbes this is precisely why TikTok’s mishandling of such information is troubling.

“Even if TikTok was not a subsidiary of a Chinese company, this would be pretty alarming IT security malpractice,” Bryan Cunningham, a former national security lawyer for the White House and CIA, told Forbes. He described tax records as some of the most sensitive data there is.

“It could be just bad IT practice, it could be they felt like they had a legitimate business need,” Cunningham said of TikTok. “But whatever the nuance of that turns out to be… if you store information in the PRC, you better assume that the intelligence services can have it if they want it. They may not target you, but boy, on the face of it, it’s highly questionable.”

TikTok and ByteDance did not respond to questions about how many people at the companies can access creators’ financial information, where those employees are located and whether there has been unauthorized access to this data. They also did not respond to queries about how long TikTok users and vendors’ payment data had been stored in China and whether it still is today.

Raising regulatory alarms on both sides of the Atlantic

TikTok or ByteDance employees in China having access to American users and businesses’ sensitive financial records is potentially problematic for geopolitical reasons, particularly against the backdrop of intense regulatory scrutiny in the U.S.

Though there is no national privacy law in the U.S. to protect against the mishandling or misuse of personally identifiable information, one top contender introduced last Congress would require companies to clearly disclose in their privacy policies whether data they collect “is transferred to, processed in, stored in, or otherwise accessible to the People’s Republic of China” and other adversaries. And though a past Federal Trade Commission settlement with TikTok (then Musical.ly) dealt with a markedly separate set of issues—children’s privacy violations—the agency could take that order into consideration when evaluating the company’s conduct today.

Due to viral videos posted on TikTok and other social media platforms, teaching people how to start cars with USB cables and exploit a security vulnerability in some models, several Kia and Hyundai cars were stolen.

Read more

GreatGameIndia is being actively targeted by powerful forces who do not wish us to survive. Your contribution, however small help us keep afloat. We accept voluntary payment for the content available for free on this website via UPI, PayPal and Bitcoin.

Support GreatGameIndia